Minimize Docker image size with multi-stage build

Minimize the size of the resulting Docker image size by using
multi-stage build and copying the resulting binaries into a minimal
Debian system. This was done with the Alpine Docker images up until now
but not with the Debian images.

firefox/Dockerfile

@@ -7,7 +7,7 @@
 
 # Python is needed for building libnss.
 # Use it as a common base.
-FROM python:3.10.1-slim-buster
+FROM python:3.10.1-slim-buster as builder
 
 WORKDIR /build
 
@@ -130,3 +130,18 @@ RUN ! (ldd ./out/curl-impersonate | grep -q -e nghttp2 -e brotli -e ssl -e crypt
 # Wrapper scripts
 COPY curl_ff* out/
 RUN chmod +x out/curl_*
+
+# Create a final, minimal image with the compiled binaries
+# only.
+FROM debian:buster-slim
+# curl tries to load the CA certificates for libnss.
+# It loads them from /usr/lib/libnssckbi.so and /usr/lib/libnsspem.so,
+# which are supplied by 'libnss3' and 'nss-plugin-pem' on debian.
+RUN apt-get update && apt-get install -y libnss3 nss-plugin-pem
+
+# Copy curl-impersonate from the builder image
+COPY --from=builder /build/install /usr/local
+# Copy to /build/out as well for backward compatibility with previous versions.
+COPY --from=builder /build/out /build/out
+# Wrapper scripts
+COPY --from=builder /build/out/curl_* /usr/local/bin/

firefox/Dockerfile.alpine

@@ -126,7 +126,7 @@ COPY curl_ff* out/
 RUN sed -i 's@/usr/bin/env bash@/usr/bin/env ash@' out/curl_*
 RUN chmod +x out/curl_*
 
-# When using alpine, create a final, minimal image with the compiled binaries
+# Create a final, minimal image with the compiled binaries
 # only.
 FROM alpine:3.15.0
 # curl tries to load the CA certificates for libnss.