The runtime image contains only the binary and an empty hooks directory, and runs as an unprivileged numeric user. Hook scripts need a shell, so they will not run in this image.
Multi-stage build producing a slim image with rust-bfdd as the entrypoint. Dependencies are built against stub sources in their own layer so source-only changes do not rebuild them.
ktims