minimize image contents

[BenTheElder]

We have a pattern developed for kube-proxy from the kind haproxy image based on the ideas in bazel rules_docker where you copy over a subset of additional debian package contents to a distroless image resulting in an image with all the binaries + libraries you need AND their package info / license but nothing else.

See:

https://github.com/kubernetes-sigs/kind/tree/main/images/haproxy
https://github.com/kubernetes/release/tree/master/images/build/distroless-iptables/distroless

Semi-related: #518 (though it appears we're still going to need a shell)

Seems like git-sync would be a good use case for this approach.

[BenTheElder]

Doing this has the benefit of:

• smaller images
• less CVEs

It has the downside of:

• more complex build
• less layer sharing (only the base distroless contents can be shared between images, vs if you used say debian everywhere you might have common binaries in shared base layers)

IMHO those are typically a preferable trade-off, it's hard to predict layer sharing anyhow and the total image size should shrink. The builds seem relatively maintainable.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[thockin]

Done! Cut by about half.

[thockin]

Hmm, seems to not work on cross-platform builds.

[thockin]

docker/buildx#495

[thockin]

It looks like I just needed to reinit buildx, which is actually in our Makefile. Not sure how to ensure that is fresh, but I am building the v4.0.0-rc1 for all platforms now.