chore(cd): mount package directory at image build time (#13350)

This updates our release workflow to use docker's build-time
[bind mount](https://docs.docker.com/reference/dockerfile/#run---mounttypebind)
support to supply the package file(s) instead of copying into the image.

The idea behind this is that mounting the package removes a large `COPY`
layer and reduces the image size.

The directory that is mounted is checksum-ed by docker as part of the build
context, so build cache is automatically invalidated when the package file
changes.

.github/workflows/release.yml

@@ -383,7 +383,7 @@ jobs:
         platforms: ${{ steps.docker_platforms_arg.outputs.platforms }}
         build-args: |
           KONG_BASE_IMAGE=${{ matrix.base-image }}
-          KONG_ARTIFACT_PATH=bazel-bin/pkg/
+          KONG_ARTIFACT_PATH=bazel-bin/pkg
           KONG_VERSION=${{ needs.metadata.outputs.kong-version }}
           RPM_PLATFORM=${{ steps.docker_rpm_platform_arg.outputs.rpm_platform }}
           EE_PORTS=8002 8445 8003 8446 8004 8447

build/dockerfiles/deb.Dockerfile

@@ -14,16 +14,15 @@ ARG EE_PORTS
 ARG TARGETARCH
 
 ARG KONG_ARTIFACT=kong.${TARGETARCH}.deb
-ARG KONG_ARTIFACT_PATH=
-COPY ${KONG_ARTIFACT_PATH}${KONG_ARTIFACT} /tmp/kong.deb
+ARG KONG_ARTIFACT_PATH
 
-RUN apt-get update \
+RUN --mount=type=bind,source=${KONG_ARTIFACT_PATH},target=/tmp/pkg \
+    apt-get update \
     && apt-get -y upgrade \
     && apt-get -y autoremove \
     && DEBIAN_FRONTEND=noninteractive apt-get install -y tzdata \
-    && apt-get install -y --no-install-recommends /tmp/kong.deb \
+    && apt-get install -y --no-install-recommends /tmp/pkg/${KONG_ARTIFACT} \
     && rm -rf /var/lib/apt/lists/* \
-    && rm -rf /tmp/kong.deb \
     && chown kong:0 /usr/local/bin/kong \
     && chown -R kong:0 ${KONG_PREFIX} \
     && ln -sf /usr/local/openresty/bin/resty /usr/local/bin/resty \

build/dockerfiles/rpm.Dockerfile

@@ -28,13 +28,12 @@ ARG EE_PORTS
 ARG TARGETARCH
 
 ARG KONG_ARTIFACT=kong.${RPM_PLATFORM}.${TARGETARCH}.rpm
-ARG KONG_ARTIFACT_PATH=
-COPY ${KONG_ARTIFACT_PATH}${KONG_ARTIFACT} /tmp/kong.rpm
+ARG KONG_ARTIFACT_PATH
 
 # hadolint ignore=DL3015
-RUN yum update -y \
-    && yum install -y /tmp/kong.rpm \
-    && rm /tmp/kong.rpm \
+RUN --mount=type=bind,source=${KONG_ARTIFACT_PATH},target=/tmp/pkg \
+    yum update -y \
+    && yum install -y /tmp/pkg/${KONG_ARTIFACT} \
     && chown kong:0 /usr/local/bin/kong \
     && chown -R kong:0 /usr/local/kong \
     && ln -sf /usr/local/openresty/bin/resty /usr/local/bin/resty \