antondlr 1c635f57a0 Fix reproducible image: switch to distroless/cc-debian11, copy libssl from builder ...

The previous final stage used distroless/cc-debian12 (Bookworm) which carries
no libssl and uses OpenSSL 3, making the Bullseye-built binary non-functional.

- Switch to distroless/cc-debian11:nonroot (pinned by index digest) — same
  Bullseye ABI as the builder, already includes libc and libgcc
- Copy libssl.so.1.1 and libcrypto.so.1.1 from the builder stage into /usr/lib/
  so no package manager is invoked in the final image (stays fully pinned)
- Normalise the arch-specific triplet lib path via a `find` into /libs/ so the
  COPY instructions work identically for both amd64 and arm64 builds

Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>

2026-04-20 11:25:18 +02:00

1.7 KiB

Raw Blame History

View Raw