I run dnstools.ws which lets you perform DNS lookups, pings, traceroutes, etc. from 25 locations around the world. Each location is powered by a VPS running Debian, running a C# service that's compiled to native code ahead-of-time using Native AOT. It uses ~60MB RAM.
Six of the the locations are powered by tiny "NAT VPSes" (native IPv6 with shared NAT IPv4) that only cost a few dollars a year, sponsored by various server providers. These usually have 256 MB RAM and 4-5 GB disk space.
This is great with OpenVZ and LXC. Since they're containers that share the kernel with the host, kernel memory doesn't count towards the container's memory limit. I'm using ~75 MB RAM on those systems: ~60MB for the DNSTools worker and ~15MB for everything else (sshd, systemd, cron, rsyslogd, and unattended-upgrades). Plenty of room left.
I also have a few KVM systems with 256 MB RAM. These are what I'm struggling with.
Debian 13 (Trixie) increased the minimum hardware requirements from 256 MB to 512 MB RAM. It seems like this is a hard requirement - When running on a system using 256 MB RAM, the installer complains about having too little RAM, and OOMs during the installation. Even with a successful installation (e.g. upgrading from bookworm to trixie), it kernel panics on boot: "System is deadlocked on memory".
I could try debootstrap to bootstrap a basic system, or Clonezilla to clone a working disk image over the network, but I think I'd hit the memory deadlock too.
Does Debian have smaller kernel images for VM environments, that use less RAM? Or should I just give up on Debian for this use case?
Does anyone have a recommendation for another distro I should use? I've been considering trying Alpine. C# does support compiling to use musl instead of glibc, so that's not an issue. I'm also not tightly-coupled to systemd and can get rid of it.
I can mount a custom ISO on the systems, so booting from an ISO isn't an issue.
Thanks!
Edit: Alpine looks very promising - no issue installing it and running my app on a 256MB VM. This is probably what I'll end up using.


npm is finally going to disable postinstall scripts by default in the next major version at least, copying what other JS package managers like pnpm do. They also added a setting for minimum age (only install package versions that are at least X days old) which is meant to help too - the idea being that malware will have been detected and removed before anyone installs it.
People use third-party Linux package repos all the time though, and they have similar attack vectors. If I can convince you to add my Debian/RPM/whatever repo, I can create a package with the same name as a common one but with a newer version number, and
apt upgradewill happily replace the official package with my malicious one.This is intentional for several reasons (e.g.
deb.sury.orghas PHP packages that replace the official Debian ones) but I'm really surprised we don't see more supply chain attacks via third party deb/rpm repos.Maybe it's because the barrier to entry is higher? With a custom deb repo (either self-hosted or using something like Packagecloud or Ubuntu PPA), you need to create the repo, create Debian packages, add them to the repo (eg using Aptly), GPG sign the repo, and convince people to add the repo. npm is just one repo with everything in it.