docker: switch to distroless runtime (#47)

Switch to `gcr.io/distroless/cc-debian13` for smaller images. Ubuntu
debug target available via `--target debug`.

## Test plan
- [x] Built distroless and debug targets
- [x] Smoke tested both images

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude Opus 4.5 <[email protected]>

Author: cristi-

.github/workflows/release.yml

@@ -15,15 +15,29 @@ env:
 
 jobs:
   build-images:
-    name: Build ${{ matrix.arch }} image
+    name: Build ${{ matrix.arch }} ${{ matrix.target }} image
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
+        arch:
+          - name: x86-64
+            runner: ubuntu-latest
+          - name: arm64
+            runner: ubuntu-24.04-arm
+        target:
+          - name: runtime
+            suffix: ""
+          - name: debug
+            suffix: "-debug"
         include:
-          - arch: x86-64
+          - arch:
+              name: x86-64
+              runner: ubuntu-latest
             runner: ubuntu-latest
-          - arch: arm64
+          - arch:
+              name: arm64
+              runner: ubuntu-24.04-arm
             runner: ubuntu-24.04-arm
     steps:
       - name: Checkout repository
@@ -47,11 +61,14 @@ jobs:
 
       - name: Build and push architecture-specific image
         run: |
-          docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-${{ matrix.arch }} .
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-${{ matrix.arch }}
+          docker build \
+            --target ${{ matrix.target.name }} \
+            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}${{ matrix.target.suffix }}-${{ matrix.arch.name }} \
+            .
+          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}${{ matrix.target.suffix }}-${{ matrix.arch.name }}
 
   create-manifest:
-    name: Create multi-arch manifest
+    name: Create multi-arch manifests
     needs: build-images
     runs-on: ubuntu-latest
     steps:
@@ -71,14 +88,36 @@ jobs:
             echo "version=dev-$(date +%s)" >> $GITHUB_OUTPUT
           fi
 
-      - name: Create and push multi-arch manifest
+      - name: Create and push versioned manifest
         run: |
           docker manifest create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }} \
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-x86-64 \
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-arm64
-
           docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
 
+      - name: Create and push debug versioned manifest
+        run: |
+          docker manifest create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-debug \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-debug-x86-64 \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-debug-arm64
+          docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-debug
+
+      - name: Tag debug as latest
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          docker manifest create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:debug \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-debug-x86-64 \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-debug-arm64
+          docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:debug
+
+      - name: Tag as latest (pushed last to appear at top)
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          docker manifest create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-x86-64 \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}-arm64
+          docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+
   create-release:
     name: Create GitHub release
     needs: [build-images, create-manifest]

Dockerfile

@@ -17,18 +17,26 @@ RUN --mount=type=cache,id=cachey-rust,sharing=locked,target=/cache \
     mkdir -p /build/target/release/ && \
     cp /cache/release/server /build/target/release/server
 
-# Runtime stage
-FROM ubuntu:latest
+# Debug runtime - ubuntu with shell access
+# Build with: docker build --target debug .
+FROM ubuntu:latest AS debug
 
-# Install ca-certificates for HTTPS requests
 RUN apt-get update && \
     apt-get install -y ca-certificates && \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
+COPY --from=builder /build/target/release/server /app/cachey
+
+ENTRYPOINT ["./cachey"]
+
+# Production runtime (default) - minimal distroless image
+FROM gcr.io/distroless/cc-debian13 AS runtime
+
+WORKDIR /app
+
 # Copy the binary from builder stage
 COPY --from=builder /build/target/release/server /app/cachey
 
-# Run the server
 ENTRYPOINT ["./cachey"]