What

Official container images from Docker Hub and Canonical weigh 75–120MB compressed. The first thing they do on boot is apt update, downloading another 90–216MB of package indexes describing 60,000–90,000 packages your server will never install. The indexes sit in /var/lib/apt/lists, consuming disk and bandwidth on every container, on every host, on every update cycle, indefinitely.

debthin images are purpose-built for headless infrastructure. Each image ships with debthin.org package indexes pre-configured, dpkg path exclusions for docs, man pages, locales, and hardware databases, and apt tuned to use compressed indexes with no translation files. The result is a rootfs that starts lean and stays lean through every apt update cycle.

Built daily from upstream with distrobuilder. Available as LXC, Incus, and OCI container images. Served from Cloudflare R2 with edge caching.

Image Sizes

Compressed download sizes for reference. OCI images include a gzip layer wrapper around the xz-compressed rootfs. The uncompressed column shows the on-disk footprint after extraction — what actually matters for storage and overlay filesystem performance.

Ubuntu images are larger because Canonical's base includes more systemd units, snapd residuals, and heavier core libraries (libicu, python3). The YAML templates strip what they can, but the base package set is bigger.

What’s inside

Every image is built from a YAML template that defines the base system, package sources, and post-install cleanup. The key decisions are baked in at build time so containers boot ready to use without manual configuration.

debthin package indexes

/etc/apt/sources.list points at debthin.org instead of the upstream archive. The debthin GPG keyring is pre-installed at /etc/apt/keyrings/debthin.gpg. Security sources go direct to security.debian.org or security.ubuntu.com — kept independent of debthin.

The result: apt update downloads ~2–5MB of curated indexes instead of 90–216MB from upstream. Every subsequent update cycle stays that small.

dpkg path exclusions

Man pages, info files, groff data, lintian checks, non-English locales, gconv character set converters, and hardware database files are excluded at install time via /etc/dpkg/dpkg.cfg.d/. This prevents bloat from accumulating as packages are installed, not just at image build time.

apt configuration

Indexes are fetched and stored compressed (Acquire::GzipIndexes "true"). Translation files are disabled. Package caches (pkgcache / srcpkgcache) are disabled. Recommends and suggests are not installed by default.

Networking

systemd-networkd and systemd-resolved are enabled with a DHCP configuration for eth0. No netplan, no NetworkManager. curl is included as the only non-essential package.

What gets stripped

Post-install cleanup removes udev (not needed in containers), cached .deb files, compiled hardware databases, and apt binary caches. Ubuntu templates additionally remove libicu, python3, netplan.io, locales, and debconf-i18n.

Formats

Usage

Incus / LXD

incus remote add debthin https://images.debthin.org --protocol simplestreams --public
incus launch debthin:debian/trixie/amd64 mycontainer

Docker / OCI

docker pull images.debthin.org/debian/trixie:amd64
podman pull images.debthin.org/ubuntu/noble:arm64

LXC

lxc-create -t download -n mycontainer -- \
  --server images.debthin.org \
  --dist debian --release trixie --arch amd64

Available Images

Images are rebuilt daily. Each build is tagged with a timestamp.

API Endpoints

Trademark notice

Source

Pipeline, worker and build scripts are open source.
github.com/debthin/debthin