--- title: Building small and secure Docker images for Rust:... description: A practical comparison of three Docker base images for Rust projects — scratch, alpine, and debian-slim — with complete multi-stage Dockerfiles for each. The... canonical: https://daily.dev/posts/building-small-and-secure-docker-images-for-rust-scratch-vs-alpine-vs-debian-u4ghpdevo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Building small and secure Docker images for Rust: scratch vs alpine vs debian | daily.dev og:description: A practical comparison of three Docker base images for Rust projects — scratch, alpine, and debian-slim — with complete multi-stage Dockerfiles for each. The... og:url: https://daily.dev/posts/building-small-and-secure-docker-images-for-rust-scratch-vs-alpine-vs-debian-u4ghpdevo og:image: https://api.daily.dev/og/posts/u4gHPdevO.png og:image:alt: Building small and secure Docker images for Rust: scratch vs alpine vs debian og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Building small and secure Docker images for Rust: scratch vs alpine vs debian **[Sylvain Kerkour](https://daily.dev/sources/kerkour)** · 7 min read · 0 upvotes · 0 comments ## Summary A practical comparison of three Docker base images for Rust projects — scratch, alpine, and debian-slim — with complete multi-stage Dockerfiles for each. The scratch image produces the smallest result at 3.44 MB content size, alpine comes in at 11.4 MB, and debian-slim at 77.5 MB. Key techniques covered include statically linking Rust binaries with the MUSL target, replacing MUSL's slow default allocator with mimalloc, using rustls instead of openssl to avoid static-linking headaches, and running containers as an unprivileged user. The author recommends scratch images for most Rust projects due to minimal attack surface and deployment efficiency, with alpine as a fallback when external tools like chromium or ffmpeg are needed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the actual image sizes when building a Rust app with scratch vs alpine vs debian-slim Docker base images? A Rust binary built with a scratch base image has a content size of 3.44 MB, alpine produces 11.4 MB, and debian-slim produces 77.5 MB. In terms of total disk usage including layers, scratch is 12.9 MB, alpine is 35.9 MB, and debian-slim is 337 MB. Scratch is the clear winner for deployment efficiency and minimal attack surface. _Rust teams choosing a base image for production containers track these tradeoffs on daily.dev._ ### Why should I use mimalloc instead of the default allocator when building Rust binaries for Alpine or scratch Docker images? MUSL libc's default malloc is not optimized for speed and causes high memory fragmentation, especially in high-throughput applications. Replacing it with mimalloc — a memory allocator designed for simplicity and high concurrency — requires only two lines of code: adding the mimalloc crate and declaring it as the global allocator with `#[global_allocator] static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;`. _Developers optimizing Rust service performance in containers find allocator comparisons like this on daily.dev._ ### How do I avoid OpenSSL when making HTTPS requests in a statically linked Rust binary for a minimal Docker image? Use rustls instead of openssl as the TLS backend. With the reqwest crate, disable default features and enable the rustls-tls feature flag: `reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", ...] }`. This avoids the complexity of statically linking openssl and keeps the binary self-contained for scratch or alpine images. _Rust developers shipping minimal containers without OpenSSL dependencies stay current on daily.dev._ ## Similar posts on daily.dev - [Small and secure Docker images for Rust: scratch vs alpine vs debian](https://daily.dev/posts/small-and-secure-docker-images-for-rust-scratch-vs-alpine-vs-debian-31lvdlshh) · Sylvain Kerkour · 0 upvotes · 0 comments - [Building smaller Docker images faster](https://daily.dev/posts/building-smaller-docker-images-faster-pkye16mw7) · Lobsters · 3 upvotes · 0 comments - [Why To Use A Multi-Stage Dockerfile](https://daily.dev/posts/why-to-use-a-multi-stage-dockerfile-ripe33vzt) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#docker](https://daily.dev/tags/docker), [#rust](https://daily.dev/tags/rust), [#containers](https://daily.dev/tags/containers) [View this post on daily.dev](https://daily.dev/posts/building-small-and-secure-docker-images-for-rust-scratch-vs-alpine-vs-debian-u4ghpdevo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Building small and secure Docker images for Rust: scratch vs alpine vs debian","url":"https://daily.dev/posts/building-small-and-secure-docker-images-for-rust-scratch-vs-alpine-vs-debian-u4ghpdevo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/building-small-and-secure-docker-images-for-rust-scratch-vs-alpine-vs-debian-u4ghpdevo"},"datePublished":"2026-08-11T08:53:58.269Z","dateModified":"2026-08-11T09:20:34.864Z","description":"A practical comparison of three Docker base images for Rust projects — scratch, alpine, and debian-slim — with complete multi-stage Dockerfiles for each. The...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"Sylvain Kerkour","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sylvain Kerkour","logo":"https://media.daily.dev/image/upload/s--3ngWt4Yp--/f_auto,q_auto/v1786438308/logos/kerkour?_a=BAMAMicg0","url":"https://daily.dev/sources/kerkour"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/building-small-and-secure-docker-images-for-rust-scratch-vs-alpine-vs-debian-u4ghpdevo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"docker,rust,containers","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sylvain Kerkour","item":"https://daily.dev/sources/kerkour"},{"@type":"ListItem","position":3,"name":"Building small and secure Docker images for Rust: scratch vs alpine vs debian"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/building-small-and-secure-docker-images-for-rust-scratch-vs-alpine-vs-debian-u4ghpdevo#faq","mainEntity":[{"@type":"Question","name":"What are the actual image sizes when building a Rust app with scratch vs alpine vs debian-slim Docker base images?","acceptedAnswer":{"@type":"Answer","text":"A Rust binary built with a scratch base image has a content size of 3.44 MB, alpine produces 11.4 MB, and debian-slim produces 77.5 MB. In terms of total disk usage including layers, scratch is 12.9 MB, alpine is 35.9 MB, and debian-slim is 337 MB. Scratch is the clear winner for deployment efficiency and minimal attack surface. Rust teams choosing a base image for production containers track these tradeoffs on daily.dev."}},{"@type":"Question","name":"Why should I use mimalloc instead of the default allocator when building Rust binaries for Alpine or scratch Docker images?","acceptedAnswer":{"@type":"Answer","text":"MUSL libc's default malloc is not optimized for speed and causes high memory fragmentation, especially in high-throughput applications. Replacing it with mimalloc — a memory allocator designed for simplicity and high concurrency — requires only two lines of code: adding the mimalloc crate and declaring it as the global allocator with `#[global_allocator] static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;`. Developers optimizing Rust service performance in containers find allocator comparisons like this on daily.dev."}},{"@type":"Question","name":"How do I avoid OpenSSL when making HTTPS requests in a statically linked Rust binary for a minimal Docker image?","acceptedAnswer":{"@type":"Answer","text":"Use rustls instead of openssl as the TLS backend. With the reqwest crate, disable default features and enable the rustls-tls feature flag: `reqwest = { version = \"0.12\", default-features = false, features = [\"rustls-tls\", ...] }`. This avoids the complexity of statically linking openssl and keeps the binary self-contained for scratch or alpine images. Rust developers shipping minimal containers without OpenSSL dependencies stay current on daily.dev."}}]} ```