build: use scratch runtime images

[SidheshwarSarangal]

Description

Replace the BusyBox runtime stages for the operator, Prometheus config reloader, and admission webhook with gcr.io/distroless/static-debian12:nonroot.

The Go binaries are built with CGO_ENABLED=0. The distroless base keeps the containers non-root while providing CA certificates and timezone data.

Relates to #8748

Testing

• Built all three images with Docker:
  • operator
  • prometheus-config-reloader
  • admission-webhook
• Ran each image with --help
• git diff --check

AI assistance

AI assistance was used to inspect the build configuration and draft this focused change. I reviewed the diff and can explain it.

[jkroepke]

We should keep in mind that some end users prefer logging in their own timezone. Only the operator binary embeds timezone data, while the admission and reloader binaries do not include tzdata.

Distroless provides tzdata and CA certificates out of the box, while scratch does not. The size difference might be only around 2 MB.

Prometheus may have chosen distroless for similar reasons, and Grafana uses distroless as well. Since much of the surrounding ecosystem already uses distroless as a base image, I personally recommend following the same approach.

[SidheshwarSarangal]

Thanks for the guidance. I updated all three runtime stages to gcr.io/distroless/static-debian12:nonroot, which preserves a non-root runtime while providing CA certificates and timezone data. I rebuilt each image and verified each binary with --help.

[jkroepke]

May use gcr.io/distroless/static-debian13. I guess your AI agent was not aware of latest version.

[simonpasquier]

The plan discussed in #8748 was to have distroless variants as moving away from busybox images is a major (potentially breaking) change for users.