Hacker News Reader

Google's distroless containers are an interesting approach for both security and performance as well, albeit with limited language support: https://github.com/GoogleContainerTools/distroless

Relatedly, rust-musl-builder [0] is useful for getting Rust binaries to run on the `static` instead of `cc` base image.

What's the advantage of doing that?

you can drop the resulting binary in a scratch container that has no shell, etc.