Add tested Alpine-derived distroless rTorrent variant

README.md

@@ -23,3 +23,27 @@ are uploaded to Gitea, and no local container builds are required.
 
 # Latest 0.16 version caveat
  - since version 0.16 explicitly set `network.bind_address.set = 0.0.0.0`, when ipv6 is disabled on kernel.
+
+## Distroless variant
+
+`docker.io/k2patel/rtorrent:distroless` is built separately using the manual
+**Build Distroless rTorrent** workflow. It preserves the Alpine 3.24 rTorrent
+binary, musl libraries, CA certificates and timezone/terminal data in a `scratch`
+final image. It contains no shell, package manager, BusyBox, or build tools.
+A small native launcher removes the stale session lock and execs rTorrent,
+so signals go directly to rTorrent. It also provides the shell-free TCP healthcheck.
+
+CI tests the assembled filesystem by starting rTorrent and making an SCGI XML-RPC
+request before publishing. The working `latest` tag is independent.
+
+Your mounted `rtorrent.rc` must not depend on shell commands or utilities missing
+from this image (including `execute` hooks). Review those hooks before switching.
+Existing mount paths, SCGI port 5001, root UID and `HOME=/root` are preserved.
+Use the Compose overlay to replace the shell-based healthcheck:
+
+```sh
+docker compose -f docker-compose.yml -f docker-compose.distroless.yml up -d
+```
+
+The overlay also selects the separate Flood distroless image. Keep the same `.env`
+values and mounted data. To roll back, use the base Compose file with `:latest`.