Container image
- The runtime image is now based on
gcr.io/distroless/static-debian13:nonrootinstead of Alpine. The image is smaller and has no shell or package manager, so there is less to attack and fewer CVE findings. - Multi-arch support is unchanged: images are still published for
linux/amd64,linux/arm64andlinux/arm/v7. - The container still runs as UID/GID
1000:1000, and the binary path (/app/bird_exporter) is unchanged. Existing socket permissions,--group-addsetups and Helm values keep working. - Note: without a shell in the image,
docker exec … shno longer works. For debugging, usekubectl debugor an ephemeral debug container.