Containerization patterns for NFs

Multi-Stage Builds for Lean Images

Container images for NFs benefit dramatically from multi-stage builds. The pattern: a builder stage uses the full Go (or C) toolchain to compile the binary; the final runtime stage starts FROM a minimal base (distroless, alpine, or scratch) and copies only the binary plus required runtime files. A Go NF binary built statically with CGO_ENABLED=0 fits in a 20-30 MB scratch image. A C-based Open5GS NF needs a runtime base with libc and OpenSSL but stays under 100 MB. Smaller images mean faster pulls during rolling upgrades, less storage in the registry, and reduced attack surface (fewer…