Docker Hardened Images (dhi.io) as a new container image variant

Reason/Context

Like discussed with @lbroudoux and @yada, the Microcks project broadly could benefit from the free DHI images: https://www.docker.com/blog/docker-hardened-images-for-every-developer/.

This will allow to improve the security posture of Microcks CLI's end users, and will also minize the surface of maintenance for the Microcks's Maintainers (CVEs noise in the Scout dashboard, continuous patching of unnecessary packages, etc.).

Description

The container image of the CLI could be optimized in terms of size, number of packages and number of CVEs. See my tests here: https://github.com/mathieu-benoit/microcks-cli/pull/1.

The goal is to provide a new -distroless variant, alongside the existing tags. The benefits of this new variant will allow to have the first tests with dhi.io for a Microcks project. It will allow to get an opt-in approach for the end users and not yet defaulting to it.

In the longer terms, if successful, we may want to reduce back the number of variant and defaulting the dhi.io image, but the proposition is to capture feedback and gain experience first.

Implementation ideas

File to update: https://github.com/microcks/microcks-cli/blob/master/build/Dockerfile:

• FROM golang --> FROM dhi.io/golang
• FROM registry.access.redhat.com/ubi9/ubi-minimal --> FROM dhi.io/static

The actual implementation is already in my fork there: https://github.com/mathieu-benoit/microcks-cli/pull/1, see there for more details about the implementation and the actual outcomes/benefits.

If accepted, just let me know and I'll port this PR officially here if this is ok?

tl,dr - With DHI it's:

• 132 packages less
• 150MB on disk less
• 22 CVEs less
• distroless (no unnecessary package manager, bash, curl, etc.)

Inizia da build/Dockerfile e confrontalo con l’implementazione nella pull request del fork collegato. Verifica come vengono creati i tag delle immagini esistenti, quindi conferma che insieme a essi venga prodotta una variante distroless opt-in e che fornisca le riduzioni dichiarate relative a pacchetti, dimensioni e CVE.