Skip to content
docker · infrastructure · chisel

Minimal runtime base forAxum services

A shared chiseled Ubuntu 24.04 runtime base image for every KBVE Axum service. Built with Canonical's chisel so it carries only the runtime libraries — jemalloc, libpq5, and CA certificates — on a scratch-based, shell-less rootfs.

View sourceUsage

Shell-less, smaller, safer

Chisel slices Ubuntu packages into minimal filesystem layers, extracting only the exact files needed — far smaller than the ~80MB+ full Ubuntu base, with no shell or package manager to shrink the attack surface.

  • jemalloc — preconfigured via LD_PRELOAD.
  • Non-root — runs as appuser:10001.
kbve/chisel-ubuntu-axumImage
Ubuntu 24.04Base
appuser:10001User
KBVELicense

What it gives you

Features

Minimal rootfs

Chiseled Ubuntu 24.04 rootfs — no shell, no package manager, just the exact files needed on a scratch base.

jemalloc preloaded

Memory allocator pre-configured via LD_PRELOAD for every service that inherits the base.

Postgres + TLS ready

Bundles libpq5, the PostgreSQL client library, and CA certificates for HTTPS/TLS connections.

Fewer build stages

Eliminates ~3 Docker stages (chisel + jemalloc + libpq) from each service Dockerfile, saving build time and disk in CI.

Runtime base

Chisel, contents & usage

Shared chiseled Ubuntu 24.04 runtime base image for all KBVE Axum services.

What is Chisel?

Section titled “What is Chisel?”

Chisel is a tool from Canonical that slices Ubuntu packages into minimal filesystem layers. Instead of a full Ubuntu image (~80MB+), chisel extracts only the exact files needed — resulting in a scratch-based image with just the runtime libraries.

Contents

Section titled “Contents”
  • Chiseled Ubuntu 24.04 rootfs — minimal, no shell, no package manager
  • jemalloc — memory allocator pre-configured via LD_PRELOAD
  • libpq5 — PostgreSQL client library
  • CA certificates — for HTTPS/TLS connections
  • Non-root user — appuser:10001

Usage

Section titled “Usage”

Service Dockerfiles reference this as their runtime base:

FROM ghcr.io/kbve/chisel-ubuntu-axum:24.04 AS runtime


COPY --from=builder --chown=10001:10001 /app/target/release/my-service /app/my-service


EXPOSE 4321
USER 10001:10001
ENTRYPOINT ["/app/my-service"]

This eliminates ~3 Docker stages (chisel + jemalloc + libpq) from each service Dockerfile, saving build time and disk space in CI.

Services

Section titled “Services”
ServiceStatus
axum-discordshplanned
axum-kbveplanned
axum-memesplanned
axum-herbmailplanned
axum-chuckrpgplanned
axum-cryptothroneplanned

Questions

Frequently asked

What is the chisel-ubuntu-axum base image?

It is a shared chiseled Ubuntu 24.04 runtime base image for all KBVE Axum services, built with Canonical's chisel so it contains only the runtime libraries — jemalloc, libpq5, and CA certificates — on a scratch-based, shell-less rootfs.

Why use a chiseled image instead of full Ubuntu?

Chisel slices Ubuntu packages into minimal filesystem layers, extracting only the exact files needed. This yields a much smaller image than the ~80MB+ full Ubuntu base and removes the shell and package manager, shrinking the attack surface.

How does it simplify service Dockerfiles?

Services reference it as their runtime base with FROM ghcr.io/kbve/chisel-ubuntu-axum, which eliminates about three build stages (chisel, jemalloc, libpq) per service and saves build time and disk space in CI.

Elsewhere

Related

APIAxum service that runs on this runtime base.HerbmailAnother KBVE Axum service targeting this image.