diff --git a/Dockerfile.alpine b/Dockerfile.alpine
index 15b055cf3..88f46198f 100644
--- a/Dockerfile.alpine
+++ b/Dockerfile.alpine
@@ -1,43 +1,33 @@
-# supported versions here: https://hub.docker.com/_/rust
-ARG RUST_BUILDER_VERSION=slim-bookworm
-ARG ALPINE_VERSION=3.23
-ARG RUST_CROSS_IMAGE=x86_64-musl
-ARG RUST_TARGET=x86_64-unknown-linux-musl
-ARG CROSS_GNU_PACKAGES=
-ARG BINDGEN_EXTRA_CLANG_ARGS=
+# supported versions here: 
+# - https://hub.docker.com/_/rust
+# - https://hub.docker.com/_/alpine
+ARG ALPINE_VERSION=3.24
 
 ########################
 ## builder image
 ########################
-FROM ghcr.io/rust-cross/rust-musl-cross:${RUST_CROSS_IMAGE} AS builder
+FROM rust:alpine${ALPINE_VERSION} AS builder
 
-ARG RUST_TARGET
-ARG CROSS_GNU_PACKAGES
-ARG BINDGEN_EXTRA_CLANG_ARGS
-ENV BINDGEN_EXTRA_CLANG_ARGS=${BINDGEN_EXTRA_CLANG_ARGS}
-ENV CARGO_TERM_PROGRESS_WHEN=always
-ENV CARGO_TERM_PROGRESS_WIDTH=80
-# Rust's armv7 musl self-contained link omits libgcc, but libstdc++ needs its
-# __sync_add_and_fetch_4 implementation for this target.
-ENV CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_RUSTFLAGS="-C link-arg=-lgcc"
+RUN apk add --update-cache --no-cache gcc g++ clang-dev git cmake make perl pkgconf \
+    && rm -rf /var/cache/apk/*
 
-RUN apt-get update \
-    && apt-get -y install git cmake perl pkg-config libclang-dev ${CROSS_GNU_PACKAGES} \
-    && rm -rf /var/lib/apt/lists/*
+WORKDIR /redlib
 
-RUN rustup target add ${RUST_TARGET}
+# display backtrace on build error
+ENV RUST_BACKTRACE=full
 
-WORKDIR /redlib
+# enable dynamic linking, older rust disabled this for musl target by default
+ENV RUSTFLAGS="-C target-feature=-crt-static -C link-self-contained=no"
 
 # download (most) dependencies in their own layer
 COPY Cargo.lock Cargo.toml ./
 RUN mkdir src && echo "fn main() { panic!(\"why am i running?\") }" > src/main.rs
-RUN cargo build --release --locked --bin redlib --target ${RUST_TARGET}
+RUN cargo build --release --locked --bin redlib
 RUN rm ./src/main.rs && rmdir ./src
 
 # copy the source and build the redlib binary
 COPY . ./
-RUN cargo build --release --locked --bin redlib --target ${RUST_TARGET}
+RUN cargo build --release --locked --bin redlib
 RUN echo "finished building redlib!"
 
 ########################
@@ -45,9 +35,12 @@ RUN echo "finished building redlib!"
 ########################
 FROM alpine:${ALPINE_VERSION} AS release
 
+# without gcc compat layer, redlib will crash with undefined symbols
+RUN apk add --update-cache --no-cache libgcc libstdc++ \
+    && rm -rf /var/cache/apk/*
+
 # Import redlib binary from builder
-ARG RUST_TARGET=x86_64-unknown-linux-musl
-COPY --from=builder /redlib/target/${RUST_TARGET}/release/redlib /usr/local/bin/redlib
+COPY --from=builder /redlib/target/release/redlib /usr/local/bin/redlib
 
 # Add non-root user for running redlib
 RUN adduser --home /nonexistent --no-create-home --disabled-password redlib
diff --git a/Dockerfile.debian-slim b/Dockerfile.debian-slim
new file mode 100644
index 000000000..faf575caf
--- /dev/null
+++ b/Dockerfile.debian-slim
@@ -0,0 +1,56 @@
+# supported versions here: 
+# - https://hub.docker.com/_/rust
+# - https://hub.docker.com/_/debian
+ARG DEBIAN_VERSION_CODENAME=trixie
+
+########################
+## builder image
+########################
+FROM rust:slim-${DEBIAN_VERSION_CODENAME} AS builder
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends --no-install-suggests gcc g++ libclang-dev git cmake make perl pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /redlib
+
+# display backtrace on build error
+ENV RUST_BACKTRACE=full
+
+# download (most) dependencies in their own layer
+COPY Cargo.lock Cargo.toml ./
+RUN mkdir src && echo "fn main() { panic!(\"why am i running?\") }" > src/main.rs
+RUN cargo build --release --locked --bin redlib
+RUN rm ./src/main.rs && rmdir ./src
+
+# copy the source and build the redlib binary
+COPY . ./
+RUN cargo build --release --locked --bin redlib
+RUN echo "finished building redlib!"
+
+########################
+## release image
+########################
+FROM debian:${DEBIAN_VERSION_CODENAME}-slim AS release
+
+# Import redlib binary from builder
+COPY --from=builder /redlib/target/release/redlib /usr/local/bin/redlib
+
+# Add non-root user for running redlib
+RUN useradd \
+    --no-create-home \
+    --password "!" \
+    --comment "user for running redlib" \
+    redlib
+USER redlib
+
+# Document that we intend to expose port 8080 to whoever runs the container
+EXPOSE 8080
+
+# Run a healthcheck every minute to make sure redlib is functional
+HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider -q http://localhost:8080/settings || exit 1
+
+# Add container metadata
+LABEL org.opencontainers.image.authors="sigaloid"
+
+CMD ["redlib"]
diff --git a/Dockerfile.distroless b/Dockerfile.distroless
new file mode 100644
index 000000000..11aa84522
--- /dev/null
+++ b/Dockerfile.distroless
@@ -0,0 +1,54 @@
+# supported versions here: https://github.com/googlecontainertools/distroless
+ARG DEBIAN_VERSION_NUMBER=13
+# supported builder cpu architectures here: https://github.com/rust-cross/rust-musl-cross
+ARG RUST_MUSL_CROSS_TAG=x86_64-musl
+
+########################
+## builder image
+########################
+FROM ghcr.io/rust-cross/rust-musl-cross:${RUST_MUSL_CROSS_TAG} AS builder
+
+ARG COMPILE_TARGET=x86_64-unknown-linux-musl
+
+RUN apt-get update \
+    && apt-get -y install git cmake perl pkg-config libclang-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN rustup target add ${COMPILE_TARGET}
+
+WORKDIR /redlib
+
+# display backtrace on build error
+ENV RUST_BACKTRACE=full
+
+# download (most) dependencies in their own layer
+COPY Cargo.lock Cargo.toml ./
+RUN mkdir src && echo "fn main() { panic!(\"why am i running?\") }" > src/main.rs
+RUN cargo build --release --locked --bin redlib --target ${COMPILE_TARGET}
+RUN rm ./src/main.rs && rmdir ./src
+
+# copy the source and build the redlib binary
+COPY . ./
+RUN cargo build --release --locked --bin redlib --target ${COMPILE_TARGET}
+RUN echo "finished building redlib!"
+
+########################
+## release image
+########################
+FROM gcr.io/distroless/static-debian${DEBIAN_VERSION_NUMBER}:nonroot AS release
+
+ARG COMPILE_TARGET=x86_64-unknown-linux-musl
+
+# Import redlib binary from builder
+COPY --from=builder --chown=65532:65532 /redlib/target/${COMPILE_TARGET}/release/redlib /usr/local/bin/redlib
+
+# Document that we intend to expose port 8080 to whoever runs the container
+EXPOSE 8080
+
+# Run a healthcheck every minute to make sure redlib is functional
+HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider -q http://localhost:8080/settings || exit 1
+
+# Add container metadata
+LABEL org.opencontainers.image.authors="sigaloid"
+
+CMD ["redlib"]
diff --git a/Dockerfile.ubuntu b/Dockerfile.ubuntu
index c929de718..1843f3c3e 100644
--- a/Dockerfile.ubuntu
+++ b/Dockerfile.ubuntu
@@ -1,6 +1,6 @@
 # supported versions here: https://hub.docker.com/_/rust
-ARG RUST_BUILDER_VERSION=slim-bookworm
-ARG UBUNTU_RELEASE_VERSION=noble
+ARG RUST_BUILDER_VERSION=slim-trixie
+ARG UBUNTU_RELEASE_VERSION=resolute
 
 ########################
 ## builder image
@@ -13,6 +13,9 @@ RUN apt-get update \
 
 WORKDIR /redlib
 
+# display backtrace on build error
+ENV RUST_BACKTRACE=full
+
 # download (most) dependencies in their own layer
 COPY Cargo.lock Cargo.toml ./
 RUN mkdir src && echo "fn main() { panic!(\"why am i running?\") }" > src/main.rs