Refactor the target allocator build to not run it as root

.chloggen/1346-run-ta-nonroot.yaml

@@ -0,0 +1,16 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. operator, target allocator, github action)
+component: target allocator
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: "Run the target allocator as non root user"
+
+# One or more tracking issues related to the change
+issues: [1346]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

cmd/otel-allocator/Dockerfile

@@ -1,26 +1,34 @@
 # Build the target allocator binary
 FROM golang:1.19 as builder
 
-WORKDIR /app
-
-# Copy go mod and sum files
-COPY go.mod go.sum ./
-
+WORKDIR /workspace
+# Copy the Go Modules manifests
+COPY go.mod go.mod
+COPY go.sum go.sum
+# cache deps before building and copying source so that we don't need to re-download as much
+# and so that source changes don't invalidate our downloaded layer
 RUN go mod download
 
-COPY . .
+# Copy the go source
+COPY main.go main.go
+COPY allocation/ allocation/
+COPY collector/ collector/
+COPY config/ config/
+COPY diff/ diff/
+COPY prehook/ prehook/
+COPY server/ server/
+COPY target/ target/
+COPY watcher/ watcher/
 
 # Build the Go app
 RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main .
 
-######## Start a new stage from scratch #######
-FROM alpine:latest  
-
-RUN apk --no-cache add ca-certificates
-
-WORKDIR /root/
-
+# Use distroless as minimal base image to package the manager binary
+# Refer to https://github.com/GoogleContainerTools/distroless for more details
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
 # Copy the pre-built binary file from the previous stage
-COPY --from=builder /app/main .
+COPY --from=builder /workspace/main .
+USER 65532:65532
 
-ENTRYPOINT ["./main"]
+ENTRYPOINT ["/main"]