IMAGE_NAME Distroless

Minimal, secure IMAGE_NAME container images based on Google's distroless base.

Features

• Minimal footprint: Small image size, reduced attack surface
• Multi-architecture: linux/amd64 and linux/arm64
• Distroless base: No shell, no package manager
• Security-first: Runs as non-root (UID 65532), binaries owned by root
• Multiple versions: VERSION_1 and VERSION_2

Quick Start

# Basic usage
docker run -d \
  -p 8080:8080 \
  git.breis.ch/images/IMAGE_NAME:VERSION_2

# With persistent data
docker run -d \
  -v appdata:/app/data \
  -p 8080:8080 \
  git.breis.ch/images/IMAGE_NAME:VERSION_2

Available Tags

Tag	Version	Notes
VERSION_2, latest	VERSION_2.x	Latest stable
VERSION_1	VERSION_1.x	Previous stable

Environment Variables

Variable	Default	Description
APP_CONFIG	-	Configuration file path
APP_LOG_LEVEL	info	Log level (debug, info, warn, error)

Security

File Ownership

Path	Owner	Permissions
/app/bin/*	root	Execute only
/app/lib/*	root	Read only
/app/data/*	65532 (nonroot)	Read/Write

The application process cannot modify its own binaries.

Runtime Hardening (Recommended)

For maximum security, run with these Docker flags:

docker run -d \
  --read-only \
  --tmpfs /tmp \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  -v appdata:/app/data \
  -p 8080:8080 \
  git.breis.ch/images/IMAGE_NAME:VERSION_2

Flag	Purpose
--read-only	Immutable root filesystem
--tmpfs /tmp	Writable temp directory
--cap-drop=ALL	Drop all Linux capabilities
--security-opt=no-new-privileges	Prevent privilege escalation

For Kubernetes, use equivalent securityContext:

securityContext:
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
  runAsNonRoot: true
  runAsUser: 65532

Volumes

Path	Description
/app/data	Data directory (mount for persistence)

Ports

Port	Description
8080	Application port

Healthcheck

The image includes a built-in healthcheck:

docker inspect --format='{{.State.Health.Status}}' container_name

License

MIT License