Convert Dockerfile to use distroless base image

- Replace Alpine base with gcr.io/distroless/static-debian12:nonroot
- Use multi-stage build to copy CA certificates from temporary Alpine stage
- Remove user creation since distroless images handle non-root execution
- Improve security and reduce image size with distroless approach
- Maintain same functionality while following security best practices

Author: chaptersix

Dockerfile

@@ -1,16 +1,18 @@
 # syntax=docker/dockerfile:1
 
-FROM alpine:3.22@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412
+# Build stage to extract CA certificates
+FROM alpine:3.22@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412 AS certs
+RUN apk add --no-cache ca-certificates
 
-# Install CA certificates and create non-root user
-RUN apk add --no-cache ca-certificates && \
-    adduser -u 1000 -D temporal
+# Final distroless stage
+FROM gcr.io/distroless/static-debian12:nonroot
+
+# Copy CA certificates from certs stage
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 
 # Copy the appropriate binary for target architecture
 ARG TARGETARCH
 COPY dist/nix_linux_${TARGETARCH}/temporal /temporal
 
-# Run as non-root user temporal
-USER temporal:temporal
-
+# Set entrypoint
 ENTRYPOINT ["/temporal"]