Switch the base Docker image to Wolfi

[rdner]

What is the problem this PR solves?

It improves overall security of the Fleet Server's Docker image.

How does this PR solve the problem?

It switches the base Docker image from Ubuntu:20.04 to Wolfi and switches the root user to a unprivileged fleet-server user.

How to test this PR locally

1. Run make build-docker and the command should succeed.
2. Run the container using the newly built image:

docker run -it --rm \
  -e ELASTICSEARCH_HOSTS="https://elasticsearch:9200" \
  -e ELASTICSEARCH_SERVICE_TOKEN="someservicetoken" \
  -e ELASTICSEARCH_CA_TRUSTED_FINGERPRINT="somefingerprint" \
  docker.elastic.co/fleet-server/fleet-server:8.16.0

and the Fleet Server should successfully start without crashing.

3. Run the shell inside the container:

docker run -it --entrypoint /bin/ash docker.elastic.co/fleet-server/fleet-server:8.16.0

4. Verify that you're running the fleet-server user with the whoami command.

The image comparison:

Before:

REPOSITORY                                    TAG       IMAGE ID       CREATED          SIZE
docker.elastic.co/fleet-server/fleet-server   8.16.0    ae499a75167e   11 seconds ago   101MB

IMAGE          CREATED          CREATED BY                                      SIZE      COMMENT
ae499a75167e   28 seconds ago   CMD ["/bin/sh" "-c" "/usr/bin/fleet-server -…   0B        buildkit.dockerfile.v0
<missing>      28 seconds ago   COPY /usr/src/fleet-server/build/binaries/fl…   35.7MB    buildkit.dockerfile.v0
<missing>      47 seconds ago   COPY fleet-server.yml /etc/fleet-server.yml …   967B      buildkit.dockerfile.v0
<missing>      47 seconds ago   ARG TARGETARCH                                  0B        buildkit.dockerfile.v0
<missing>      47 seconds ago   ARG TARGETOS                                    0B        buildkit.dockerfile.v0
<missing>      47 seconds ago   ARG VERSION                                     0B        buildkit.dockerfile.v0
<missing>      7 weeks ago      /bin/sh -c #(nop)  CMD ["/bin/bash"]            0B        
<missing>      7 weeks ago      /bin/sh -c #(nop) ADD file:6d8cc056ee741f09a…   65.7MB    
<missing>      7 weeks ago      /bin/sh -c #(nop)  LABEL org.opencontainers.…   0B        
<missing>      7 weeks ago      /bin/sh -c #(nop)  LABEL org.opencontainers.…   0B        
<missing>      7 weeks ago      /bin/sh -c #(nop)  ARG LAUNCHPAD_BUILD_ARCH     0B        
<missing>      7 weeks ago      /bin/sh -c #(nop)  ARG RELEASE                  0B        

After:

REPOSITORY                                    TAG       IMAGE ID       CREATED         SIZE
docker.elastic.co/fleet-server/fleet-server   8.16.0    fd3ffec22e4a   8 seconds ago   61.3MB

IMAGE          CREATED          CREATED BY                                      SIZE      COMMENT
fd3ffec22e4a   27 seconds ago   CMD ["/bin/sh" "-c" "/usr/bin/fleet-server -…   0B        buildkit.dockerfile.v0
<missing>      27 seconds ago   COPY --chown=fleet-server:fleet-server --chm…   35.7MB    buildkit.dockerfile.v0
<missing>      41 seconds ago   COPY --chown=fleet-server:fleet-server --chm…   967B      buildkit.dockerfile.v0
<missing>      41 seconds ago   USER fleet-server                               0B        buildkit.dockerfile.v0
<missing>      41 seconds ago   RUN |3 VERSION=8.16.0 TARGETOS=linux TARGETA…   3.67kB    buildkit.dockerfile.v0
<missing>      42 seconds ago   RUN |3 VERSION=8.16.0 TARGETOS=linux TARGETA…   11.9MB    buildkit.dockerfile.v0
<missing>      42 seconds ago   ARG TARGETARCH                                  0B        buildkit.dockerfile.v0
<missing>      42 seconds ago   ARG TARGETOS                                    0B        buildkit.dockerfile.v0
<missing>      42 seconds ago   ARG VERSION                                     0B        buildkit.dockerfile.v0
<missing>      2 days ago       apko                                            13.8MB    This is an apko single-layer image

Down in size by 101-61.3=39.7MB.

To my knowledge we don't ship this image publicly, therefore I think we don't need a change log entry.

Related issues

Relates to https://github.com/elastic/elastic-agent/pull/5062

[AndersonQ]

@rdner, please, only merge it Monday :)

[michel-laterman]

lgtm

we only use these images internally at the moment

[elastic-sonarqube]

Quality Gate passed

Issues
1 New issue
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[rdner]

@michel-laterman to my knowledge this image is used in serverless.