Custom distroless Docker base image

A minimal, security-hardened base image for production containers, published at ghcr.io/morningstar-sudo/distroless-base:latest.

Why distroless?

• No shell, no package manager — an attacker who lands in the container has almost nothing to work with.
• Tiny CVE surface — only the runtime libraries the application actually needs; scanners stop drowning you in irrelevant findings.
• Small images — faster pulls, faster cold starts, cheaper registries.
• Immutable by design — nothing can be installed or modified at runtime; what you scanned is what runs.

How it's built

• Multi-stage build — build tools never reach the final layer.
• Pinned digests — every upstream stage is referenced by @sha256 digest, not by mutable tag.
• Non-root by default — the image ships with a nonroot user, so containers don't run as root unless you opt in.
• Secure CI pipeline — every build is scanned with Trivy, an SBOM is generated and attached, and the image is signed before publishing.

Using it

Build your application in a full-featured stage, then copy the binary onto the distroless base:

# Build stage: full toolchain
FROM golang:1.24-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /app ./cmd/server

# Runtime stage: distroless base — no shell, no package manager
FROM ghcr.io/morningstar-sudo/distroless-base:latest
COPY --from=build /app /app
USER nonroot
ENTRYPOINT ["/app"]

All published images are listed in the image catalog.