feat: Reduce image size with distroless image

.gitignore

@@ -0,0 +1 @@
+/target

Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "mumble-docker"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+regex = "1.10.3"
+libc = "0.2.152"
+
+[profile.release]
+lto = true
+codegen-units = 1
+opt-level = "s"
+strip = true

Dockerfile

@@ -1,4 +1,24 @@
-FROM ubuntu:20.04 as base
+ARG DEBIAN_RELEASE_NAME=bullseye
+ARG DEBIAN_RELEASE_NUM=11
+
+# ------------------------------------------------------#
+# --- Build stage for the entrypoint.sh replacement ----#
+# ------------------------------------------------------#
+FROM rust:slim-${DEBIAN_RELEASE_NAME} as builder
+WORKDIR /data
+COPY Cargo.toml /data
+COPY Cargo.lock /data
+RUN mkdir -p /data/src
+RUN echo 'fn main() {}' > /data/src/main.rs
+RUN cargo build
+COPY ./src/main.rs /data/src/main.rs
+RUN cargo build --release
+
+# ------------------------------------------------------#
+# --- Runtime image with mumble-server's dependencies --#
+# --- (Used to extract the shared libs from later) -----#
+# ------------------------------------------------------#
+FROM debian:${DEBIAN_RELEASE_NAME}-slim as base
 
 ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install --no-install-recommends -y \
@@ -26,6 +46,9 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
 
 
 
+# ------------------------------------------------------#
+# --- Build stage for mumble-server itself -------------#
+# ------------------------------------------------------#
 FROM base as build
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -62,8 +85,11 @@ RUN /mumble/scripts/clone.sh && /mumble/scripts/build.sh \
 && /mumble/scripts/copy_one_of.sh ./scripts/murmur.ini ./auxiliary_files/mumble-server.ini default_config.ini
 
 
-
-FROM base
+# ------------------------------------------------------#
+# --- Preparation stage that could run mumble ----------#
+# --- Determines config files and libs for final stage -#
+# ------------------------------------------------------#
+FROM base as runner
 ARG MUMBLE_UID=1000
 ARG MUMBLE_GID=1000
 
@@ -73,11 +99,35 @@ COPY --from=build /mumble/repo/build/mumble-server /usr/bin/mumble-server
 COPY --from=build /mumble/repo/default_config.ini /etc/mumble/bare_config.ini
 
 RUN mkdir -p /data && chown -R mumble:mumble /data && chown -R mumble:mumble /etc/mumble
-USER mumble
-EXPOSE 64738/tcp 64738/udp
+
+COPY copy-libs.sh /copy-libs.sh
 COPY entrypoint.sh /entrypoint.sh
+COPY --from=builder /data/target/release/mumble-docker/ /mumble-docker-entrypoint
+
+# Copy over all required shared libraries to /lib/copy so we can
+# reuse them in the distroless container in the final stage
+RUN /copy-libs.sh /mumble-docker-entrypoint /lib/copy
+RUN /copy-libs.sh /usr/bin/mumble-server /lib/copy
+RUN /copy-libs.sh /usr/lib/x86_64-linux-gnu/qt5/plugins/sqldrivers/libqsqlite.so /lib/copy
+RUN cp -r /usr/lib/x86_64-linux-gnu/qt-default /lib/copy
+RUN cp -r /usr/lib/x86_64-linux-gnu/qt5/ /lib/copy
+
+# ------------------------------------------------------#
+# --- Distroless base image for the final container --- #
+# --- Copying over needed libs from previous stage ---- #
+# ------------------------------------------------------#
+FROM gcr.io/distroless/cc-debian${DEBIAN_RELEASE_NUM}:latest
+COPY --from=runner /etc/passwd /etc/passwd
+COPY --from=runner /etc/shadow /etc/shadow
+COPY --from=runner /usr/bin/mumble-server /usr/bin/mumble-server
+COPY --from=runner /lib/copy /usr/lib/x86_64-linux-gnu
+COPY --from=runner /etc/mumble /etc/mumble
+COPY --chown=1000:1000 --from=runner /data /data
+COPY --from=runner /mumble-docker-entrypoint /mumble-docker-entrypoint
 
+USER mumble
+EXPOSE 64738/tcp 64738/udp
 VOLUME ["/data"]
-ENTRYPOINT ["/entrypoint.sh"]
+ENTRYPOINT ["/mumble-docker-entrypoint"]
 CMD ["/usr/bin/mumble-server", "-fg"]
 

copy-libs.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+if [ $# -lt 2 ]
+then
+  echo "Too few arguments. Run copy-libs.sh <binary or shared lib to analyze> <target directory>"
+  exit 1
+fi
+
+binary_path=$1
+target_path=$2
+
+mkdir -p "$2"
+for i in $(ldd "$binary_path" | grep "=>" | awk -F ' => ' '{print $2}' | cut -d ' ' -f1)
+do
+  echo "Copying $i"
+  cp -f "$i" "$2"
+done