Ship in scratch container

Skip vulns introduced by alpine

Dockerfile

@@ -14,19 +14,12 @@ ENV GOOS=linux
 RUN go build -ldflags "-X main.version=$VERSION" -o $GOPATH/bin/MailHog
 
 
-FROM alpine:3
-# Add mailhog user/group with uid/gid 1000.
-# This is a workaround for boot2docker issue #581, see
-# https://github.com/boot2docker/boot2docker/issues/581
-RUN adduser -D -u 1000 mailhog
-
-COPY --from=builder /root/gocode/bin/MailHog /usr/local/bin/
-
-USER mailhog
-
-WORKDIR /home/mailhog
+FROM scratch
+USER 10001
 
 ENTRYPOINT ["MailHog"]
 
 # Expose the SMTP and HTTP ports:
-EXPOSE 1025 8025
+EXPOSE 1025 8025
+
+COPY --from=builder /root/gocode/bin/MailHog /usr/local/bin/

README.md

@@ -1,7 +1,7 @@
 MailHog [![Docker Build and Push](https://github.com/cloudogu/mailhog-image/actions/workflows/docker-image.yml/badge.svg)](https://github.com/cloudogu/mailhog/actions/workflows/docker-image.yml)
 =========
 
-Mailhog [Docker/OCI image](https://github.com/cloudogu/mailhog-image/pkgs/container/mailhog), regularly rebuilt
+Mailhog [Docker/OCI image](https://github.com/cloudogu/mailhog-image/pkgs/container/mailhog), regularly rebuilt and shipped in a scratch container, to minimize CVEs.
 
 See [mailhog's README](https://github.com/mailhog/MailHog/blob/master/README.md) for more details.
 
@@ -14,7 +14,8 @@ You can send mails via SMTP to localhost:1025 and see mailhogs web UI via localh
 
 ## Releasing
 
-To build and push a fresh image on the latest alpine version and mailhog, just [run GH action](https://github.com/cloudogu/mailhog-image/actions/workflows/docker-image.yml). This sets three tags
+To build and push a fresh image basing on the latest versions of Go and MailHog, just [run GH action](https://github.com/cloudogu/mailhog-image/actions/workflows/docker-image.yml).
+This sets three tags
 * `latest`
 * MailHog's latest tag, e.g. `v1.0.1`
-* MailHog's latest tag + time stamp, e.g. `v1.0.1-2023-10-25`
+* MailHog's latest tag + time stamp, e.g. `v1.0.1-2023-10-25`, which is "immutable".