Update IMDS Emulator base image to Google's distroless.

sts-agent/Dockerfile

@@ -1,8 +1,13 @@
-FROM python:3.13-slim
+FROM python:3.13-slim-trixie AS build
 
-RUN pip install --no-cache-dir "google-auth[requests,cryptography]>=2.39.0"
+# The interpreter path in the virtualenv must match the path in the distroless image.
+RUN ln -s /usr/local/bin/python /usr/bin/python \
+    && /usr/bin/python -m venv /venv \
+    && /venv/bin/pip install --no-cache-dir "google-auth[requests,cryptography]>=2.39.0"
 
-COPY imds_emulator.py /usr/local/bin/imds-emulator
-COPY imds_test.py /usr/local/bin/imds-test
+FROM gcr.io/distroless/python3-debian13
 
-CMD ["/usr/local/bin/imds-emulator"]
+COPY --from=build /venv /venv
+COPY imds_emulator.py imds_test.py /app/
+
+ENTRYPOINT ["/venv/bin/python3", "/app/imds_emulator.py"]