Use distroless base image for runtime container images

CHANGELOG.md

@@ -24,6 +24,7 @@
 * [ENHANCEMENT] Metrics Helper: Add native histogram support for aggregating and merging, including dual-format histogram handling that exposes both native and classic bucket formats. #7359
 * [ENHANCEMENT] Cache: Add per-tenant TTL configuration for query results cache to control cache expiration on a per-tenant basis with separate TTLs for regular and out-of-order data. #7357
 * [ENHANCEMENT] Update build image and Go version to 1.26. #7437
+* [ENHANCEMENT] Upgraded container base images from `alpine:3.23` to `gcr.io/distroless/static-debian12`, reducing image size and attack surface. #7637
 * [ENHANCEMENT] Query Scheduler: Add `cortex_query_scheduler_tracked_requests` metric to track the current number of requests held by the scheduler. #7355
 * [ENHANCEMENT] Compactor: Prevent partition compaction to compact any blocks marked for deletion. #7391
 * [ENHANCEMENT] Distributor: Optimize memory allocations by reusing the existing capacity of these pooled slices in the Prometheus Remote Write 2.0 path. #7392

cmd/cortex/Dockerfile

@@ -1,7 +1,7 @@
-FROM       alpine:3.23
+ARG        BASEIMG=gcr.io/distroless/static-debian12:latest
+FROM       ${BASEIMG}
 ARG TARGETARCH
 
-RUN        apk add --no-cache ca-certificates
 COPY       migrations /migrations/
 COPY       cortex-$TARGETARCH /bin/cortex
 EXPOSE     80

cmd/query-tee/Dockerfile

@@ -1,7 +1,7 @@
-FROM       alpine:3.23
+ARG        BASEIMG=gcr.io/distroless/static-debian12:latest
+FROM       ${BASEIMG}
 ARG TARGETARCH
 
-RUN        apk add --no-cache ca-certificates
 COPY       query-tee-$TARGETARCH /query-tee
 ENTRYPOINT ["/query-tee"]
 

cmd/test-exporter/Dockerfile

@@ -1,6 +1,6 @@
-FROM       alpine:3.23
+ARG        BASEIMG=gcr.io/distroless/static-debian12:latest
+FROM       ${BASEIMG}
 ARG TARGETARCH
-RUN        apk add --no-cache ca-certificates
 COPY       test-exporter-$TARGETARCH /test-exporter
 ENTRYPOINT ["/test-exporter"]
 

cmd/thanosconvert/Dockerfile

@@ -1,6 +1,6 @@
-FROM       alpine:3.23
+ARG        BASEIMG=gcr.io/distroless/static-debian12:latest
+FROM       ${BASEIMG}
 ARG TARGETARCH
-RUN        apk add --no-cache ca-certificates
 COPY       thanosconvert-$TARGETARCH /thanosconvert
 ENTRYPOINT ["/thanosconvert"]