Feat: scratch docker build

Dockerfile

@@ -0,0 +1,40 @@
+FROM alpine:3.22.4 AS builder
+
+RUN apk add --no-cache \
+    ca-certificates \
+    gcc \
+    musl-dev \
+    make \
+    pkgconf \
+    curl-dev \
+    curl-static \
+    cjson-dev \
+    openssl-dev \
+    openssl-libs-static \
+    nghttp2-dev \
+    nghttp2-static \
+    zlib-dev \
+    zlib-static \
+    brotli-dev \
+    brotli-static \
+    c-ares-dev \
+    c-ares-static \
+    libidn2-dev \
+    libidn2-static \
+    libpsl-dev \
+    libpsl-static \
+    libunistring-dev \
+    libunistring-static
+
+WORKDIR /build
+COPY src/ src/
+COPY Makefile .
+
+RUN make STATIC=1
+
+FROM scratch
+
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /build/build/dns-keeper /dns-keeper
+
+ENTRYPOINT ["/dns-keeper"]

README.md

@@ -65,4 +65,16 @@ make STATIC=1
 The dynamically linked binary is smaller but requires dependencies:
 libcurl, libcjson and pthread to be on the target machine.
 
-The static binary is slightly bigger but is fully self contained.
+The static binary is slightly bigger but is fully self contained.
+
+### Docker Image
+
+The [Dockerfile](./Dockerfile) in this repo builds a minimal image with just the static binary and CA certificates.
+
+```sh
+docker build -t dns-keeper .
+```
+
+> [!TIP]
+> Because the image is just the c binary with ca certs, there is no shell to exec into.  
+> `docker exec` will not work for debugging.