From 127f3f5e61e9d91daa1d825df79883ce29516078 Mon Sep 17 00:00:00 2001
From: Vincent Le Goff <vincent.legoff@konghq.com>
Date: Tue, 21 Jul 2026 09:16:14 +0200
Subject: [PATCH 1/2] feat(docker): switch to distroless

---
 Dockerfile | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b45091637..4685bf696 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,10 @@ ARG TAG
 RUN CGO_ENABLED=0 GOOS=linux go build -o deck \
       -ldflags "-s -w -X github.com/kong/deck/cmd.VERSION=$TAG -X github.com/kong/deck/cmd.COMMIT=$COMMIT"
 
-FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+FROM ghcr.io/jqlang/jq:1.8.2@sha256:b9c68867e5766576263a222e91db3de422d802069c7af70440e667a95344e486 AS jq
+
+FROM gcr.io/distroless/base:latest@sha256:f4a335ca209e1d2ee873102c17c389ad0142e3d5b21aee2817e9cc9c01d87d20
+
 ARG COMMIT
 ARG TAG
 LABEL org.opencontainers.image.title="deck" \
@@ -21,8 +24,7 @@ LABEL org.opencontainers.image.title="deck" \
       org.opencontainers.image.revision="$COMMIT" \
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.vendor="Kong Inc."
-RUN adduser --disabled-password --gecos "" deckuser
-RUN apk --no-cache upgrade && apk --no-cache add ca-certificates jq
-USER deckuser
-COPY --from=build /deck/deck /usr/local/bin
+USER nonroot
+COPY --from=build /deck/deck /usr/local/bin/
+COPY --from=jq /jq /usr/local/bin/jq
 ENTRYPOINT ["deck"]
\ No newline at end of file

From 857b241985a7b62270b72c9c39c91184b93e5c8c Mon Sep 17 00:00:00 2001
From: Prashansa Kulshrestha <prashansa.kulshrestha@konghq.com>
Date: Mon, 3 Aug 2026 09:55:58 +0530
Subject: [PATCH 2/2] chore: added env HOME and changed base image to
 static-debian for size reduction

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 4685bf696..32c73a2f0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,7 +12,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -o deck \
 
 FROM ghcr.io/jqlang/jq:1.8.2@sha256:b9c68867e5766576263a222e91db3de422d802069c7af70440e667a95344e486 AS jq
 
-FROM gcr.io/distroless/base:latest@sha256:f4a335ca209e1d2ee873102c17c389ad0142e3d5b21aee2817e9cc9c01d87d20
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:37d3baf4e657ce79c144b69b69f60b8542f366a64fb7a49bd99f5444ef008bb0
 
 ARG COMMIT
 ARG TAG
@@ -27,4 +27,4 @@ LABEL org.opencontainers.image.title="deck" \
 USER nonroot
 COPY --from=build /deck/deck /usr/local/bin/
 COPY --from=jq /jq /usr/local/bin/jq
-ENTRYPOINT ["deck"]
\ No newline at end of file
+ENTRYPOINT ["deck"]