Use a distroless docker image

[techmunk]

Description

Have you considered using a distroless image for the docker build? One that doesn't include busybox?

I'm currently doing the following in my own Dockerfile and all seems to be working fine.

FROM ghcr.io/tale/headplane:latest AS headplane

FROM gcr.io/distroless/nodejs22-debian12:nonroot

COPY --from=headplane --chown=nonroot:nonroot /app /app
COPY --from=headplane --chown=nonroot:nonroot /usr/libexec/headplane /usr/libexec/headplane
COPY --from=headplane --chown=nonroot:nonroot /var/lib/headplane /var/lib/headplane

WORKDIR /app
CMD ["build/server/index.js"]

[tale]

Yes I have and I don't really know if I wanna do that because it's annoying to debug when there isn't any shell inside the container.

[techmunk]

That's reasonable. I wonder if you could do a multi-stage build and have a debug target? Or a different docker file for debug?

It's your project, and it's great the amount of effort you've put into a wonderful tool here. I'm happy maintaining my own dockerfile as shown above, but wondered if it's something you might consider to keep public facing services a bit more "secure".

[tale]

I could definitely consider it, I know Headscale personally uses this method with a debug image and whatnot. If it makes sense maybe I could add a little script inside of the container in /bin/sh which just prints out something like:

This image does not come with a shell to debug any issues you may have.
If you need a shell in the container, switch to the ghcr.io/tale/headplane:<version>-debug tag.

Thoughts?