Use Docker base images to distroless or scratch

[NimJay]

Background

• This repository uses a lot of alpine-based Docker base images (see relevant search).
• In light of what happened with Log4j in December 2021, we want to try to shrink the size of Docker base images being used:
  • See Google-internal bug, b/215516492.
• Smaller base images = less vulnerabilities.
• Relevant work from the past:

  • 49

  • 45

Task

For each Dockerfile in this repository that uses a distro-ed base image (e.g., alpine):

1. Explore how we could remove the need for a distro.
2. If possible, remove it.

[NimJay]

Update to cool down this issue (since this issue is currently in our out-of-SLO list):

• The effort required for resolving this fairly large (many instances of alpine + research required).
• This is not a high priority issue since the containers images are already fairly small.
• We should focus our engineering efforts towards:
  • Kustomize integration
  • OpenTelemtry support
  • Cloud Debugger deprecation

[NimJay]

Update to cool down this issue (since this issue is currently in our out-of-SLO list):

• Relevant and useful resource: github.com/GoogleContainerTools/distroless
• This is still an important task, so let's keep this issue open.
• But we should focus on more pressing engineering efforts such as:
  • CakeSoft runtime metrics
  • Auto-merging Renovate Bot PRs
  • extending OpenTelemetry support (adding OpenTelemetry metrics integrations)
  • ARM support

[minherz]

Postponing the working on this to Q4

[mathieu-benoit]

FYI: All the Golang apps are now in distroless (actually scratch): https://github.com/GoogleCloudPlatform/microservices-demo/pull/2512.

[mathieu-benoit]

FYI: The .NET app is now in distroless too: https://github.com/GoogleCloudPlatform/microservices-demo/pull/2568