Use busybox from alpine

[liam-verta]

@SuperQ @discordianfish I'll admit this is a little hacky, but it is sufficient.

Fixes #50

[SuperQ]

I'm wondering if we should make a new prometheus busybox:alpine, since this changes the libc.

It doesn't quite make sense to me to call it busybox:glibc if we're not actually using glibc here.

[discordianfish]

Looks like this will create an image from busybox:glibc, then copy over alpine busybox and musl which seems like fragile. Why do we still need to base this on the upstream busybox image if we replace it anyway? I'd rather to FROM scratch and copy in from alpine. But then, yes a new image tag.

[liam-verta]

@discordianfish @SuperQ I'm trying another pass at this PR using a statically-linked busybox.

From the perspective of consumers of these images, the key features are:

• The busybox toolset
• The specified libc flavor

This is why I chose to continue to base this image on the same busybox:* images as before. Those images provide a specific libc flavor and minimal folder layout. We want to keep that.

Given that a particular libc flavor is present, it is convenient for busybox to link to those libraries, but that linkage is not a significant feature. The internal structure/linking of thebusybox toolset is an implementation detail.

Using a statically-linked busybox does have some effect, but it is not significant from a downstream user perspective. For example, static linking changes memory usage but probably not to a degree worth noting for the scenarios these tools are used in. See https://busybox.net/FAQ.html#tips_memory for discussion.

The size on of the busybox files is similar, with the statically linked alpine version being slightly smaller than the dynamic official executable:

• alpine:latest - /bin/busybox: 0.82 MB (841376 bytes)
• alpine:latest - /bin/busybox.static: 0.98 MB (1001288 bytes)
• busybox:glibc - /bin/busybox: 1.00 MB (1025504 bytes)
• busybox:uclibc - /bin/busybox: 1.13 MB (1157408 bytes)

Taking this change will improve the security profile of projects based on these images with minimal change to user facing features.

[SuperQ]

I don't think we should touch the existing package flavors. Rather, we should create a new image prom/busybox:alpine or something that is something we can transition to.

[liam-verta]

@SuperQ @discordianfish Done. I made a new alpine-glibc and added a section to the readme.

[liam-verta]

@discordianfish @SuperQ Another attempt at this, now from scratch. The final image is flat with no vestige of the non-static busybox. It also is stripped of libc-utils and apk.

I'm sure there is more that can be removed from this image, but perhaps this is good enough a first iteration?

[liam-verta]

@SuperQ @discordianfish Ping?