Prune system libraries from distroless image

[istreeter]

The purpose of the distroless docker image is to be as lightweight as possible; for the benefit of developers it reduces the number of security vulnerabilities that creep in over time.

But the image still includes more libraries than we need. I can inspect what libraries get linked at run time by looking in the file /proc/<PID>/maps. It tells me we need all of these libs:

/lib/x86_64-linux-gnu/ld-2.31.so
/lib/x86_64-linux-gnu/libc-2.31.so
/lib/x86_64-linux-gnu/libdl-2.31.so
/lib/x86_64-linux-gnu/libgcc_s.so.1
/lib/x86_64-linux-gnu/libm-2.31.so
/lib/x86_64-linux-gnu/libnss_compat-2.31.so
/lib/x86_64-linux-gnu/libnss_dns-2.31.so
/lib/x86_64-linux-gnu/libnss_files-2.31.so
/lib/x86_64-linux-gnu/libpthread-2.31.so
/lib/x86_64-linux-gnu/libresolv-2.31.so
/lib/x86_64-linux-gnu/librt-2.31.so
/lib/x86_64-linux-gnu/libz.so.1.2.11
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache
/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.28

...plus jvm libs but no others! I propose to amend the distroless docker image to remove all other .so files.