--- title: 'DIY chiselled Ubuntu: crafting your own chiselled Ubuntu base image' description: Learn how to craft chiselled Ubuntu base images with this step-by-step guide. Chiselled Ubuntu images are Distroless, Appliance-type Ubuntu-based containers. url: https://canonical.com/blog/craft-custom-chiselled-ubuntu-distroless?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Valentin Viennot](https://canonical.com/blog/author/valentinviennot "More about Valentin Viennot") 10 January 2023 # DIY chiselled Ubuntu: crafting your own chiselled Ubuntu base image [cloud](https://canonical.com/blog/tag/cloud) [containers](https://canonical.com/blog/tag/containers) [docker](https://canonical.com/blog/tag/docker) [Security](https://canonical.com/blog/tag/security) [Tutorial](https://canonical.com/blog/tag/tutorial) --- Share the article **In a previous** [**post**](https://canonical.com/blog/combining-distroless-and-ubuntu-chiselled-containers)**, I explained how we made our Ubuntu image 15 times smaller by chiselling a specific slice of Ubuntu for .NET developers. In this blog, I will provide step-by-step instructions on customising your chiselled Ubuntu base images for any use case.** * Chiselled Ubuntu containers combine Distroless and Ubuntu to create smaller, more secure containers. * The reduced size of the containers reduces the overall attack surface. Combined with the support and content quality from the Ubuntu distribution, chiselled Ubuntu is a significant security improvement. * Chisel provides a developer-friendly CLI to install slices of packages from the upstream Ubuntu distribution onto container filesystems. That’s what chiselled Ubuntu containers could look like… well, if you ask the DALL-E2 AI. I don’t believe in a perfect container base image anymore. I remember thinking that Google’s [Distroless](https://www.youtube.com/watch?v=lviLZFciDv4) base was pretty close, but it turned out that the most perfect base image would in fact be `FROM scratch`:  only exactly what you need and installed from a popular, well-maintained and supported Linux distribution. Here’s how you can build your own. ## Step 1: Build Chisel with Docker To build chiselled Ubuntu images, you first need a chisel. The *chisel* package slicing tool used to craft chiselled Ubuntu base images is a Go application that currently doesn’t provide pre-built releases. Therefore, you’ll need to build it using the Golang SDK. I provided a [20-line Dockerfile](https://github.com/valentincanonical/chisel/blob/examples/Dockerfile) that shows how to build Chisel and package it as a container image using Docker, the Go SDK and Chisel itself! Once built, the output will be a less than 16MB chiselled Ubuntu-based *chisel* image, which is excellent proof of the effectiveness of chiselled Ubuntu images. The final *chisel* OCI image contains a custom chiselled Ubuntu base (mostly Glibc and CA certificates) and the Go-compiled Chisel tool, ready to be used in our future container builds. ## Step 2: DIY chiselled Ubuntu To create your own chiselled Ubuntu base image, you will start with a `FROM scratch` base image and add the necessary chiselled Ubuntu bits from your selected package dependencies. Inspired by Google’s Distroless [base](https://github.com/GoogleContainerTools/distroless/tree/main/base) image, for this example, I chose the following package slices from the Ubuntu distribution: *base-files\_base*, *base-files\_release-info*, *ca-certificates\_data*, and *libc6\_libs*. To do this, use the following 5-instruction [*Dockerfile*](https://github.com/valentincanonical/chisel/blob/examples/examples/chiselled-base.dockerfile): ``` # chiselled-base.dockerfile # "chisel:22.04" is our previous "chisel" image from Step 1 # we built and tagged it locally using the Docker CLI FROM chisel:22.04 as installer WORKDIR /staging # Use chisel to cut out the necessary package slices from the # chisel:22.04 image and store them in the /staging directory RUN ["chisel", "cut", "--root", "/staging", \ "base-files_base", \ "base-files_release-info", \ "ca-certificates_data", \ "libc6_libs" ] # Start with a scratch image as the base for our chiselled Ubuntu base image FROM scratch # Copy the package slices from the installer image # to the / directory of our chiselled Ubuntu base image COPY --from=installer [ "/staging/", "/" ] ``` Once you have created this *Dockerfile*, you can build your new chiselled Ubuntu image using the command: `docker build . -t chiselled-base:22.04 -f chiselled-base.dockerfile` Your custom chiselled Ubuntu base image should be around 5MB and is ready to run many C/C++, Golang, or other dynamically linked self-contained programs. You can test it using the [provided sample *Dockerfile*](https://github.com/valentincanonical/chisel/blob/examples/examples/example.dockerfile) that layers a C program on top of your new base image. ## Step 3: Add SSL support for your base image If your application requires SSL support, you can easily add it to your chiselled Ubuntu base image by [adding the following 30 characters](https://github.com/valentincanonical/chisel/blob/examples/examples/chiselled-ssl-base.dockerfile) to your previous *Dockerfile*: ``` # chiselled-ssl-base.dockerfile # "chisel:22.04" is our previous "chisel" image from Step 1 # we built and tagged it locally using the Docker CLI FROM chisel:22.04 as installer WORKDIR /staging RUN ["chisel", "cut", "--root", "/staging", \ "base-files_base", \ "base-files_release-info", \ "ca-certificates_data", \ "libc6_libs", \ "libssl3_libs", \ "openssl_config" ] FROM scratch COPY --from=installer [ "/staging/", "/" ] ``` To build your new chiselled Ubuntu base image with SSL support, use the command: `docker build . -t chiselled-ssl-base:22.04 -f chiselled-ssl-base.dockerfile` Your new base image with SSL support should be less than 11 MB and is ready for use in applications that require SSL. This simple process allows you to easily add and remove package dependencies and customise your chiselled Ubuntu base image to fit your specific needs and requirements. For more examples and use cases, including creating extra package slices, check out [our examples git repo](https://github.com/valentincanonical/chisel/tree/examples/examples). # Conclusion Chiselled Ubuntu container images offer the benefits of a well-known and well-maintained Linux distribution combined with the advantages of ultra-small Distroless-type container images, offering a secure and efficient foundation for building and deploying containerised applications. **So why not try chiselled Ubuntu container images and see the benefits for yourself? As they say, the proof is in the pudding – or in this case, the size of your container image!** * GitHub [repository for the full and commented code samples](https://github.com/valentincanonical/chisel/tree/examples/examples) as used in this article + further examples on how to build and use chiselled Ubuntu * Chisel in GitHub: * Chisel [documentation](https://canonical-rockcraft.readthedocs-hosted.com/en/latest/explanation.html#what-is-chisel) (WIP) * Chiselled Ubuntu for .NET [announcement](https://ubuntu.com/blog/install-dotnet-on-ubuntu) * And don’t forget to read the [previous blog post](https://canonical.com/blog/combining-distroless-and-ubuntu-chiselled-containers) (if you didn’t already!) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026