From 17618ac28831113b17bfdd226fbabd3028de16b7 Mon Sep 17 00:00:00 2001
From: Jesus Vazquez <jesus.vazquez@grafana.com>
Date: Wed, 4 Dec 2024 14:25:53 +0100
Subject: [PATCH] docker: build using distroless image

Signed-off-by: Jesus Vazquez <jesus.vazquez@grafana.com>
---
 Dockerfile | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index fc219d2f..e03e7784 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,15 @@
-FROM alpine
+FROM alpine as builder
 RUN apk --update add --no-cache ca-certificates
-ADD carbon-relay-ng-linux-amd64 /bin/carbon-relay-ng
+RUN mkdir /var/spool/carbon-relay-ng
+
+# But the final image is distroless
+FROM gcr.io/distroless/static-debian12
+COPY --from=builder /etc/ssl /etc/ssl
+COPY --from=builder /var/spool /var/spool
+
 VOLUME /conf
 ADD examples/carbon-relay-ng.ini /conf/carbon-relay-ng.ini
-RUN mkdir /var/spool/carbon-relay-ng
+ADD carbon-relay-ng-linux-amd64 /bin/carbon-relay-ng
+
 ENTRYPOINT ["/bin/carbon-relay-ng"]
 CMD ["/conf/carbon-relay-ng.ini"]