feat(docker): Switch to a distroless base image

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+**Features**:
+
+- Build and publish Relay containers with a distroless base image. ([#4940](https://github.com/getsentry/relay/pull/4940))
+
 **Bug Fixes**:
 
 - Normalize OS and Browser names in contexts when missing a version. ([#4957](https://github.com/getsentry/relay/pull/4957))

Dockerfile.release

@@ -1,31 +1,21 @@
-FROM debian:bookworm-slim
+FROM gcr.io/distroless/cc-debian12:debug AS builder
 
-ARG TARGETPLATFORM
-
-RUN apt-get update \
-  && apt-get install -y ca-certificates gosu curl --no-install-recommends \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
+RUN ["/busybox/busybox", "mkdir", "/work", "/etc/relay"]
 
-ENV \
-  RELAY_UID=10001 \
-  RELAY_GID=10001
 
-# Create a new user and group with fixed uid/gid
-RUN groupadd --system relay --gid $RELAY_GID \
-  && useradd --system --gid relay --uid $RELAY_UID relay
+FROM gcr.io/distroless/cc-debian12:nonroot
 
-RUN mkdir /work /etc/relay \
-  && chown relay:relay /work /etc/relay
-VOLUME ["/work", "/etc/relay"]
-WORKDIR /work
+ARG TARGETPLATFORM
 
 EXPOSE 3000
 
-COPY $TARGETPLATFORM/relay /bin/relay
-RUN chmod +x /bin/relay
+COPY --from=builder --chown=nonroot:noonroot /etc/relay /etc/relay
+COPY --from=builder --chown=nonroot:noonroot /work /work
 
-COPY ./docker-entrypoint.sh /
-ENTRYPOINT ["/bin/bash", "/docker-entrypoint.sh"]
-CMD ["run"]
+VOLUME ["/etc/relay", "/work"]
+WORKDIR /work
 
+COPY --chmod=755 $TARGETPLATFORM/relay /bin/relay
+
+ENTRYPOINT ["/bin/relay"]
+CMD ["run"]

relay-kafka/Cargo.toml

@@ -13,7 +13,7 @@ publish = false
 workspace = true
 
 [dependencies]
-rdkafka = { workspace = true, optional = true, features = ["tracing", "ssl"] }
+rdkafka = { workspace = true, optional = true, features = ["tracing", "ssl", "libz-static"] }
 rdkafka-sys = { workspace = true, optional = true }
 relay-log = { workspace = true, optional = true }
 relay-statsd = { workspace = true, optional = true }