02dd7396

By: Michael Lynch <git@mtlynch.io>

Build litestream stage from scratch image

The litestream/litestream:0.5.11 image is a full Debian rootfs. Kaniko
must materialize that whole filesystem to satisfy the COPY --from, and
its setuid/setgid/sticky entries (var/local, var/mail, passwd, su, ...)
cannot be recreated by PRoot on NixCI, which failed with
"mkdir /var/local: operation not permitted".

Switch to the 0.5.11-scratch tag, which ships only the static litestream
binary plus CA certs at the same path with the same multi-arch support.
This mirrors the earlier golang -> golang-alpine fix for the builder.

The scratch image also ships no /etc/resolv.conf, so it can no longer
clobber the host resolver the runner provides. Drop the now-unnecessary
--ignore-path /etc/resolv.conf that worked around the Debian image's
empty resolv.conf.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Timeline