feat: Use a rootless hardened docker image

[timokoessler]

Type of change

• 🐛 Bug fix
• 🚀 New feature
• ❓ Other (please specify)

Description

• Use hardened Docker images without any CLI or executables, just minimal required libraries
• Use a rootless image for the hub
• Also sign docker images using cosign

Additional context

There is no alpine variant available and this debian based distroless images are not really larger. DHI images by Docker itself required authentication to be pulled and are not really open source.

[Copilot]

Pull request overview

Updates the Hub/Agent container images to use hardened distroless bases (including running Hub rootless), adds startup checks to ensure the Hub data directory is writable under rootless execution, and extends the release workflow to verify/sign images with cosign.

Changes:

• Switch Hub and Agent runtime images from Alpine to distroless (Hub uses :nonroot).
• Add Hub startup initialization to create/check writability of the data directory, with new unit tests.
• Add cosign install + base image signature verification + image signing to the release workflow.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
hub.Dockerfile	Moves Hub runtime to distroless nonroot base and adjusts copies to set ownership.
agent.Dockerfile	Moves Agent runtime to distroless base (root) with rationale comments.
backend/internal/hub/server.go	Calls initDataDir() during Hub startup before DB connect.
backend/internal/hub/data_dir.go	Implements data directory creation + writability checks with user-facing error guidance.
backend/internal/hub/data_dir_test.go	Adds tests for writable and non-existent directories.
backend/internal/hub/data_dir_unix_test.go	Adds a Unix-only test for read-only directory handling.
.github/workflows/release.yml	Adds cosign verification of base images and signs published images; introduces matrix base image refs.
.dockerignore	Ignores *.exe artifacts in Docker build context.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 59.25926% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/internal/hub/data_dir.go	66.66%	4 Missing and 4 partials ⚠️
backend/internal/hub/server.go	0.00%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!