Add tested standalone distroless Flood variant

README.md

@@ -33,3 +33,23 @@ publishing; it does not start a torrent daemon.
 The entrypoint uses `npm run start`, matching upstream v4.16.2, while retaining
 `--host=0.0.0.0` and `--rundir=/server/`. The upstream combined rTorrent stage
 is deliberately excluded.
+
+## Distroless variant
+
+The manual **Build Distroless Flood** workflow publishes `k2patel/floodui:distroless`
+for the selected Flood release (default `v4.16.2`). It does not change `latest`.
+
+The Alpine 3.24-derived runtime contains Node 24.18.1, the bundled Flood server/UI,
+mediainfo, GNU df, their musl libraries, CA certificates and timezone data. The
+final image is built from scratch, with no shell, npm/pnpm, package manager,
+node_modules, source tree or build tools. It starts Node directly and remains
+separate from rTorrent. Root UID, port 3000, and `/server/db` stay compatible.
+
+Before publication, CI starts Flood inside the exact stripped filesystem and
+requires an HTTP 200 response; it also checks mediainfo and df can execute and
+that shell/package-manager binaries are absent. All builds run remotely, and
+the temporary builder/cache is removed afterward.
+
+Change only the Compose image tag to `k2patel/floodui:distroless`; keep existing
+mounts and connection settings. Revert to `latest` to roll back. A matching
+rTorrent Compose overlay is provided in the docker-rtorrent repository.