feat(docker): Switch to a distroless base image

.github/workflows/ci.yml

@@ -572,7 +572,7 @@ jobs:
       matrix:
         image_name: ["relay"] # Don't publish relay-pop (for now)
 
-    if: github.event_name == 'merge_group' 
+    if: github.event_name == 'merge_group'
 
     env:
       GHCR_DOCKER_IMAGE: "ghcr.io/getsentry/${{ matrix.image_name }}"
@@ -854,6 +854,13 @@ jobs:
           image_url: ghcr.io/getsentry/relay:${{ github.event.pull_request.head.sha || github.sha }}
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
+      - name: Inspect failure
+        if: failure()
+        run: |
+          cd /home/runner/work/_actions/getsentry/self-hosted/master
+          docker compose ps
+          docker compose logs
+
   validate-devservices-config:
       runs-on: ubuntu-24.04
       needs: devservices-files-changed

Dockerfile.release

@@ -1,31 +1,21 @@
-FROM debian:bookworm-slim
+FROM gcr.io/distroless/cc-debian12:debug AS builder
 
-ARG TARGETPLATFORM
-
-RUN apt-get update \
-  && apt-get install -y ca-certificates gosu curl --no-install-recommends \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
+RUN ["/busybox/busybox", "mkdir", "/work", "/etc/relay"]
 
-ENV \
-  RELAY_UID=10001 \
-  RELAY_GID=10001
 
-# Create a new user and group with fixed uid/gid
-RUN groupadd --system relay --gid $RELAY_GID \
-  && useradd --system --gid relay --uid $RELAY_UID relay
+FROM gcr.io/distroless/cc-debian12:nonroot
 
-RUN mkdir /work /etc/relay \
-  && chown relay:relay /work /etc/relay
-VOLUME ["/work", "/etc/relay"]
-WORKDIR /work
+ARG TARGETPLATFORM
 
 EXPOSE 3000
 
-COPY $TARGETPLATFORM/relay /bin/relay
-RUN chmod +x /bin/relay
+COPY --from=builder --chown=nonroot:noonroot /etc/relay /etc/relay
+COPY --from=builder --chown=nonroot:noonroot /work /work
 
-COPY ./docker-entrypoint.sh /
-ENTRYPOINT ["/bin/bash", "/docker-entrypoint.sh"]
-CMD ["run"]
+VOLUME ["/etc/relay", "/work"]
+WORKDIR /work
 
+COPY --chmod=755 $TARGETPLATFORM/relay /bin/relay
+
+ENTRYPOINT ["/bin/relay"]
+CMD ["run"]

relay-kafka/Cargo.toml

@@ -13,7 +13,7 @@ publish = false
 workspace = true
 
 [dependencies]
-rdkafka = { workspace = true, optional = true, features = ["tracing", "ssl"] }
+rdkafka = { workspace = true, optional = true, features = ["tracing", "ssl", "libz-static"] }
 rdkafka-sys = { workspace = true, optional = true }
 relay-log = { workspace = true, optional = true }
 relay-statsd = { workspace = true, optional = true }