By: Michael Lynch <git@mtlynch.io>
Build litestream stage from scratch image The litestream/litestream:0.5.11 image is a full Debian rootfs. Kaniko must materialize that whole filesystem to satisfy the COPY --from, and its setuid/setgid/sticky entries (var/local, var/mail, passwd, su, ...) cannot be recreated by PRoot on NixCI, which failed with "mkdir /var/local: operation not permitted". Switch to the 0.5.11-scratch tag, which ships only the static litestream binary plus CA certs at the same path with the same multi-arch support. This mirrors the earlier golang -> golang-alpine fix for the builder. The scratch image also ships no /etc/resolv.conf, so it can no longer clobber the host resolver the runner provides. Drop the now-unnecessary --ignore-path /etc/resolv.conf that worked around the Debian image's empty resolv.conf. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>