Dockerfile: disable distroless stuff (no longer working with Nodejs 24)

[fgalan]

In PR #890 we updated Nodejs version in Dockerfile to 24.

This line causes the problem:

FROM gcr.io/distroless/nodejs:${NODE_VERSION} AS distroless

Looking at https://console.cloud.google.com/artifacts/docker/distroless/us/gcr.io?pli=1 it seems they stopped producing images in nodev18.

So we have disabled the distroless stuff by the moment. Not sure if we should remove that part completely or the distroless case can be solved in some way.

[fgalan]

Similar problem exists in https://github.com/telefonicaid/iotagent-manager repository. Apply the same decision/solution there.

[fgalan]

@jason-fox I don't remember pretty well (as a long time has passed :) but I think that the distroless image was a contribution on your side.

What do you think on this? Any alternative to gcr.io/distroless to "recover" it? Does it worth the effort? (not sure if distroless is actually used...)

Thanks for your feedback!

[jason-fox]

The security and bloat reasons for continuing to offer distroless builds still remain. Removing distroless would be a retrograde step IMHO. All that has happened is that Google have changed their naming convention. The latest distroless node image is gcr.io/distroless/nodejs24-debian12

Just amend the Dockerfile as shown and reinstate the build back into the hook.

- FROM gcr.io/distroless/nodejs:${NODE_VERSION} AS distroless
+ FROM gcr.io/distroless/nodejs${NODE_VERSION}-debian12 AS distroless

A comprehensive comparison of Node Docker Images can be found here and explains which circumstances may lead users to use Node, Node-Slim, Alpine, Distroless etc.

[fgalan]

With

FROM gcr.io/distroless/nodejs${NODE_VERSION}-debian12 AS distroless

hadolint complains

hadolint violations:  
docker/Dockerfile:159 DL3006 �[1m�[93mwarning�[0m: Always tag the version of an image explicitly  

and with

FROM gcr.io/distroless/nodejs${NODE_VERSION}-debian12:latest AS distroless

it complains

hadolint violations:  
docker/Dockerfile:159 DL3007 �[1m�[93mwarning�[0m: Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag 

(It can be checked at telefonicaid/iotagent-manager#368)

Not sure which tag to use in this case... any recomentado @jason-fox please?

[jason-fox]

The following 4 tags are supported: latest, nonroot, debug, debug-nonroot.

Personally I would leave it as it is and stick with latest (since that was the equivalent for previous node versions) and just disable the hadolint error check as a false positive for now. In this case Hadolint is being too cautious - I assume it complains about Google's sample Dockerfile too.

# hadolint ignore=DL3007
FROM gcr.io/distroless/nodejs${NODE_VERSION}-debian12 AS distroless

There is further discussion about version pinning (and lack of tags) here: GoogleContainerTools/distroless#686

[fgalan]

DL3007 overcome, but new compliant (DL3006)

telefonicaid/iotagent-manager#368 (comment)

Would ignoring it be the right solution also in this case? @jason-fox what do you think?

[fgalan]

Forget my last coment :)

DL3006 was the original error. Both seems to be "correlated" in this case. I'll configure the Dockerfile to ignore both.

[fgalan]

PRs to fix this are now ready

• FIX recover distroless image #892
• FIX recover distroless image iotagent-manager#368
• FIX recover distroless image perseo-fe#847

@jason-fox it would be great if you could have a look and provide LGTM, please.

[fgalan]

Having merged the PRs, this issue can now be closed.

@jason-fox thanks for the support on this!