Build a distroless variant using ko or apko

[jawnsy]

Feature Description

Build a minimal, distroless, container image using the ko build tool or the related apko build tool.

This removes all extraneous container contents, which reduces false positives that occur when other unrelated libraries are included in the base image. Additionally, it makes it easier to produce signed images or publish an SBOM.

[enocom]

Our default image actually already uses distroless. See here and here.

For signed images, we're considering #1267. If you have thoughts on what that should look like, please add them to the issue.

Assuming you're not thinking of something else that I've missed, I'm going to close this. Feel free to re-open if our current distroless container needs some work.

[jawnsy]

Thanks for triaging and the links! I think documentation would be useful to help people choose between the images, based on the README description, it seems that the default distroless variant would be preferable for us, over alpine.

I agree with closing this, thanks for taking a look and sorry about the noise.