Updated the image to use a distroless image instead of FROM scratch.
Related Issues / PRs
Resolves: #41
Thought Process
Looking into this more, people have already done the work of creating a bare minimum image that just needs a binary placed in it to run. These are well supported and are kept up to date.
I've updated the builder stage to just build the binary, and then the distroless stage just copies it over, and set's the user to be a non-root user. No need to copy over timezone data or certs, they already exist.
I tried to take advantage of how the layers are built and caching, so I've set each command in the file to work from least likely to change, to most likely.
Overview
Updated the image to use a distroless image instead of FROM scratch.
Related Issues / PRs
Resolves: #41
Thought Process
Looking into this more, people have already done the work of creating a bare minimum image that just needs a binary placed in it to run. These are well supported and are kept up to date.
I've updated the builder stage to just build the binary, and then the distroless stage just copies it over, and set's the user to be a non-root user. No need to copy over timezone data or certs, they already exist.
I tried to take advantage of how the layers are built and caching, so I've set each command in the file to work from least likely to change, to most likely.
Testing Steps
or deploy to fly:
Risks
Low risk, this should harden the image.