Container Base Images

Windows offers four container base images that users can build from. Each base image is a different type of the Windows operating system, has a different on-disk footprint, and has a different set of the Windows API set.

Image discovery

All Windows container base images are discoverable through Docker Hub. The Windows container base images themselves are served from, the Microsoft Container Registry (MCR). This is why the pull commands for the Windows container base images look like the following:

docker pull

The MCR does not have its own catalog experience and is meant to support existing catalogs such as Docker Hub. Thanks to Azure’s global footprint and coupled with Azure CDN, the MCR delivers an image pull experience that is consistent and fast. Azure customers, running their workloads in Azure, benefit from in-network performance enhancements as well as tight integration with the MCR (the source for Microsoft container images), Azure Marketplace, and the expanding number of services in Azure that offer containers as the deployment package format.

Choosing a base image

How do you choose the right base image to build upon? For most users, Windows Server Core and Nanoserver will be the most appropriate image to use.


While you're free to target whichever image you wish, here are some guidelines to help steer your choice:

  • Does your application require the full .NET framework? If the answer to this question is yes, you should target Windows Server Core.
  • Are you building a Windows app based upon .NET Core? If the answer to this question is yes, you should target Nanoserver.
  • Are you building an IoT application? If the answer to this question is yes, you should target IoT Core.
  • Is the Windows Server Core container image missing a dependency your app needs? If the answer to this question is yes, you should attempt to target Windows. This image is much larger than the other base images, but it carries many of the core Windows libraries (such as the GDI library).
  • Are you a Windows Insider? If yes, you should consider using the insider version of the images. See "Base images for Windows insiders" below.


Many Windows users want to containerize applications that have a dependency on .NET. In addition to the four base images described here, Microsoft publishes several Windows container images that come pre-configured with popular Microsoft frameworks, such as a the .NET framework image and the ASP .NET image.

Base images for Windows Insiders

Microsoft provides "insider" versions of each container base image. These insider container images carry the latest and greatest feature development in our container images. When you're running a host that is an insider version of Windows (either Windows Insider or Windows Server Insider), it is preferable to use these images. The insider images are available on Docker Hub:

Read Use Containers with the Windows Insider Program to learn more.

Windows Server Core vs Nanoserver

Windows Server Core and Nanoserver are the most common base images to target. The key difference between these images is that Nanoserver has a significantly smaller API surface. PowerShell, WMI, and the Windows servicing stack are absent from the Nanoserver image.

Nanoserver was built to provide just enough API surface to run apps that have a dependency on .NET core or other modern open source frameworks. As a tradeoff to the smaller API surface, the Nanoserver image has a significantly smaller on-disk footprint than the rest of the Windows base images. Keep in mind that you can always add layers on top of Nano Server as you see fit. For an example of this check out the .NET Core Nano Server Dockerfile.