Rewrite Dockerfile to use Alpine Linux, and produce a minimal image

.dockerignore

@@ -0,0 +1,60 @@
+*.o
+*.a
+*.lo
+*.la
+*.lai
+*.so
+*.so.*
+*.gcda
+*.gcno
+*.gcov
+*~
+.*.sw[a-p]
+tags
+
+jq
+!tests/modules/lib/jq/
+jq.1
+
+# Generated source
+src/builtin.inc
+*.pc
+
+# Autotools junk
+.libs
+.deps
+.dirstamp
+libtool
+*.log
+stamp-h1
+config.log
+config.status
+autom4te.cache
+INSTALL
+Makefile
+jq-*.tar.gz
+configure
+aclocal.m4
+Makefile.in
+version.h
+.remake-version-h
+config.cache
+*.rpm
+m4/libtool.m4
+m4/ltoptions.m4
+m4/ltsugar.m4
+m4/ltversion.m4
+m4/lt~obsolete.m4
+tests/*.trs
+
+cscope.in.out
+cscope.out
+cscope.po.out
+jq.dSYM
+
+# Don't bust the build-cache on Dockerfile/.dockerignore only changes
+.dockerignore
+.github
+.travis.yml
+appveyor.yml
+build/*

Dockerfile

@@ -1,54 +1,35 @@
-FROM debian:9
+FROM alpine:3.12 AS build
 
-ENV DEBIAN_FRONTEND=noninteractive \
-    DEBCONF_NONINTERACTIVE_SEEN=true \
-    LC_ALL=C.UTF-8 \
-    LANG=C.UTF-8
+ENV LC_ALL=C.UTF-8
+ENV LANG=C.UTF-8
 
-COPY . /app
-
-# get dependencies, build, and remove anything we don't need for running jq.
-# valgrind seems to have trouble with pthreads TLS so it's off.
-
-RUN apt-get update && \
-    apt-get install -y \
-        build-essential \
+RUN apk add --no-cache \
+        automake \
         autoconf \
-        libtool \
-        git \
+        build-base \
         bison \
         flex \
-        python3 \
-        python3-pip \
-        wget && \
-    pip3 install pipenv && \
-    (cd /app/docs && pipenv sync) && \
-    (cd /app && \
-        git submodule init && \
-        git submodule update && \
-        autoreconf -i && \
-        ./configure --disable-valgrind --enable-all-static --prefix=/usr/local && \
-        make -j8 && \
-        make check && \
-        make install ) && \
-    (cd /app/modules/oniguruma && \
-        make uninstall ) && \
-    (cd /app && \
-        make distclean ) && \
-    apt-get purge -y \
-        build-essential \
-        autoconf \
-        libtool \
-        bison \
         git \
-        flex \
-        python3 \
-        python3-pip && \
-    apt-get autoremove -y && \
-    rm -rf /app/modules/oniguruma/* && \
-    rm -rf /app/modules/oniguruma/.git && \
-    rm -rf /app/modules/oniguruma/.gitignore && \
-    rm -rf /var/lib/apt/lists/* /var/lib/gems
+        libtool \
+        oniguruma-dev
+
+WORKDIR /app
+COPY . .
+RUN autoreconf -if
+RUN ./configure --disable-docs --enable-all-static CFLAGS='-Os -static -no-pie' CXXFLAGS='-Os -static -no-pie'
+RUN make
+RUN make check
+RUN strip jq
+
+# Ensure that the built executable is really statically linked.
+RUN file jq | grep -Fw 'statically linked'
 
-ENTRYPOINT ["/usr/local/bin/jq"]
-CMD []
+# The deploy stage is the final image, and only contains artefacts
+# that should be published.
+FROM scratch AS deploy
+COPY --from=build /app/AUTHORS /
+COPY --from=build /app/COPYING /
+COPY --from=build /app/jq      /jq
+RUN ["/jq", "-V"]
+ENTRYPOINT ["/jq"]
+CMD ["--help"]

Dockerfile.debian

@@ -0,0 +1,54 @@
+
+ARG PYTHON_VERSION=3.6.7
+
+FROM python:${PYTHON_VERSION}-stretch AS build
+CMD ["bash"]
+ENV LC_ALL=C.UTF-8
+ARG DEBIAN_FRONTEND=noninteractive
+ARG DEBCONF_NONINTERACTIVE_SEEN=true
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+        autoconf \
+        bison \
+        build-essential \
+        flex \
+        git \
+        libtool \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Install docs dependencies; we're only copying the Pipfile here,
+# so that this is only run again if dependencies change
+RUN  pip3 install pipenv
+COPY docs/Pipfile docs/Pipfile.lock ./docs/
+RUN  cd docs && pipenv sync
+
+COPY .gitmodules .
+COPY .git        ./.git/
+RUN git submodule init
+RUN git submodule update
+RUN sed -i.bak '/^AM_INIT_AUTOMAKE(\[-Wno-portability 1\.14\])$/s/14/11/' modules/oniguruma/configure.ac
+
+COPY . .
+RUN autoreconf -if
+RUN ./configure --disable-valgrind --with-oniguruma=builtin YACC=/usr/bin/bison --prefix=/build/
+RUN make BISON_PKGDATADIR=/usr/bin/bison src/parser.c || make src/parser.c
+RUN make -j8
+RUN make check -j8
+RUN make install
+RUN /build/bin/jq -V
+
+# Collect the files for the final image
+FROM debian:stretch-slim AS deploy
+ENV LC_ALL=C.UTF-8
+ARG DEBIAN_FRONTEND=noninteractive
+ARG DEBCONF_NONINTERACTIVE_SEEN=true
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends man \
+ && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /build/.  /usr/local/
+RUN jq -V
+ENTRYPOINT ["/usr/local/bin/jq"]
+CMD ["--help"]