Base Image Strategy
Nexa standard
Section titled “Nexa standard”The default base-image family for Nexa Node.js, React build stages, Python/FastAPI services, and approved web-serving runtimes is Debian 12 Bookworm Slim.
Approved examples include:
FROM node:24-bookworm-slimFROM python:3.12-slim-bookwormPatch-level pinning may be introduced through centrally managed dependency automation where update cadence and compatibility testing are reliable. latest is prohibited.
Why Bookworm Slim
Section titled “Why Bookworm Slim”Bookworm Slim gives Nexa a consistent glibc-based runtime across Node and Python, broad compatibility with prebuilt Python wheels and native Node modules, predictable Debian package management, and a smaller final image than full Debian variants. Alpine is not the default because musl-related compatibility and build complexity can outweigh its size benefit for Nexa services.
Exceptions
Section titled “Exceptions”Alpine, Amazon Linux, distroless, or another base requires an approved ADR or engineering exception that records:
- the platform constraint or measurable benefit;
- dependency and debugging implications;
- vulnerability ownership;
- non-root execution and patch strategy;
- evidence that the image works across its required deployment targets.
A platform-specific integration requirement is not permission to install an entire build toolchain into the final runtime stage.
Future golden images
Section titled “Future golden images”A future golden-image program may publish centrally patched and signed Nexa Bookworm-based runtime images per language. Golden images require an owner, automated rebuilds, compatibility policy, SBOM, vulnerability SLA, and downstream rebuild notification before adoption.