build: Loki build and Docker updates

Makefile

@@ -38,6 +38,7 @@ BUILD_IN_CONTAINER ?= true
 
 # ensure you run `make drone` and `make release-workflows` after changing this
 BUILD_IMAGE_VERSION ?= 0.33.4
+GO_VERSION := 1.22.5
 
 # Docker image info
 IMAGE_PREFIX ?= grafana
@@ -141,7 +142,7 @@ logcli: cmd/logcli/logcli ## build logcli executable
 logcli-debug: cmd/logcli/logcli-debug ## build debug logcli executable
 
 logcli-image: ## build logcli docker image
-	$(SUDO) docker build -t $(IMAGE_PREFIX)/logcli:$(IMAGE_TAG) -f cmd/logcli/Dockerfile .
+	$(SUDO) docker build --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/logcli:$(IMAGE_TAG) -f cmd/logcli/Dockerfile .
 
 cmd/logcli/logcli:
 	CGO_ENABLED=0 go build $(GO_FLAGS) -o $@ ./cmd/logcli
@@ -597,9 +598,9 @@ endef
 
 # promtail
 promtail-image: ## build the promtail docker image
-	$(SUDO) docker build -t $(IMAGE_PREFIX)/promtail:$(IMAGE_TAG) -f clients/cmd/promtail/Dockerfile .
+	$(SUDO) docker build --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/promtail:$(IMAGE_TAG) -f clients/cmd/promtail/Dockerfile .
 promtail-image-cross:
-	$(SUDO) $(BUILD_OCI) -t $(IMAGE_PREFIX)/promtail:$(IMAGE_TAG) -f clients/cmd/promtail/Dockerfile.cross .
+	$(SUDO) $(BUILD_OCI) --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/promtail:$(IMAGE_TAG) -f clients/cmd/promtail/Dockerfile.cross .
 
 promtail-debug-image: ## build the promtail debug docker image
 	$(SUDO) $(BUILD_OCI) -t $(IMAGE_PREFIX)/promtail:$(IMAGE_TAG)-debug -f clients/cmd/promtail/Dockerfile.debug .
@@ -609,47 +610,47 @@ promtail-push: promtail-image-cross
 
 # loki
 loki-image: ## build the loki docker image
-	$(SUDO) docker build -t $(IMAGE_PREFIX)/loki:$(IMAGE_TAG) -f cmd/loki/Dockerfile .
+	$(SUDO) docker build --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki:$(IMAGE_TAG) -f cmd/loki/Dockerfile .
 loki-image-cross:
-	$(SUDO) $(BUILD_OCI) -t $(IMAGE_PREFIX)/loki:$(IMAGE_TAG) -f cmd/loki/Dockerfile.cross .
+	$(SUDO) $(BUILD_OCI) --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki:$(IMAGE_TAG) -f cmd/loki/Dockerfile.cross .
 
 loki-debug-image: ## build the debug loki docker image
-	$(SUDO) $(BUILD_OCI) -t $(IMAGE_PREFIX)/loki:$(IMAGE_TAG)-debug -f cmd/loki/Dockerfile.debug .
+	$(SUDO) $(BUILD_OCI) --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki:$(IMAGE_TAG)-debug -f cmd/loki/Dockerfile.debug .
 
 loki-push: loki-image-cross
 	$(call push-image,loki)
 
 # loki-canary
 loki-canary-image: ## build the loki canary docker image
-	$(SUDO) docker build -t $(IMAGE_PREFIX)/loki-canary:$(IMAGE_TAG) -f cmd/loki-canary/Dockerfile .
+	$(SUDO) docker build --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki-canary:$(IMAGE_TAG) -f cmd/loki-canary/Dockerfile .
 loki-canary-image-cross:
-	$(SUDO) $(BUILD_OCI) -t $(IMAGE_PREFIX)/loki-canary:$(IMAGE_TAG) -f cmd/loki-canary/Dockerfile.cross .
+	$(SUDO) $(BUILD_OCI) --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki-canary:$(IMAGE_TAG) -f cmd/loki-canary/Dockerfile.cross .
 loki-canary-image-cross-boringcrypto:
-	$(SUDO) $(BUILD_OCI) -t $(IMAGE_PREFIX)/loki-canary-boringcrypto:$(IMAGE_TAG) -f cmd/loki-canary-boringcrypto/Dockerfile .
+	$(SUDO) $(BUILD_OCI) --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki-canary-boringcrypto:$(IMAGE_TAG) -f cmd/loki-canary-boringcrypto/Dockerfile .
 loki-canary-push: loki-canary-image-cross
 	$(SUDO) $(PUSH_OCI) $(IMAGE_PREFIX)/loki-canary:$(IMAGE_TAG)
 loki-canary-push-boringcrypto: loki-canary-image-cross-boringcrypto
 	$(SUDO) $(PUSH_OCI) $(IMAGE_PREFIX)/loki-canary-boringcrypto:$(IMAGE_TAG)
 helm-test-image: ## build the helm test image
-	$(SUDO) docker build -t $(IMAGE_PREFIX)/loki-helm-test:$(IMAGE_TAG) -f production/helm/loki/src/helm-test/Dockerfile .
+	$(SUDO) docker build --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki-helm-test:$(IMAGE_TAG) -f production/helm/loki/src/helm-test/Dockerfile .
 helm-test-push: helm-test-image ## push the helm test image
 	$(SUDO) $(PUSH_OCI) $(IMAGE_PREFIX)/loki-helm-test:$(IMAGE_TAG)
 
 # loki-querytee
 loki-querytee-image:
-	$(SUDO) docker build -t $(IMAGE_PREFIX)/loki-query-tee:$(IMAGE_TAG) -f cmd/querytee/Dockerfile .
+	$(SUDO) docker build --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki-query-tee:$(IMAGE_TAG) -f cmd/querytee/Dockerfile .
 loki-querytee-image-cross:
-	$(SUDO) $(BUILD_OCI) -t $(IMAGE_PREFIX)/loki-query-tee:$(IMAGE_TAG) -f cmd/querytee/Dockerfile.cross .
+	$(SUDO) $(BUILD_OCI) --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki-query-tee:$(IMAGE_TAG) -f cmd/querytee/Dockerfile.cross .
 loki-querytee-push: loki-querytee-image-cross
 	$(SUDO) $(PUSH_OCI) $(IMAGE_PREFIX)/loki-query-tee:$(IMAGE_TAG)
 
 # migrate-image
 migrate-image:
-	$(SUDO) docker build -t $(IMAGE_PREFIX)/loki-migrate:$(IMAGE_TAG) -f cmd/migrate/Dockerfile .
+	$(SUDO) docker build --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki-migrate:$(IMAGE_TAG) -f cmd/migrate/Dockerfile .
 
 # LogQL Analyzer
 logql-analyzer-image: ## build the LogQL Analyzer image
-	$(SUDO) docker build -t $(IMAGE_PREFIX)/logql-analyzer:$(IMAGE_TAG) -f cmd/logql-analyzer/Dockerfile .
+	$(SUDO) docker build --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/logql-analyzer:$(IMAGE_TAG) -f cmd/logql-analyzer/Dockerfile .
 logql-analyzer-push: logql-analyzer-image ## push the LogQL Analyzer image
 	$(call push-image,logql-analyzer)
 
@@ -663,7 +664,7 @@ else
 endif
 
 build-image: ensure-buildx-builder
-	$(SUDO) $(BUILD_OCI) -t $(IMAGE_PREFIX)/loki-build-image:$(IMAGE_TAG) ./loki-build-image
+	$(SUDO) $(BUILD_OCI) --build-arg=GO_VERSION=$(GO_VERSION) -t $(IMAGE_PREFIX)/loki-build-image:$(IMAGE_TAG) ./loki-build-image
 build-image-push: build-image ## push the docker build image
 ifneq (,$(findstring WIP,$(IMAGE_TAG)))
 	@echo "Cannot push a WIP image, commit changes first"; \

clients/cmd/promtail/Dockerfile

@@ -1,4 +1,5 @@
-FROM golang:1.22.5-bookworm as build
+ARG GO_VERSION=1.22
+FROM golang:${GO_VERSION}-bookworm as build
 
 COPY . /src/loki
 WORKDIR /src/loki

clients/cmd/promtail/Dockerfile.cross

@@ -1,8 +1,9 @@
 ARG BUILD_IMAGE=grafana/loki-build-image:0.33.4
+ARG GO_VERSION=1.22
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f clients/cmd/promtail/Dockerfile .
-FROM 1.22.2-alpine as goenv
+FROM golang:${GO_VERSION}-alpine as goenv
 RUN go env GOARCH > /goarch && \
   go env GOARM > /goarm
 

cmd/logcli/Dockerfile

@@ -1,13 +1,15 @@
-FROM golang:1.22.5 as build
+ARG GO_VERSION=1.22
+FROM golang:${GO_VERSION} as build
 
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && make BUILD_IN_CONTAINER=false logcli
 
-FROM alpine:3.18.5
 
-RUN apk add --no-cache ca-certificates
+FROM gcr.io/distroless/base-nossl:debug
 
 COPY --from=build /src/loki/cmd/logcli/logcli /usr/bin/logcli
+SHELL [ "/busybox/sh", "-c" ]
+RUN ln -s /busybox/sh /bin/sh
 
 ENTRYPOINT [ "/usr/bin/logcli" ]

cmd/logql-analyzer/Dockerfile

@@ -1,13 +1,14 @@
-FROM golang:1.22.5 as build
+ARG GO_VERSION=1.22
+FROM golang:${GO_VERSION} as build
 
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && CGO_ENABLED=0 go build ./cmd/logql-analyzer/
 
-FROM alpine:3.18.5
-
-RUN apk add --no-cache ca-certificates
+FROM gcr.io/distroless/base-nossl:debug
 
 COPY --from=build /src/loki/logql-analyzer /usr/bin/logql-analyzer
+SHELL [ "/busybox/sh", "-c" ]
+RUN ln -s /busybox/sh /bin/sh
 
 ENTRYPOINT [ "/usr/bin/logql-analyzer" ]

cmd/loki-canary-boringcrypto/Dockerfile

@@ -1,12 +1,13 @@
-FROM golang:1.22.5 as build
+ARG GO_VERSION=1.22
+FROM golang:${GO_VERSION} as build
 
 COPY . /src/loki
 WORKDIR /src/loki
 RUN go env GOARCH > /goarch
 RUN make clean && make GOARCH=$(cat /goarch) BUILD_IN_CONTAINER=true GOEXPERIMENT=boringcrypto loki-canary-boringcrypto
 
-FROM alpine:3.18.5
-RUN apk add --update --no-cache ca-certificates
-RUN apk add --no-cache libc6-compat
+FROM gcr.io/distroless/base-nossl:debug
 COPY --from=build /src/loki/cmd/loki-canary-boringcrypto/loki-canary-boringcrypto /usr/bin/loki-canary
+SHELL [ "/busybox/sh", "-c" ]
+RUN ln -s /busybox/sh /bin/sh
 ENTRYPOINT [ "/usr/bin/loki-canary" ]

cmd/loki-canary/Dockerfile

@@ -1,10 +1,13 @@
-FROM golang:1.22.5 as build
+ARG GO_VERSION=1.22
+FROM golang:${GO_VERSION} as build
 
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && make BUILD_IN_CONTAINER=false loki-canary
 
-FROM alpine:3.18.5
-RUN apk add --update --no-cache ca-certificates
+FROM gcr.io/distroless/base-nossl:debug
+
 COPY --from=build /src/loki/cmd/loki-canary/loki-canary /usr/bin/loki-canary
+SHELL [ "/busybox/sh", "-c" ]
+RUN ln -s /busybox/sh /bin/sh
 ENTRYPOINT [ "/usr/bin/loki-canary" ]

cmd/loki-canary/Dockerfile.cross

@@ -1,18 +1,20 @@
 ARG BUILD_IMAGE=grafana/loki-build-image:0.33.4
+ARG GO_VERSION=1.22
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f cmd/promtail/Dockerfile .
-FROM golang:1.22.5-alpine as goenv
+FROM golang:${GO_VERSION} as goenv
 RUN go env GOARCH > /goarch && \
   go env GOARM > /goarm
 
-FROM --platform=linux/amd64 $BUILD_IMAGE as build
+FROM $BUILD_IMAGE as build
 COPY --from=goenv /goarch /goarm /
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAINER=false loki-canary
 
-FROM alpine:3.18.5
-RUN apk add --update --no-cache ca-certificates
+FROM gcr.io/distroless/base-nossl:debug
 COPY --from=build /src/loki/cmd/loki-canary/loki-canary /usr/bin/loki-canary
+SHELL [ "/busybox/sh", "-c" ]
+RUN ln -s /busybox/sh /bin/sh
 ENTRYPOINT [ "/usr/bin/loki-canary" ]

cmd/loki/Dockerfile

@@ -1,22 +1,23 @@
-FROM golang:1.22.5 as build
+ARG GO_VERSION=1.22
+FROM golang:${GO_VERSION} as build
 
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && make BUILD_IN_CONTAINER=false loki
 
-FROM alpine:3.18.5
-
-RUN apk add --no-cache ca-certificates libcap
+FROM gcr.io/distroless/base-nossl:debug
 
 COPY --from=build /src/loki/cmd/loki/loki /usr/bin/loki
 COPY cmd/loki/loki-docker-config.yaml /etc/loki/local-config.yaml
 
+SHELL [ "/busybox/sh", "-c" ]
+
 RUN addgroup -g 10001 -S loki && \
     adduser -u 10001 -S loki -G loki
 RUN mkdir -p /loki/rules && \
     mkdir -p /loki/rules-temp && \
-    chown -R loki:loki /etc/loki /loki
-
+    chown -R loki:loki /etc/loki /loki && \
+    ln -s /busybox/sh /bin/sh
 USER 10001
 EXPOSE 3100
 ENTRYPOINT [ "/usr/bin/loki" ]

cmd/loki/Dockerfile.cross

@@ -1,28 +1,27 @@
-ARG BUILD_IMAGE=grafana/loki-build-image:0.33.4
+ARG GO_VERSION=1.22
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/loki -f cmd/loki/Dockerfile .
-FROM golang:1.22.5-alpine as goenv
+FROM golang:${GO_VERSION} as goenv
 RUN go env GOARCH > /goarch && \
     go env GOARM > /goarm
 
-FROM --platform=linux/amd64 $BUILD_IMAGE as build
-COPY --from=goenv /goarch /goarm /
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAINER=false loki
 
-FROM alpine:3.18.5
+FROM gcr.io/distroless/base-nossl:debug
 
-RUN apk add --no-cache ca-certificates
-
-COPY --from=build /src/loki/cmd/loki/loki /usr/bin/loki
+COPY --from=goenv /src/loki/cmd/loki/loki /usr/bin/loki
 COPY cmd/loki/loki-local-config.yaml /etc/loki/local-config.yaml
 
+SHELL [ "/busybox/sh", "-c" ]
+
 RUN addgroup -g 10001 -S loki && \
     adduser -u 10001 -S loki -G loki
 RUN mkdir -p /loki && \
-    chown -R loki:loki /etc/loki /loki
+    chown -R loki:loki /etc/loki /loki && \
+    ln -s /busybox/sh /bin/sh
 
 USER 10001
 EXPOSE 3100

cmd/loki/Dockerfile.debug

@@ -1,22 +1,22 @@
 ARG BUILD_IMAGE=grafana/loki-build-image:0.33.4
+ARG GO_VERSION=1.22
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/loki -f cmd/loki/Dockerfile.debug .
 
-FROM golang:1.22.5-alpine as goenv
+FROM golang:${GO_VERSION} as goenv
 RUN go env GOARCH > /goarch && \
     go env GOARM > /goarm && \
     go install github.com/go-delve/delve/cmd/dlv@latest
 
-FROM --platform=linux/amd64 $BUILD_IMAGE as build
+FROM $BUILD_IMAGE as build
 COPY --from=goenv /goarch /goarm /
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && \
     GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAINER=false loki-debug
 
-FROM       alpine:3.18.5
-RUN        apk add --update --no-cache ca-certificates
+FROM       gcr.io/distroless/base-nossl:debug
 COPY       --from=build /src/loki/cmd/loki/loki-debug /usr/bin/loki-debug
 COPY       --from=goenv /go/bin/dlv /usr/bin/dlv
 COPY       cmd/loki/loki-docker-config.yaml /etc/loki/local-config.yaml
@@ -25,8 +25,9 @@ EXPOSE     3100
 # Expose 40000 for delve
 EXPOSE 40000
 
-# Allow delve to run on Alpine based containers.
-RUN apk add --no-cache libc6-compat
+SHELL [ "/busybox/sh", "-c" ]
+RUN ln -s /busybox/sh /bin/sh
+
 
 # Run delve, ending with -- because we pass params via kubernetes, per the docs:
 #   Pass flags to the program you are debugging using --, for example:`

cmd/migrate/Dockerfile

@@ -1,10 +1,12 @@
-FROM golang:1.22.5 as build
+ARG GO_VERSION=1.22
+FROM golang:${GO_VERSION} as build
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && make BUILD_IN_CONTAINER=false migrate
 
-FROM alpine:3.18.5
-RUN apk add --update --no-cache ca-certificates
+FROM gcr.io/distroless/base-nossl:debug
+
 COPY --from=build /src/loki/cmd/migrate/migrate /usr/bin/migrate
-#ENTRYPOINT [ "/usr/bin/migrate" ]
-CMD tail -f /dev/null
+SHELL [ "/busybox/sh", "-c" ]
+RUN ln -s /busybox/sh /bin/sh
+ENTRYPOINT [ "/busybox/tail", "-f", "/dev/null" ]

cmd/querytee/Dockerfile

@@ -1,10 +1,14 @@
-FROM golang:1.22.5 as build
+ARG GO_VERSION=1.22
+FROM golang:${GO_VERSION} as build
 
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && make BUILD_IN_CONTAINER=false loki-querytee
 
-FROM alpine:3.18.5
-RUN apk add --update --no-cache ca-certificates
+FROM gcr.io/distroless/base-nossl:debug
 COPY --from=build /src/loki/cmd/querytee/querytee /usr/bin/querytee
+
+SHELL [ "/busybox/sh", "-c" ]
+RUN ln -s /busybox/sh /bin/sh
+
 ENTRYPOINT [ "/usr/bin/querytee" ]

cmd/querytee/Dockerfile.cross

@@ -2,17 +2,19 @@ ARG BUILD_IMAGE=grafana/loki-build-image:0.33.4
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f cmd/promtail/Dockerfile .
-FROM golang:1.22.5-alpine as goenv
+ARG GO_VERSION=1.22
+FROM golang:${GO_VERSION} as goenv
 RUN go env GOARCH > /goarch && \
   go env GOARM > /goarm
 
-FROM --platform=linux/amd64 $BUILD_IMAGE as build
+FROM $BUILD_IMAGE as build
 COPY --from=goenv /goarch /goarm /
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAINER=false loki-querytee
 
-FROM alpine:3.18.5
-RUN apk add --update --no-cache ca-certificates
+FROM gcr.io/distroless/base-nossl:debug
 COPY --from=build /src/loki/cmd/querytee/querytee /usr/bin/querytee
+SHELL [ "/busybox/sh", "-c" ]
+RUN ln -s /busybox/sh /bin/sh
 ENTRYPOINT [ "/usr/bin/querytee" ]