ksnarf/ubuntu repository overview

⁠ksnarf/ubuntu

A minimal, hardened Ubuntu base image for building production-ready containers.

Built on the official ubuntu:24.04 image with a pinned digest for reproducibility.

⁠What's included

• Ubuntu 24.04 LTS — pinned by digest for supply-chain integrity
• tini⁠ — lightweight init process to handle signals and reap zombies correctly
• ca-certificates — standard TLS trust store
• Non-root user (app, UID/GID 10001) — containers run unprivileged by default
• /work as the default working directory

⁠What's NOT included

Intentionally lean — no package manager cache, no shells beyond bash, no extras. Extend it, don't bloat it.

⁠Usage

FROM ksnarf/ubuntu:latest

# Your layers here
COPY --chown=app:app . /work
CMD ["your-entrypoint"]

⁠Build args

⁠Design decisions

• Digest-pinned base prevents silent upstream changes
• tini as entrypoint ensures proper PID 1 behavior (signal forwarding, zombie reaping)
• Non-root by default — override with USER root only when necessary