Make distroless the sole latest image and default Compose runtime

Dockerfile

@@ -1,15 +1,21 @@
-FROM alpine:3.24
-
-RUN mkdir /myconfig
-RUN mkdir /home/nfs_download
-RUN mkdir /root || true
-
-# create file and ignore if it fails
-RUN touch /root/.rtorrent.rc || true
-COPY install/rtorrent.sh /rtorrent.sh
-
-RUN apk add --no-cache bash rtorrent curl libcurl ncurses
+# Keep Alpine's musl ABI and rTorrent version; export only runtime dependencies.
+FROM alpine:3.24 AS runtime
+RUN apk add --no-cache rtorrent ca-certificates tzdata \
+    build-base lddtreepax python3
+COPY install/rtorrent-entrypoint.c /build/rtorrent-entrypoint.c
+RUN cc -Os -Wall -Wextra -Werror -o /usr/local/bin/rtorrent-entrypoint /build/rtorrent-entrypoint.c \
+    && strip /usr/local/bin/rtorrent-entrypoint
+COPY build/runtime-root.py /build/runtime-root.py
+RUN python3 /build/runtime-root.py /runtime /usr/bin/rtorrent /usr/local/bin/rtorrent-entrypoint
+COPY tests/rtorrent-smoke.c /build/rtorrent-smoke.c
+RUN cc -static -Os -Wall -Wextra -Werror -o /build/rtorrent-smoke /build/rtorrent-smoke.c
 
+FROM scratch
+COPY --from=runtime /runtime/ /
+ENV HOME=/root PATH=/usr/local/bin:/usr/bin:/bin TERM=xterm
+RUN --mount=type=bind,from=runtime,source=/build/rtorrent-smoke,target=/ci-smoke ["/ci-smoke"]
 VOLUME ["/home/nfs_download"]
 EXPOSE 5001/tcp
-ENTRYPOINT ["/rtorrent.sh"]
+HEALTHCHECK --interval=10s --timeout=10s --start-period=90s --retries=5 \
+    CMD ["/usr/local/bin/rtorrent-entrypoint", "--healthcheck"]
+ENTRYPOINT ["/usr/local/bin/rtorrent-entrypoint"]