Most secure base OS container images, ranked by isolation score¶
How isolated are the most-pulled base OS container images when you docker run them with plain defaults, no hardening flags? This page ranks 12 base operating system images (Alpine, Debian, Ubuntu, Fedora, Rocky Linux) on IronClaw's seven-dimension container containment scale (0-100), best-isolated first. Scores run 48/100 to 48/100 (average 48/100). Higher is safer. Every score comes from ironctl scan, a credential-free audit you can run on your own containers in ten seconds.
No base OS image ships fully isolated by default: the leaders still leave capabilities, egress, or a writable root filesystem open. The gap between any image here and a clean 100/100 grade A is a handful of
docker runflags, shown on every scorecard.
Ranked best to worst¶
| Rank | Image | Score | Grade | Top gaps (default config) |
|---|---|---|---|---|
| 🥇 1 | almalinux:9 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 🥈 2 | alpine:3.21 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 🥉 3 | amazonlinux:2023 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 4 | archlinux:latest |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 5 | busybox:1.37 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 6 | debian:12-slim |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 7 | fedora:41 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 8 | opensuse/leap:15.6 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 9 | oraclelinux:9 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 10 | photon:5.0 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 11 | rockylinux:9 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
| 12 | ubuntu:24.04 |
48/100 | 🟠 D | Dropped capabilities, Non-root user (uid != 0), Network isolation / egress |
Scan your own base OS container¶
These grades come from ironctl scan, one credential-free command that audits any running container, docker-compose service, or Kubernetes manifest, not just the base OS images ranked above:
# install (Homebrew)
brew install ironsecco/ironclaw/ironclaw
# grade your own container the same way this page was generated
ironctl scan my-container
- All container isolation scores →, every scorecard, worst-isolated first.
- Browse every category →, the full set of ranked collection pages.
- Container Isolation Leaderboard →, the whole dataset ranked, with a Hall of Fame and worst offenders.
- Scan any container →, the full command reference.
- The State of Container Isolation, 2026 →, the survey these grades are built from.
Part of the Container Isolation Scores directory. Generated from a reproducible survey by examples/isolation-survey/gen_scorecards.py and refreshed weekly, so this ranking never goes stale. Grades reflect each image's default configuration, not a limit of the image itself: every one reaches grade A with the right docker run flags.