erlang

Use it as a base image

Reference it in the FROM line of your Dockerfile. Nonroot, read-only root filesystem, built for amd64 and arm64.

FROM ghcr.io/quenchworks/images/erlang:29

Or pull it directly

docker pull ghcr.io/quenchworks/images/erlang:29

Version line

29

Latest line

27, 28, 29

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

License

Apache-2.0

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three before you build on it:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/erlang:29 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
gh attestation verify oci://ghcr.io/quenchworks/images/erlang:29 --owner quenchworks

# 3. SPDX SBOM — the package inventory
gh attestation verify oci://ghcr.io/quenchworks/images/erlang:29 --owner quenchworks \
  --predicate-type https://spdx.dev/Document

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Best-practice Dockerfile for 29

Assemble a self-contained rebar3 release on the BEAM in the build stage, then copy that release onto a clean erlang base. The release carries the runtime system and only prod deps.

1
# Build stage: fetch deps and assemble a prod rebar3 release.
2
FROM ghcr.io/quenchworks/images/erlang:29 AS build
3
USER root
4
WORKDIR /app
5
ENV REBAR_CACHE_DIR=/tmp/rebar3
6

7
COPY rebar.config rebar.lock ./
8
RUN ["rebar3", "get-deps"]
9
COPY . .
10
RUN ["rebar3", "as", "prod", "release"]
11

12
# Runtime stage: copy the self-contained release onto a clean erlang base.
13
FROM ghcr.io/quenchworks/images/erlang:29 AS runtime
14
WORKDIR /app
15
ENV HOME=/tmp
16
COPY --from=build /app/_build/prod/rel/app ./
17
USER 1001
18
EXPOSE 8080
19
CMD ["bin/app", "foreground"]

This Dockerfile is pinned to the 29 line. For the line-by-line walkthrough and ecosystem variants (npm/Yarn, pip/uv/Poetry, Maven/Gradle), see the Build hardened images guide.