build(docker): Make the distroless image the only vroom image

.github/workflows/image.yaml

@@ -12,20 +12,13 @@ jobs:
     strategy:
       matrix:
         platform: [amd64, arm64]
-        variant: [default, distroless]
         include:
           - platform: amd64
             os: ubuntu-24.04
           - platform: arm64
             os: ubuntu-24.04-arm
-          - variant: default
-            target: application
-            suffix: ''
-          - variant: distroless
-            target: application-distroless
-            suffix: '-distroless'
     if: github.repository_owner == 'getsentry'
-    name: build-${{ matrix.platform }}${{ matrix.suffix }}
+    name: build-${{ matrix.platform }}
     steps:
       - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
@@ -36,12 +29,11 @@ jobs:
         uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
-          target: ${{ matrix.target }}
-          cache-from: ghcr.io/getsentry/vroom:nightly${{ matrix.suffix }}
+          cache-from: ghcr.io/getsentry/vroom:nightly
           cache-to: type=inline
           platforms: linux/${{ matrix.platform }}
-          tags: vroom:${{ matrix.platform }}${{ matrix.suffix }}
-          outputs: type=docker,dest=/tmp/vroom-${{ matrix.platform }}${{ matrix.suffix }}.tar
+          tags: vroom:${{ matrix.platform }}
+          outputs: type=docker,dest=/tmp/vroom-${{ matrix.platform }}.tar
           push: false
 
       # NOTE(aldy505): Rather than pushing the individual architecture-specific image to GHCR,
@@ -54,18 +46,15 @@ jobs:
       - name: Upload Image
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: vroom-${{ matrix.platform }}${{ matrix.suffix }}
-          path: /tmp/vroom-${{ matrix.platform }}${{ matrix.suffix }}.tar
+          name: vroom-${{ matrix.platform }}
+          path: /tmp/vroom-${{ matrix.platform }}.tar
 
   assemble-image:
     runs-on: ubuntu-latest
     needs:
       - build-image
     if: ${{ github.event_name != 'pull_request' }}
-    strategy:
-      matrix:
-        suffix: ['', '-distroless']
-    name: assemble-image${{ matrix.suffix }}
+    name: assemble-image
     steps:
       - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
       - run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< "$GHCR_TOKEN"
@@ -78,42 +67,37 @@ jobs:
       - name: Download amd64 Image
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
-          name: vroom-amd64${{ matrix.suffix }}
+          name: vroom-amd64
           path: /tmp
 
       - name: Load amd64 Image
-        run: docker load --input /tmp/vroom-amd64${{ matrix.suffix }}.tar
+        run: docker load --input /tmp/vroom-amd64.tar
 
       - name: Download arm64 Image
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
-          name: vroom-arm64${{ matrix.suffix }}
+          name: vroom-arm64
           path: /tmp
 
       - name: Load arm64 Image
-        run: docker load --input /tmp/vroom-arm64${{ matrix.suffix }}.tar
+        run: docker load --input /tmp/vroom-arm64.tar
 
       - name: Push to GitHub Container Registry
-        env:
-          SUFFIX: ${{ matrix.suffix }}
         run: |
-          docker tag vroom:amd64${SUFFIX} ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-amd64
-          docker push ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-amd64
-          docker tag vroom:arm64${SUFFIX} ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-arm64
-          docker push ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-arm64
-
-          docker manifest create \
-            ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX} \
-            --amend ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-amd64 \
-            --amend ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-arm64
-
-          docker manifest create \
-            ghcr.io/getsentry/vroom:nightly${SUFFIX} \
-            --amend ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-amd64 \
-            --amend ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-arm64
-
-          docker manifest push ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}
-          docker manifest push ghcr.io/getsentry/vroom:nightly${SUFFIX}
+          docker tag vroom:amd64 ghcr.io/getsentry/vroom:${{ github.sha }}-amd64
+          docker push ghcr.io/getsentry/vroom:${{ github.sha }}-amd64
+          docker tag vroom:arm64 ghcr.io/getsentry/vroom:${{ github.sha }}-arm64
+          docker push ghcr.io/getsentry/vroom:${{ github.sha }}-arm64
+
+          # The image is distroless. The "-distroless" tags are kept until
+          # everything that pulls them (deploys, devservices) moves to the plain tags.
+          for tag in ${{ github.sha }} ${{ github.sha }}-distroless nightly nightly-distroless; do
+            docker manifest create \
+              ghcr.io/getsentry/vroom:${tag} \
+              --amend ghcr.io/getsentry/vroom:${{ github.sha }}-amd64 \
+              --amend ghcr.io/getsentry/vroom:${{ github.sha }}-arm64
+            docker manifest push ghcr.io/getsentry/vroom:${tag}
+          done
 
   publish-to-dockerhub:
     name: Publish Vroom to DockerHub
@@ -146,18 +130,14 @@ jobs:
       - assemble-image
     runs-on: ubuntu-latest
     timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        suffix: ['', '-distroless']
-    name: self-hosted-end-to-end${{ matrix.suffix }}
+    name: self-hosted-end-to-end
 
     steps:
       - name: Run Sentry self-hosted e2e CI
         uses: getsentry/self-hosted@e29cfe002b439d8d281d51a54d574e6a31831973 # master
         with:
           project_name: vroom
-          image_url: ghcr.io/getsentry/vroom:${{ github.sha }}${{ matrix.suffix }}
+          image_url: ghcr.io/getsentry/vroom:${{ github.sha }}
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
 
@@ -182,11 +162,12 @@ jobs:
           tag_nightly: false
           tag_latest: true
           google_ar_image_name: us-central1-docker.pkg.dev/sentryio/vroom/vroom
+          tags: us-central1-docker.pkg.dev/sentryio/vroom/vroom:${{ github.sha }}-distroless
           google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool
           google_service_account: [email protected]
           # The builder stage starts with `COPY . .`, so nothing from a previous
           # commit's cache is reusable. Skip the GitHub Actions cache and hand
-          # this build's cache to the next three builds on the runner's disk.
+          # this build's cache to the next build on the runner's disk.
           cache_from: ''
           cache_to: type=local,dest=${{ runner.temp }}/vroom-buildcache,mode=max
 
@@ -201,42 +182,7 @@ jobs:
           tag_nightly: false
           tag_latest: true
           google_ar_image_name: us-docker.pkg.dev/sentryio/vroom-mr/vroom
-          google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool
-          google_service_account: [email protected]
-          cache_from: type=local,src=${{ runner.temp }}/vroom-buildcache
-          cache_to: ''
-
-      - name: Build and push distroless image to single-region registry
-        uses: getsentry/action-build-and-push-images@3714f354c0bc912a95221f193c9643cdba966e34
-        with:
-          image_name: 'vroom'
-          platforms: linux/amd64
-          dockerfile_path: './Dockerfile'
-          build_target: 'application-distroless'
-          tag_suffix: -distroless
-          ghcr: false
-          google_ar: true
-          tag_nightly: false
-          tag_latest: false
-          google_ar_image_name: us-central1-docker.pkg.dev/sentryio/vroom/vroom
-          google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool
-          google_service_account: [email protected]
-          cache_from: type=local,src=${{ runner.temp }}/vroom-buildcache
-          cache_to: ''
-
-      - name: Build and push distroless image to multi-region registry
-        uses: getsentry/action-build-and-push-images@3714f354c0bc912a95221f193c9643cdba966e34
-        with:
-          image_name: 'vroom'
-          platforms: linux/amd64
-          dockerfile_path: './Dockerfile'
-          build_target: 'application-distroless'
-          tag_suffix: -distroless
-          ghcr: false
-          google_ar: true
-          tag_nightly: false
-          tag_latest: false
-          google_ar_image_name: us-docker.pkg.dev/sentryio/vroom-mr/vroom
+          tags: us-docker.pkg.dev/sentryio/vroom-mr/vroom:${{ github.sha }}-distroless
           google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool
           google_service_account: [email protected]
           cache_from: type=local,src=${{ runner.temp }}/vroom-buildcache

Dockerfile

@@ -8,33 +8,13 @@ RUN CGO_ENABLED=0 go build -o . -ldflags="-s -w -X main.release=$(git rev-parse
 
 # Distroless runtime: no shell or package manager. The base already ships the
 # CA bundle (SSL_CERT_FILE), tzdata and a world-writable /tmp.
-FROM us-docker.pkg.dev/sentryio/dhi-mirror/static:20250419-debian13 AS application-distroless
+FROM us-docker.pkg.dev/sentryio/dhi-mirror/static:20250419-debian13 AS application
 
 EXPOSE 8085
 
 COPY --from=builder /src/vroom /bin/vroom
 
 WORKDIR /var/vroom
-# Same uid/gid as the debian image, so existing volumes and runAsUser keep working.
 USER 1000:1000
 
 ENTRYPOINT ["/bin/vroom"]
-
-# Debian runtime. Keep it the last stage: builds without --target produce this image.
-FROM debian:trixie-slim AS application
-
-EXPOSE 8080
-
-RUN groupadd --gid 1000 vroom \
-    && useradd -g vroom --uid 1000 vroom \
-    && apt-get update \
-    && apt-get install -y ca-certificates tzdata --no-install-recommends \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY --from=builder /src/vroom /bin/vroom
-
-WORKDIR /var/vroom
-USER vroom
-
-ENTRYPOINT ["/bin/vroom"]