Use Distroless as base image

[yank1]

Use Distroless as base image to reduce attack surface and image size.

Metioned by #13459 , #10804 and #10805 .

Signed-off-by: yankay kay.yan@daocloud.io

Please read https://github.com/etcd-io/etcd/blob/main/CONTRIBUTING.md#contribution-flow.

[serathius]

I haven't followed previous discussions about Etcd base image, however I'm fully supporting for switching to distroless image for security reasons.

[ptabor]

SGTM.

Could you please add it to changelog, as it might be important that some debugging tools will not be available within the image.

[yank1]

Thanks for comments, the message have been add to changelog

SGTM.

Could you please add it to changelog, as it might be important that some debugging tools will not be available within the image.

[ptabor]

Thank you. Will merge when tests are green.

[joestringer]

Hi @yank1 , I see that this changed the base image to gcr.io/distroless/base-debian11. However, it seems like etcd is compiled statically so it may be possible to further reduce the attack surface by switching to gcr.io/distroless/static-debian11. Did you consider this option?

[serathius]

It struck me when reading #14792. Busybox is a GPL licensed https://hub.docker.com/_/busybox https://www.busybox.net/license.html

Not a expert, but I think there is a risk of etcd breaking busybox license by distributing docker image that busybox. My recommendation would be to remove it.

Problem is that we backported this PR and released v3.4.23. I would recommend to remove/replace docker images.
cc @ahrtr @ptabor @spzala.

[ptabor]

Thank you Marek, for spotting this.

My thoughts are following:

1. I think it didn't introduced any regression. Full debian (k8s.gcr.io/build-image/debian-base:bullseye-v1.1.0) contained also e.g. bash, that is GPL licensed software: https://www.gnu.org/licenses/gpl-3.0.html
2. Thus I wouldn't perform any replacement in 3.4.23.
3. Having said that, I think we might not need the busybox at all:
   • Creation of directory can be executed using: https://docs.docker.com/engine/reference/builder/#workdir
   • I'm not sure whether we need shell technically... I don't see reason. I think it's just convenient for debugging dockers.

[ahrtr]

It struck me when reading #14792.

I assume you were talking about #15017 or #15016

Not a expert, but I think there is a risk of etcd breaking busybox license by distributing docker image that busybox

Shouldn't it be OK as long as etcd's an open source project?

3. Having said that, I think we might not need the busybox at all:

The only impact would be that users can't log into a running container firstly and then execute command (e.g etcdctl). Instead, they can do it in just one command.

[iavael]

@serathius if etcd doesn't link to busybox, then it's fine

[ahrtr]

FYI. #15037