[PM-7068] - Use a distroless container image for bws

[tangowithfoxtrot]

Type of change

• Bug fix
• New feature development
• Tech debt (refactoring, code cleanup, dependency upgrades, etc)
• Build/deploy pipeline (DevOps)
• Other

Objective

Addresses PM-7068. Build the bws Docker image from an empty file system. This results in a much smaller Docker image (~16MB, uncompressed) with a smaller threat surface than bundling it with a distro.

Code changes

• ./crates/bws/Dockerfile: Use scratch for the final build stage. This results in a distroless image that only contains our binary, the libraries that it depends on, and the CA certificates needed for SSL to work. The ldd line automatically determines what dependencies we need to copy over so we don't have to manually maintain a list of them.

Before you submit

• Please add unit tests where it makes sense to do so

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 60.61%. Comparing base (596ce17) to head (5643fca).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #681   +/-   ##
=======================================
  Coverage   60.61%   60.61%           
=======================================
  Files         170      170           
  Lines       10387    10387           
=======================================
  Hits         6296     6296           
  Misses       4091     4091           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[withinfocus]

Novel approach! Is this feasible for what we're offering here? I haven't seen scratch used directly like this.

[tangowithfoxtrot]

Thanks! I borrowed this approach from some of the "hello-docker" examples.

I also use it for another container that I made for personal use.

This runs every major function of our CLI without issue: listing secrets, getting secrets, mounting config + state files, etc.

Using ldd to grab the dynamic dependencies has worked well in my experience. The image could be simplified to remove this in the future as well, if we can statically-link bws.

[Thomas-Avery]

Very cool, thank you!