docker: switch base image from distroless/base to distroless/static:nonroot

[yosida95]

go-httpbin is built fully statically and does not depend on libc, so it can use the distroless/static image. This change reduces the resulting image size by about half.

$ docker image ls
REPOSITORY                     TAG       IMAGE ID       CREATED          SIZE
go-httpbin                     nonroot   9910daab0040   38 minutes ago   19.5MB
ghcr.io/mccutchen/go-httpbin   2.18.3    115573352e3d   4 months ago     38.1MB

Since go-httpbin's default listening port is 8080, an unprivileged port, it can run as non-root. While this may break setups that use privileged ports, running as non-root provides a clear security advantage. Such users can continue using their ports by adding the CAP_NET_BIND_SERVICE capability.

[mccutchen]

Oh I like this, thank you!

Such users can continue using their ports by adding the CAP_NET_BIND_SERVICE capability.

Would you mind adding this note to the README under the docker instructions?

Thanks!

[yosida95]

@mccutchen I've updated the README and the Kubernetes manifest as well. Could you please take a look? Thanks!

[mccutchen]

This looks great, thanks!

I love the thoroughness of the README update, but I might actually push a small commit to link out to documentation on CAP_NET_BIND_SERVICE to keep it brief, given that this is unlikely — I assume — to be a common need.

(Also, I'll fix the test failure separately.)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.12%. Comparing base (d0da72b) to head (365c89b).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #224   +/-   ##
=======================================
  Coverage   95.12%   95.12%           
=======================================
  Files          10       10           
  Lines        1827     1827           
=======================================
  Hits         1738     1738           
  Misses         52       52           
  Partials       37       37           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mccutchen]

I love the thoroughness of the README update, but I might actually push a small commit to link out to documentation on CAP_NET_BIND_SERVICE to keep it brief, given that this is unlikely — I assume — to be a common need.

On second thought, I kept the more detailed info but moved it down below. I hope you don't mind!

Thanks a lot for the contribution, this is a nice little improvement to both image size and out-of-the-box security posture.