Distroless is stuck on debian 11 - we can do the same thing, more or
less in our own script. Sad that we have to, but here we are.
The net result is a about 8MB smaller and passes e2e and passes trivy.
For each package and binary we need, this pulls in all the files and
deps (shared libs, mostly). The build is slower but the final image is
85 MB (versus 157 MB before). e2e passes. Hopefully less CVE surface.
This is based on scripts used in kubernetes and KinD.
Tim Hockin