use distroless base image

[matthyx]

this one requires a modification in the Helm chart:

securityContext:
  fsGroup: 65532
  runAsUser: 65532

there might be issues with existing files in /data because they were previously created with user ks

[codiumai-pr-agent[bot]]

PR Analysis

• 🎯 Main theme: Update Dockerfile to use distroless base image

• 📌 Type of PR: Enhancement

• 🧪 Relevant tests added: No

• ✨ Focused PR: Yes, the PR is focused as it only changes the Dockerfile to use a distroless base image

• 🔒 Security concerns: No, the changes made in this PR do not introduce any obvious security concerns. The use of a distroless image can actually improve security by minimizing the attack surface.

  PR Feedback

• General suggestions: The PR is generally well-structured and the changes are clear. However, it would be beneficial to add tests to verify the functionality of the new base image. Additionally, it would be helpful to provide more information in the PR description about why this change is being made and what benefits it brings.

• 🤖 Code feedback:

  • relevant file: build/Dockerfile suggestion: Consider pinning the version of the distroless image to ensure reproducible builds and avoid potential issues with latest versions. [important] relevant line: FROM gcr.io/distroless/static-debian11:nonroot

  • relevant file: build/Dockerfile suggestion: It's a good practice to use multi-stage builds to keep the final image small and secure. However, ensure that only the necessary files are copied into the final image to avoid including unnecessary files which could potentially increase the attack surface. [medium] relevant line: COPY --from=builder /out/storage /usr/bin/storage

  • relevant file: build/Dockerfile suggestion: The ARG image_version is declared but not used in the Dockerfile. If it's not required, consider removing it to avoid confusion. [medium] relevant line: ARG image_version

How to use

To invoke the PR-Agent, add a comment using one of the following commands: /review [-i]: Request a review of your Pull Request. For an incremental review, which only considers changes since the last review, include the '-i' option. /describe: Modify the PR title and description based on the contents of the PR. /improve: Suggest improvements to the code in the PR. /ask \<QUESTION>: Pose a question about the PR.

To edit any configuration parameter from 'configuration.toml', add --config_path=new_value For example: /review --pr_reviewer.extra_instructions="focus on the file: ..." To list the possible configuration parameters, use the /config command.

[github-actions[bot]]

Summary:

• License scan: success
• Credentials scan: success
• Vulnerabilities scan: success
• Unit test: success
• Go linting: success

[matthyx]

temporary fix for permissions, add an initContainer to do a chown on startup