fix(build): remove busybox from dockerfile

[fcjack]

What this PR does / why we need it:

Busybox included on our distroless dockerfile has a list of CVEs that needs to be addressed.

Going to remove the busybox from our dockerfile and use the distroless:nonroot as base image to follow best security practices.

Which issue(s) this PR fixes:
Fix CVEs:

• CVE-2023-42364
• CVE-2023-42365
• CVE-2023-42363
• CVE-2023-42366
• CVE-2025-46394
• CVE-2024-58251

Running grype scanner we see no vulnerabilities on this image:

grype fcjack/loki:fcjack-remove-busybox-from-docker-1750bf9
 ✔ Loaded image                                                                                                                                        fcjack/loki:fcjack-remove-busybox-from-docker-1750bf9 
 ✔ Parsed image                                                                                                                      sha256:52cf41545517f7a7412bbd3fbbd0c37a77ca9bea43cae7d3d4445b36bb913bed 
 ✔ Cataloged contents                                                                                                                       695770f9714e7ecee0d246ab19f850b5bdc82abe86e20beaa2d86f3ec68edbd6 
   ├── ✔ Packages                        [351 packages]  
   ├── ✔ Executables                     [1 executables]  
   ├── ✔ File metadata                   [947 locations]  
   └── ✔ File digests                    [947 files]  
 ✔ Scanned for vulnerabilities     [0 vulnerability matches]  
   ├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible
No vulnerabilities found

[slim-bean]

something feels off to me here, previously our final stage was setting the ownership and permissions and it set the permissions on the /loki directory

However now we are setting permissions on an intermediate build stage, and also we are setting it on /tmp/loki not /loki

This feels like it might be incorrect to me

[fcjack]

This is because in our final stage we will use the distroless without sh, so I can't change in there.

The process is set in the intermediate, change the permissions first and then we can copy with from there with the right permissions.

[fcjack]

Good catch on directories, I updated now to not be on /tmp

[slim-bean]

LGTM

[guillaumedsde]

Hello 👋

Slimming down the Docker image seems like a good thing, thanks for that. However, it seems like the Loki binary does not include any way to run a healthcheck. As such, the Docker image for Loki >= 3.6.0 lacks any tools for performing a healthcheck, there is no shell to look for listening ports in the /proc filesystem, or wget to request the healthcheck endpoint which prevents users of the image from defining a docker healthcheck for the container.

Busybox is a bit overkill for that, but would you be open to adding a loki health command which would request the /health endpoint, exiting with an error code if loki is unhealthy? This would enable setting a docker healthcheck on containers instantiated with the official Loki Docker image (without re-adding all of busybox).