From 9fb94303197aeaa8b8a7d1b86bc5661ff099167a Mon Sep 17 00:00:00 2001
From: FoxyHunter <fox@foxyhunter.be>
Date: Mon, 1 Jun 2026 21:51:38 +0200
Subject: [PATCH] Feat: scratch docker build

---
 Dockerfile | 40 ++++++++++++++++++++++++++++++++++++++++
 README.md  | 14 +++++++++++++-
 2 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 Dockerfile

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..c6992c4
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,40 @@
+FROM alpine:3.22.4 AS builder
+
+RUN apk add --no-cache \
+    ca-certificates \
+    gcc \
+    musl-dev \
+    make \
+    pkgconf \
+    curl-dev \
+    curl-static \
+    cjson-dev \
+    openssl-dev \
+    openssl-libs-static \
+    nghttp2-dev \
+    nghttp2-static \
+    zlib-dev \
+    zlib-static \
+    brotli-dev \
+    brotli-static \
+    c-ares-dev \
+    c-ares-static \
+    libidn2-dev \
+    libidn2-static \
+    libpsl-dev \
+    libpsl-static \
+    libunistring-dev \
+    libunistring-static
+
+WORKDIR /build
+COPY src/ src/
+COPY Makefile .
+
+RUN make STATIC=1
+
+FROM scratch
+
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /build/build/dns-keeper /dns-keeper
+
+ENTRYPOINT ["/dns-keeper"]
diff --git a/README.md b/README.md
index 7fba2bd..a3b0e8d 100644
--- a/README.md
+++ b/README.md
@@ -65,4 +65,16 @@ make STATIC=1
 The dynamically linked binary is smaller but requires dependencies:
 libcurl, libcjson and pthread to be on the target machine.
 
-The static binary is slightly bigger but is fully self contained.
\ No newline at end of file
+The static binary is slightly bigger but is fully self contained.
+
+### Docker Image
+
+The [Dockerfile](./Dockerfile) in this repo builds a minimal image with just the static binary and CA certificates.
+
+```sh
+docker build -t dns-keeper .
+```
+
+> [!TIP]
+> Because the image is just the c binary with ca certs, there is no shell to exec into.  
+> `docker exec` will not work for debugging. 
\ No newline at end of file