run on nothing but the binary

alpine carried a shell, a package manager, libc and sqlite-libs so that a
dynamically linked binary could find them. Linking statically removes the
reason for all four: the image is the binary and the TLS roots, on
distroless static, as nonroot.

The explorer serves its frontend from //go:embed, so nothing else was ever
needed at runtime.

Co-authored-by: Hanzo Dev <[email protected]>

Dockerfile

@@ -10,14 +10,14 @@ ARG VERSION=dev
 # sum.golang.org cross-checks.
 RUN rm -f go.sum && CGO_ENABLED=1 CGO_CFLAGS="-D_LARGEFILE64_SOURCE" GOOS=linux \
     GOSUMDB=off go build -mod=mod \
-    -ldflags "-s -w -X main.version=${VERSION}" \
+    -ldflags "-s -w -linkmode external -extldflags '-static' -X main.version=${VERSION}" \
     -o /graphd ./cmd/graphd
 
-FROM alpine:3.21
-RUN apk add --no-cache ca-certificates tzdata \
-    && addgroup -S graphd && adduser -S graphd -G graphd
+# The binary, the TLS roots and the zoneinfo Go reads — nothing else.
+# Statically linked, so no libc and no shell in the image at all.
+FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=build /graphd /usr/local/bin/graphd
-USER graphd
+USER nonroot
 VOLUME /data
 EXPOSE 8080
 HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=3 \