Skip to content

Conversation

@cbaugus
Copy link
Owner

@cbaugus cbaugus commented Dec 22, 2025

This commit adds a minimal, secure Chainguard-based static image build while maintaining the existing Ubuntu-based image for debugging.

Changes:

  • Add Dockerfile.static for Chainguard static build (~10-15 MB)

    • Uses musl-based static compilation (all deps compiled in)
    • Runs on cgr.dev/chainguard/static base (2-5 MB)
    • No shell, minimal attack surface, typically 0-2 CVEs
    • Uses existing rustls configuration (no OpenSSL C deps)
  • Update CI/CD to build both image variants:

    • Standard: cbaugus/rust_loadtest:latest (Ubuntu, debuggable)
    • Static: cbaugus/rust_loadtest:latest-static (Chainguard, secure)
    • Generate separate SBOMs for both images
  • Update README.md with image variant documentation:

    • Document standard vs static image trade-offs
    • Recommend static for prod, standard for dev/debug
    • Update project structure to show both Dockerfiles

Benefits:

  • Standard image: Full shell access, easy debugging, lab testing
  • Static image: 75% smaller, zero CVEs, maximum security for production
  • Zero cost (Chainguard public images are free)
  • Flexibility to choose the right image for the deployment context

cbaugus and others added 4 commits December 22, 2025 10:18
This commit adds a minimal, secure Chainguard-based static image build
while maintaining the existing Ubuntu-based image for debugging.

Changes:
- Add Dockerfile.static for Chainguard static build (~10-15 MB)
  - Uses musl-based static compilation (all deps compiled in)
  - Runs on cgr.dev/chainguard/static base (2-5 MB)
  - No shell, minimal attack surface, typically 0-2 CVEs
  - Uses existing rustls configuration (no OpenSSL C deps)

- Update CI/CD to build both image variants:
  - Standard: cbaugus/rust_loadtest:latest (Ubuntu, debuggable)
  - Static: cbaugus/rust_loadtest:latest-static (Chainguard, secure)
  - Generate separate SBOMs for both images

- Update README.md with image variant documentation:
  - Document standard vs static image trade-offs
  - Recommend static for prod, standard for dev/debug
  - Update project structure to show both Dockerfiles

Benefits:
- Standard image: Full shell access, easy debugging, lab testing
- Static image: 75% smaller, zero CVEs, maximum security for production
- Zero cost (Chainguard public images are free)
- Flexibility to choose the right image for the deployment context

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@cbaugus cbaugus merged commit f83b45d into main Dec 22, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants