Minimal Docker Images

Rust services fit small containers: multi-stage builds compile in a fat image, then copy a single binary into distroless or scratch (with CA certs if using HTTPS).

Recipe

# syntax=docker/dockerfile:1
 
FROM rust:1.97-bookworm AS builder
WORKDIR /app
COPY . .
RUN cargo build --release --locked
 
FROM gcr.io/distroless/cc-debian12
COPY --from=builder /app/target/release/my-service /my-service
USER nonroot:nonroot
ENTRYPOINT ["/my-service"]

When to reach for this:

• Production Kubernetes deployments
• Reducing attack surface and image pull time
• Compliance requirements forbidding shells in runtime images

Working Example

FROM rust:1.97-bookworm AS builder
WORKDIR /app
# Cache dependencies
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && echo "fn main() {}" > src/main.rs
RUN cargo build --release && rm -rf src
COPY . .
RUN cargo build --release --locked
 
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/*
COPY --from=builder /app/target/release/my-service /usr/local/bin/my-service
EXPOSE 8080
ENTRYPOINT ["/usr/local/bin/my-service"]

What this demonstrates:

• Dependency layer caching speeds rebuilds
• Runtime image has only binary plus CA bundle
• Non-root user in distroless variant

Deep Dive

Image Size Levers

HTTPS from Distroless

Distroless cc or static variants include CA roots; pure scratch needs manual ca-certificates copy.

Gotchas

• Running as root - container escape impact. Fix: USER nonroot or distroless nonroot.
• Missing ca-certificates - TLS fails mysteriously. Fix: copy certs or use distroless cc.
• Compiling in runtime stage - huge images. Fix: strict multi-stage separation.
• No shell for debugging - harder ad-hoc inspection. Fix: ephemeral debug pods with toolkit image.
• Stale Cargo.lock in Docker - non-reproducible builds. Fix: --locked and commit lockfile.

Alternatives

FAQs

Related

• Deployment basics
• musl & static linking
• CI/CD for Rust
• Configuration & secrets in prod

Stack versions: This page was written for Rust 1.97.0 (edition 2024), Tokio 1.x, Axum 0.8, serde 1.0, sqlx 0.8, clap 4, and Polars 0.46+.