Add Distroless variant

[tymonx]

It is related with my comment #343 (comment)

Pros:

• Small base image size (19MB) compared to other base images
• It is based on the Debian base image. Because the default mariadb image is based on the Ubuntu image, to prepare a distroless image it requires only a multi stage build, copy necessary executables, scripts and libraries from the original image into new created distroless image
• Secure, no shell and no package manager for in-container attacks, smaller security surface attacks (less libraries/executetables)
• It uses glibc (no musl Alpine issues, no performance drops)
• Stable and mature (based on the Debian 10 distro)

I can provide a support in this area.

[grooverdan]

Noted, its a pretty good option, but unfortunately it fails the repeatibility criteria (like ubi).

There's some back-burner issue MDEV-13234 for producing a minimal tarball image for release (that can be used with dbdeployer also). We'd be doing a static linking of maybe glibc there which solves most issues and hence considering bash or busybox as base image (though I'm not sure the de-bashifiying the entrypoint has a substantial value for effort).

What I'm mainly after from our user-base is a clear requirement(s), whether that is being smaller, a particular architecture, xyz package management or indeed something else.

[tymonx]

I see. I wasn't aware of this limitation. I have opened two other related issues in Docker official images and the Distroless project:

• Please add an exception for the Distroless image in the repeatability section docker-library/official-images#10218
• Make the distroless image as part of Docker official images GoogleContainerTools/distroless#739

If one of these propositions will be accepted, I propose this simple Docker scheme tag convection mariadb:<version>-distroless or mariadb:<version>-minimal with annotation in the documentation that these images are based on the Distroless image without built-in shell and package manager.

Smaller size is one of benefits (faster downloads in CI, less occupied MBs in storage) but it has other advantages like smaller security surface attacks, less CVEs (Common Vulnerabilities and Exposures) to analyze, faster/better security audits, no in-container attacks. In microservice based, secure or enterprise applications it is very important case.

[grooverdan]

Unfortunately, this requires a resolution to docker-library/official-images#10218 before we can consider it. Thanks for raising those. We'll see how Red Hat and Google respond to the build changes for UBI (Skopeo based last time I found it) and distoless respectively.