* [Topics](/en/topics "Topics") * [Linux](/en/topics/linux "Linux") * What is a golden image? What is a golden image? ======================= Published August 31, 2022•*4*-minute read Copy URL Jump to section --------------- OverviewBaselines empower admins in the cloudWhy use a golden image?Some best practices for golden imagesGolden images and the Red Hat portfolio Overview -------- In media production, a *gold image* is the final cut of an album or film after all edits and mixing have been completed. It’s in its final, perfect form–it’s gold. This meaning carried over into systems administration. In this context, a golden image is an intentionally configured snapshot of a system, (server, virtual desktop environment, or even a disk drive) which can be used to deploy new instances. Because this golden image (or sometimes gold image) is used in network virtualization to create new systems, it is also called a *master image* or *clone image*. Another popular term is a baseline image, which can be an illustrative term to frame why golden images are so useful: they create a consistent, reliable baseline for system configuration, which can make it easier to maintain those systems across their life cycle. [Innovate with Red Hat Enterprise Linux](/en/resources/make-most-of-your-linux-experience-ebook) Baselines empower admins in the cloud ------------------------------------- The concept of golden images starts with [virtual machines](/en/topics/virtualization/what-is-a-virtual-machine), which themselves are specially configured and launched from templates. With virtual environments, golden images offer two key benefits: *convenience* and *consistency*. Using a predefined template image allows administrators to deploy systems consistently with clear and known configuration. [Cloud computing](/en/topics/cloud-computing) is essentially virtual environments at a massive scale; the underlying concepts and technologies are very similar, and the differences come down to hardware management and user experience. The main difference with cloud computing is volume–instances can be deployed, changed, or removed quickly and without restraints from resource consumption or access. With cloud computing, golden images are valuable IT management tools, with the ability to scale by allowing admins to deploy large numbers of instances very quickly while maintaining consistency. Cloud computing adds complexity to infrastructures; consistency across your systems (really, standard operating environments, otherwise known as an SOE) allows administrators to perform common admin tasks at scale, like patching systems, upgrading packages, even granting user access to required services. This video can't play due to privacy settings To change your settings, select the "Cookie Preferences" link in the footer and opt in to "Advertising Cookies or try disabling adblockers." Recommended for you Building the Future Using Bootable Containers --------------------------------------------- [Watch the webinar](https://www.redhat.com/en/events/webinar/building-future-using-bootable-containers?percmp=RHCTG0250000455235) Why use a golden image? ----------------------- The reasons to use golden images in your environment hit every stage of your system life cycle. * *Faster deployment*. Using golden images help you to deploy faster in cloud environments, both through scripting and automation or in ad hoc instances. * *Reduced human error*. [According to the IBM Cyber Security Intelligence Index](https://threatcop.com/blog/top-5-cyber-attacks-and-security-breaches-due-to-human-error), 95% of breaches are caused by human error such as misconfigurations, unpatched systems, or poor access controls. Having a predefined and tested template reduces the risk of human error causing a vulnerable system. * *Faster patch management and upgrades*. Having defined templates helps with visibility and monitoring because it is possible to see quickly what systems require a patch or an updated package, or which ones are affected by a [security vulnerability](/en/topics/security). It also allows for effective use of [automation](/en/topics/automation), rather than having to update each system individually and risking missing or misconfiguring systems. * *Maintaining configuration*. "Configuration drift" is a somewhat recognized term, but there is still a lot of confusion. *Drift* means that a system has changed from an ideal baseline, either through adding or modifying applications, changing security settings, or changing system configurations between the data center and recovery systems. Without a baseline, it can be very difficult to identify when or how systems have been modified–and this can be crucial to maintain compliance systems for regulatory and industry standards. Using a baseline means that you can monitor systems for drift (which you can do for [Red Hat® Enterprise Linux®](/en/technologies/linux-platforms/enterprise-linux) and [Red Hat OpenShift®](/en/technologies/cloud-computing/openshift) systems through [Red Hat Lightspeed, formerly Red Hat Insights](/en/lightspeed)). Security is not a configuration setting, [good security is a practice](/en/topics/security/cloud-security). It’s the cumulative effect of many different administrative and process choices. You can incorporate your specific security requirements and practices into your baseline images, which helps maintain your security posture even in different cloud environments and different footprints. [Manage security and compliance through effective automation](/en/engage/improve-security-compliance-ebook "SOLP: Manage security and compliance risk on open source Linux") Some best practices for golden images ------------------------------------- Unlike in media production, IT systems are never "done". Good IT practice requires maintaining the entire life cycle of systems, and with golden images, that requires maintaining both the image catalog and the systems deployed using the templates. * *Have a separate virtual environment to create new images*. When using a tool like Red Hat Enterprise Linux [image builder](/en/topics/linux/what-is-an-image-builder) to create a new base image, it is strongly encouraged to use a dedicated virtual machine because of the specific security requirements for the system. * *Consider setting up roles, groups, and services within your system configuration*. One of the bottlenecks for cloud deployments isn’t deploying a new instance, it’s granting the right user and service access to new instances. Use the system security configuration to have required groups and roles done as part of the deployment process to make the overall authentication/authorization process more streamlined. * *Test before you launch*. Have a QA process in place to test that the configuration (especially around applications and security) meet your requirements. Test for performance–packages should be optimized for the specific cloud environment in which they’ll be used. * *Update images when new packages are released*. It’s easy to create new images or edit images using tools like image builder. To maintain the security and capabilities of the images, update the images as new versions of included packages are available. * *Monitor your deployed systems*. Services like Red Hat Lightspeed give visibility over your entire infrastructure, and using a set of baseline images can make it easier to identify vulnerable systems, create playbooks for automation, and track drift within systems. * *Have processes to retire images and systems*. Create explicit policies for updating and deprecating images within your catalog and how to manage systems as images are changed and retired. * *Make images for a specific purpose*. Identify different profiles that you use within your environment, and create baseline images that are specific for those different purposes. There is no reason to have a one-size-fits-all image, and using more custom images can help attain requirements around performance or security. Golden images and the Red Hat portfolio --------------------------------------- If you want to build your own images, Red Hat Enterprise Linux has a [tool called image builder](https://www.redhat.com/sysadmin/rhel-image-builder), which can be run locally or [through Red Hat Hybrid Cloud Console as a hosted service](https://www.redhat.com/en/blog/announcing-full-support-new-red-hat-enterprise-linux-image-builder-service). Image builder breaks creating a custom image into a handful of simple steps: Get package recommendations (powered by [Red Hat Enterprise Linux's gen AI tools](/en/technologies/linux-platforms/enterprise-linux-10/gen-ai-tools)), select your packages, set the configuration, and then optimize the underlying operating system for a specific cloud environment. Red Hat also has a program called [Cloud Access](/en/technologies/cloud-computing/cloud-access), which allows organizations to use their subscription with public cloud providers. As part of the Cloud Access program, [Red Hat has created certified, prebuilt images](https://access.redhat.com/documentation/en-us/red_hat_subscription_management/1/html/red_hat_cloud_access_reference_guide/understanding-gold-images_cloud-access) for [Amazon Web Services (AWS)](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-aws), [Microsoft Azure](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-azure), and [Google](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-google-cloud) clouds for all of the major products from Red Hat, including Red Hat Enterprise Linux, middleware, and storage. Red Hat even has optimized, OCI-compliant container images as part of its [Universal Base Image Catalog](https://developers.redhat.com/products/rhel/ubi). [See what Red Hat Enterprise Linux can offer your strategic IT plans](/en/resources/make-most-of-your-linux-experience-ebook "Expand innovation and operational efficiency with Linux") Recommended for you E-book How an open solution is key to enterprise IT challenges ------------------------------------------------------- Read how Red Hat’s open hybrid cloud portfolio provides a consistent foundation for applications in nearly any environment. Download today. [Read the e-book](https://www.redhat.com/en/resources/open-solution-key-to-enterprise-challenges-ebook?percmp=RHCTG0250000455234) Recommended for you Red Hat Certified Specialist in Security: Linux exam ---------------------------------------------------- validates your knowledge and abilities in securing Red Hat® Enterprise Linux® [View exam](https://www.redhat.com/en/services/training/ex415-red-hat-certified-specialist-security-linux-exam?percmp=RHCTG0250000455236) Keep reading ------------ ### What is an image builder? An image builder is a tool used to create a copy of a virtual system or configuration that can then be used as a base from which developers can build and deploy these systems on other machines or platforms. [Read the article](/en/topics/linux/what-is-an-image-builder "article | What is an image builder?") ### Why choose Red Hat for Linux? Workloads need to be portable and scalable across environments. Red Hat Enterprise Linux is your consistent, stable foundation across hybrid cloud deployments. [Read the article](/en/topics/linux/why-choose-red-hat-enterprise-linux "article | why choose red hat for linux?") ### What is Linux? Linux is an open source operating system made up of the kernel, the base component of the OS, and the tools, applications, and services bundled with it. [Read the article](/en/topics/linux/what-is-linux "article | what is linux?") Linux resources --------------- ### Related content * Blog post [Simplify Red Hat Enterprise Linux provisioning in image builder with new Red Hat Lightspeed security and management integrations](/en/blog/simplify-red-hat-enterprise-linux-provisioning-image-builder-new-red-hat-lightspeed-security-and-management-integrations) * Case study [Advent One modernizes IT with Red Hat](/en/resources/advent-one-case-study) * Blog post [More than meets the eye: Behind the scenes of Red Hat Enterprise Linux 10 (Part 5)](/en/blog/more-meets-eye-behind-scenes-red-hat-enterprise-linux-10-part-5) * Blog post [Announcing general availability of SQL Server 2025 on Red Hat Enterprise Linux 10](/en/blog/announcing-general-availability-sql-server-2025-red-hat-enterprise-linux-10) ### Related articles * [What is an image builder?](/en/topics/linux/what-is-an-image-builder) * [Red Hat OpenShift for developers](/en/technologies/cloud-computing/openshift/developers) * [What is a Linux container?](/en/topics/containers/whats-a-linux-container) * [Why choose Red Hat for Kubernetes?](/en/topics/containers/why-choose-red-hat-kubernetes) * [Why choose Red Hat for Linux?](/en/topics/linux/why-choose-red-hat-enterprise-linux) * [How to move to Red Hat Enterprise Linux from other Linux distros](/en/technologies/linux-platforms/enterprise-linux/migration-process/convert2rhel) * [Linux for cloud computing](/en/topics/linux/linux-for-cloud-computing) * [What is Linux?](/en/topics/linux/what-is-linux) * [What is post-quantum cryptography?](/en/topics/security/post-quantum-cryptography) * [Why run Microsoft SQL Server on Linux?](/en/topics/linux/why-run-sql-server-on-linux) * [What is CaaS?](/en/topics/cloud-computing/what-is-caas) * [What is the SAP HANA migration?](/en/topics/linux/what-is-sap-hana-migration) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [What is Podman Desktop?](/en/topics/containers/what-is-podman-desktop) * [What is Podman?](/en/topics/containers/what-is-podman) * [Containers vs. VMs: Similarities, differences, and combined approaches](/en/topics/containers/containers-vs-vms) * [Edge computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/edge-computing) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [Why run Linux on AWS?](/en/topics/linux/linux-on-aws) * [What is high availability?](/en/topics/linux/what-is-high-availability) * [What is container orchestration?](/en/topics/containers/what-is-container-orchestration) * [What is ERP?](/en/topics/linux/what-is-erp) * [What is SAP HANA (and why does it run on Linux)?](/en/topics/linux/sap-hana-and-linux) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [Why run Linux on IBM Cloud](/en/topics/linux/linux-on-ibm-cloud) * [What is CentOS Stream?](/en/topics/linux/what-is-centos-stream) * [Stateful vs stateless applications](/en/topics/cloud-native-apps/stateful-vs-stateless) * [Why choose Red Hat Enterprise Linux on Azure?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-azure) * [What is Kubernetes?](/en/topics/containers/what-is-kubernetes) * [Why choose Red Hat Enterprise Linux on AWS?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-on-aws) * [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware) * [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt) * [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift) * [Linux on Azure](/en/topics/linux/linux-on-azure) * [What to know for Red Hat Enterprise Linux 7 End of Maintenance](/en/technologies/linux-platforms/enterprise-linux/rhel-7-end-of-maintenance) * [Red Hat Enterprise Linux migration process](/en/technologies/linux-platforms/enterprise-linux/migration-process) * [What is CentOS?](/en/topics/linux/what-is-centos) * [What to know about CentOS Linux EOL](/en/topics/linux/centos-linux-eol) * [Why run Linux on Google Cloud?](/en/topics/linux/linux-on-google-cloud) * [Red Hat Satellite on Red Hat Enterprise Linux](/en/technologies/management/satellite/satellite-for-rhel) * [What is the Kubernetes Java client?](/en/topics/cloud-computing/what-is-kubernetes-java-client) * [What are hosted control planes?](/en/topics/containers/what-are-hosted-control-planes) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Why choose Red Hat Enterprise Linux on Google Cloud?](/en/technologies/linux-platforms/enterprise-linux/why-choose-red-hat-enterprise-linux-google-cloud) * [What is Linux kernel live patching?](/en/topics/linux/what-is-linux-kernel-live-patching) * [How Kubernetes can help AI/ML](/en/topics/cloud-computing/how-kubernetes-can-help-ai) * [What is Kubeflow?](/en/topics/cloud-computing/what-is-kubeflow) * [What are microservices?](/en/topics/microservices/what-are-microservices) * [What is container security?](/en/topics/security/container-security) * [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack) * [What is Buildah?](/en/topics/containers/what-is-buildah) * [What are sandboxed containers](/en/topics/containers/sandboxed-containers) * [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack) * [What are validated patterns?](/en/topics/cloud-computing/what-are-validated-patterns) * [Kubernetes on AWS: Self-Managed vs. Managed Applications Platforms](/en/topics/containers/kubernetes-on-aws) * [What's the best Linux distro for you?](/en/topics/linux/whats-the-best-linux-distro-for-you) * [What's the difference between Fedora and Red Hat Enterprise Linux](/en/topics/linux/fedora-vs-red-hat-enterprise-linux) * [What is a Linux server?](/en/topics/linux/linux-server) * [What is a configuration file?](/en/topics/linux/what-configuration-file) * [Red Hat OpenShift vs. OKD](/en/topics/containers/red-hat-openshift-okd) * [What is high performance computing (HPC)?](/en/topics/high-performance-computing/what-is-high-performance-computing) * [Red Hat OpenShift vs. Kubernetes: What's the difference?](/en/technologies/cloud-computing/openshift/red-hat-openshift-kubernetes) * [Why run Apache Kafka on Kubernetes?](/en/topics/integration/why-run-apache-kafka-on-kubernetes) * [What is high availability and disaster recovery for containers?](/en/topics/containers/high-availability-containers) * [Spring on Kubernetes with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/spring) * [What are Red Hat OpenShift cloud services?](/en/technologies/cloud-computing/openshift/what-are-red-hat-openshift-cloud-services) * [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference) * [What is a container registry?](/en/topics/cloud-native-apps/what-is-a-container-registry) * [What is an ARM processor?](/en/topics/linux/what-is-arm-processor) * [ARM vs x86: What's the difference?](/en/topics/linux/ARM-vs-x86) * [What is Skopeo?](/en/topics/containers/what-is-skopeo) * [What are Red Hat OpenShift Operators?](/en/technologies/cloud-computing/openshift/what-are-openshift-operators) * [Using Helm with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/helm) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [Orchestrating Windows containers on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/windows-containers-on-red-hat-openshift) * [What is a Kubernetes operator?](/en/topics/containers/what-is-a-kubernetes-operator) * [What is MPLS?](/en/topics/edge-computing/what-is-mpls) * [High performance computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/high-performance-computing) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [What is KubeLinter?](/en/topics/containers/what-is-kubelinter) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [How microservices support IT integration in healthcare](/en/topics/microservices/microservices-in-healthcare) * [Kubernetes cluster management](/en/technologies/cloud-computing/openshift/kubernetes-cluster-management) * [Red Hat OpenShift on IBM IT infrastructure](/en/technologies/cloud-computing/openshift/what-is-red-hat-openshift-on-IBM-IT-infrastructure) * [Red Hat OpenShift for business leaders](/en/technologies/cloud-computing/openshift/business-leaders) * [How to deploy Red Hat OpenShift](/en/technologies/cloud-computing/openshift/deploy-red-hat-openshift) * [Cost management for Kubernetes on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/cost-management) * [What makes Red Hat OpenShift the right choice for SAP?](/en/technologies/cloud-computing/openshift/sap) * [Kubernetes-native Java development with Quarkus](/en/technologies/cloud-computing/openshift/quarkus) * [What is enterprise Kubernetes?](/en/topics/containers/what-is-enterprise-kubernetes) * [What makes Red Hat OpenShift the right choice for IT operations?](/en/technologies/cloud-computing/openshift/it-operations) * [What is Kubernetes role-based access control (RBAC)](/en/topics/containers/what-kubernetes-role-based-access-control-rbac) * [What is containerization?](/en/topics/cloud-native-apps/what-is-containerization) * [What is a Linux certification?](/en/topics/linux/linux-certification) * [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos) * [Learning Kubernetes basics](/en/topics/containers/learning-kubernetes-tutorial) * [What is service-oriented architecture?](/en/topics/cloud-native-apps/what-is-service-oriented-architecture) * [What is the Kubernetes API?](/en/topics/containers/what-is-the-kubernetes-api) * [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management) * [What is a Kubernetes deployment?](/en/topics/containers/what-is-kubernetes-deployment) * [Why choose the Red Hat build of Quarkus?](/en/topics/cloud-native-apps/why-choose-red-hat-quarkus) * [Introduction to Kubernetes architecture](/en/topics/containers/kubernetes-architecture) * [Introduction to Kubernetes patterns](/en/topics/cloud-native-apps/introduction-to-kubernetes-patterns) * [What is a Kubernetes cluster?](/en/topics/containers/what-is-a-kubernetes-cluster) * [What is Quarkus?](/en/topics/cloud-native-apps/what-is-quarkus) * [What is Jaeger?](/en/topics/microservices/what-is-jaeger) * [What is SELinux?](/en/topics/linux/what-is-selinux) * [What is the Linux kernel?](/en/topics/linux/what-is-the-linux-kernel) * [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization) * [What is Knative?](/en/topics/microservices/what-is-knative) * [What is Clair?](/en/topics/containers/what-is-clair) * [What is etcd?](/en/topics/containers/what-is-etcd) * [Why choose Red Hat for microservices?](/en/topics/microservices/why-choose-red-hat-microservices) * [Why choose Red Hat for containers?](/en/topics/containers/why-choose-red-hat-containers) * [What is Docker?](/en/topics/containers/what-is-docker) * [What is a Kubernetes pod?](/en/topics/containers/what-is-kubernetes-pod) [More about this topic](/en/topics/linux "More about this topic")