Add distroless support for CBL-Mariner

[mthalman]

• Define custom Linux VM scale set agent pool
• Support "FROM scratch" Dockerfiles in Image Builder
• Define CBL-Mariner builder Dockerfile
• Pre-build script for building CBL-Mariner distroless image
• Define distroless Dockerfiles for CBL-Mariner
• Update tests to handle distroless
• Merge to main

[johnazariah]

Watching!

[mthalman]

Instead of using the Mariner toolkit to build the Mariner distroless image with the necessary package dependencies, I'm proposing a new strategy that will allow Mariner's distroless container image to be used as a base layer instead. This avoids the need to use Mariner's toolkit, provides layer sharing, and is a simple enough pattern to be easily maintainable.

I have a sample gist of a Dockerfile that accomplishes the building of a .NET runtime-deps image based on Mariner's distroless image: https://gist.github.com/mthalman/99f1188e974ebbda5910a87f188a0870.

The installation pattern involves the use of dnf to install the needed packages into an explicitly defined install root location separate from the root of the container. This acts as an isolated staging location for all the files that get installed by these packages and their dependencies. With that staging location fully populated, it can be copied en masse to the final stage of the Dockerfile, overlaying it's contents on top of the root of the distroless image.

This approach results in an image that has full fidelity with comparison to the equivalent image produced by Mariner's toolkit.

I recommend this strategy to produce our images instead of building with Mariner's toolkit. Not only is the Dockerfile a cleaner and more self-describing implementation, but it eliminates the need for special infrastructure (e.g. custom build agents).

[olljanat]

@mthalman so are those distroless runtime images now available on somewhere? I cannot see those at least on https://hub.docker.com/_/microsoft-dotnet-runtime/ or https://hub.docker.com/_/microsoft-dotnet-aspnet/