feat: dockerfile updates scratch to distroless/static, and nonroot

images

Author: nxtcoder17

Dockerfile.ci

@@ -24,7 +24,8 @@ nix \
   develop --command run build binary_out=/tmp/plugin-helm-controller
 EOF
 
-FROM scratch
-COPY --from=builder /tmp/plugin-helm-controller /plugin-helm-controller
-USER 1001
-ENTRYPOINT ["/plugin-helm-controller"]
+FROM gcr.io/distroless/static
+WORKDIR /home/nonroot
+USER nonroot:nonroot
+COPY --from=builder --chown=nonroot:nonroot /tmp/plugin-helm-controller ./plugin-helm-controller
+ENTRYPOINT ["./plugin-helm-controller"]

IMAGES/helm-job-runner/Dockerfile-nix

@@ -16,7 +16,8 @@ cp -R $(nix-store -qR /tmp/output/result) /tmp/nix-store-closure
 EOF
 
 FROM gcr.io/distroless/static
-COPY --from=builder /tmp/nix-store-closure /nix/store
+WORKDIR /home/nonroot
 USER nonroot:nonroot
+COPY --from=builder /tmp/nix-store-closure /nix/store
 COPY --from=builder --chown=nonroot:nonroot /tmp/output/ /app/
 ENV PATH=/app/result/bin