Image Optimization

Size and build time are the same problem viewed from two angles: both come from carrying more into the image, and into the build, than the running application needs. A slow build is usually a large one — the layers you push are the layers a runner had to pull, unpack, and cache too.

Optimize by removing, not by compressing after the fact. The fastest layer to pull is the one that was never built.

1. Choose the smallest base that still lets you debug

scratch and distroless bases produce the smallest, lowest-attack-surface images, but they ship without a shell — a production incident that needs exec-ing in becomes much harder. A distro-based "slim" variant is usually the right default: small enough to matter, still debuggable. Reserve scratch for statically-linked binaries (Go, Rust) where you genuinely never need a shell inside the container, and keep a debug-variant image or an ephemeral debug container available as a sidecar for when you do.