more docs

docs/docker.md

@@ -4,14 +4,26 @@
 
 Using Docker is not required, but if you prefer using a Docker container we provide a Docker entrypoint to make this as easy as possible.
 
-To build the `ld-relay` container:
+We provide two distributions. The first is a based on Alpine Linux, while the second is based on Google's 
+["distroless"](https://github.com/GoogleContainerTools/distroless) debian12 images. 
+
+
+## Local Development
+
+When developing locally, you can build the `ld-relay` Alpine container with the following command:
 ```
 $ docker build -t ld-relay .
 ```
 
-In Docker, the config file is expected to be found at `/ldr/ld-relay.conf`, unless you are using environment variables to configure the Relay Proxy. To learn more, read [Configuration](./configuration.md).
+Please note that this [Dockerfile](../Dockerfile) is **not** the same on that is published to [DockerHub](https://hub.docker.com/r/launchdarkly/ld-relay).
+
+It is a convenience for local development, whereas the image published to DockerHub is built during our release process 
+and is based on [Dockerfile.goreleaser](../Dockerfile.goreleaser).
+
+In Docker, the config file is expected to be found at `/ldr/ld-relay.conf`, unless you are using environment variables 
+to configure the Relay Proxy. To learn more, read [Configuration](./configuration.md).
 
-## Docker examples
+## Local Development Examples
 
 To run a single environment, without Redis:
 ```shell
@@ -34,3 +46,33 @@ To run multiple environment, with Redis:
 $ docker run --name redis redis:alpine
 $ docker run --name ld-relay --link redis:redis -e USE_REDIS=1 -e LD_ENV_test="sdk-test-sdkKey" -e LD_PREFIX_test="ld:default:test" -e LD_ENV_prod="sdk-prod-sdkKey" -e LD_PREFIX_prod="ld:default:prod" ld-relay
 ```
+
+## Production Deployment
+
+In production, you may choose between our Distroless or Alpine Linux images. We recommend using the Distroless
+images, as they present a smaller attack surface and will be less likely to require continual patching.
+
+Additionally, the Distroless images are even smaller than Alpine.
+
+Please note that the default Distroless image does not contain a debug shell. 
+
+### Distroless Variants
+
+Relay's Distroless images are distributed in two variants. The first is intended for regular usage, while the 
+second is for debugging and contains a shell.
+
+| Docker image tag suffix          | Based on [Distroless](https://github.com/GoogleContainerTools/distroless) tag.. | Purpose                  |
+|----------------------------------|---------------------------------------------------------------------------------|--------------------------|
+| `-nonroot-static-debian12`       | `static-debian12:nonroot`                                                       | Normal usage             |
+| `-debug-nonroot-static-debian12` | `static-debian12:debug-nonroot`                                                 | Contains a busybox shell |
+
+
+
+### Supported Architectures
+
+Alpine and Distroless are multi-arch images.
+
+| Image      | i386 | amd64 | armv7 | arm64v8 |
+|------------|------|-------|-------|---------|
+| Distroless | ❌    | ✅     | ✅     | ✅       |
+| Alpine     | ✅    | ✅     | ✅     | ✅       |