Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

Recipe

Put a Rust service in a small image

Use when: a Rust program has to be delivered as a container image

Goal: a multi-stage Dockerfile whose shipped stage holds only the executable, its data, and the libraries it links

Taught in Containers

Quick recipe

  1. Make the program container-ready
  2. Build in a first stage
  3. Pick the runtime base from what the binary links
  4. Copy only the result
  5. Cache dependencies
  1. 1

    Read its port and file locations from environment variables, listen on 0.0.0.0, and shut down cleanly on SIGTERM.

    Why: inside a container, 127.0.0.1 is unreachable from outside and PID 1 ignores a signal it doesn't handle.

  2. 2

    FROM a Rust image AS build, copy Cargo.toml, Cargo.lock and src/, and run cargo build --release --locked.

    Why: the toolchain stays in a stage that is never shipped, and --locked builds exactly the reviewed versions.

  3. 3

    scratch or distroless static for musl, distroless cc for glibc, a slim distribution only if you need its tools.

    Example

    dockd is a glibc build from rust:1.98-slim-trixie, so its runtime base is gcr.io/distroless/cc-debian13:nonroot: the same Debian release, a non-root user.

    Why: the image must provide exactly what ldd would list, and nothing it doesn't need.

  4. 4

    COPY --from=build the executable and its data files, set ENV and EXPOSE, and make it the ENTRYPOINT.

    Why: whatever isn't copied isn't downloaded, stored or attackable.

  5. 5

    Add a .dockerignore for target/, and a cargo-chef stage so dependencies rebuild only when the manifest or lock changes.

    Why: without it, every source edit recompiles every crate.