基于Distroless镜像构建Python Docker镜像遇exit code 139错误

为满足安全要求，我尝试基于Distroless镜像构建Python Docker镜像。此前依照指定步骤操作成功，但假期后执行原可用Dockerfile时抛出错误：

executor failed running [/bin/sh -c echo "monty:x:1000:monty" >> /etc/group]: exit code: 139

Exit code 139对应段错误（内存访问异常），我使用Mac系统，docker --version输出为Docker version 20.10.12, build e91ed57。尝试调整文件复制范围、修改权限均无法解决问题，以下是可复现该问题的最简Dockerfile：

## -------------- 提供新版Python及其依赖的镜像层 ------------- ##

FROM python:3.8-slim as python-base

## ------------------------------- Distroless基础镜像 ------------------------------ ##

# 基于distroless C或cc:debug构建，因为多数Python依赖C库
FROM gcr.io/distroless/cc:debug

ARG CHIPSET_ARCH=x86_64-linux-gnu

## ------------------------- 从构建镜像复制Python本体 -------------------------- ##

# 这种方式比完整安装风险更高，但能大幅缩小镜像体积
COPY --from=python-base /usr/local/lib/ /usr/local/lib/
COPY --from=python-base /usr/local/bin/python /usr/local/bin/python
COPY --from=python-base /etc/ld.so.cache /etc/ld.so.cache

## -------------------------- 添加常用编译依赖库 --------------------------- ##

# 若遇到ImportError，检查python-base中是否存在对应库并按以下方式复制

# 很多包依赖这些库 - 例如six、numpy、wsgi
COPY --from=python-base /lib/${CHIPSET_ARCH}/libz.so.1 /lib/${CHIPSET_ARCH}/
COPY --from=python-base /lib/${CHIPSET_ARCH}/libexpat* /lib/${CHIPSET_ARCH}/
COPY --from=python-base /lib/${CHIPSET_ARCH}/libc.so.6 /lib/${CHIPSET_ARCH}/
# google-cloud/grpcio依赖
COPY --from=python-base /usr/lib/${CHIPSET_ARCH}/libffi* /usr/lib/${CHIPSET_ARCH}/

## -------------------------------- 非root用户配置 ------------------------------- ##

COPY --from=python-base /bin/echo /bin/echo
COPY --from=python-base /bin/rm /bin/rm
COPY --from=python-base /bin/sh /bin/sh

RUN echo "monty:x:1000:monty" >> /etc/group
RUN echo "monty:x:1001:" >> /etc/group
RUN echo "monty:x:1000:1001::/home/monty:" >> /etc/passwd

# 在仍有shell时快速验证Python是否可用
RUN python --version

RUN rm /bin/sh /bin/echo /bin/rm

## --------------------------- 标准化执行环境 ----------------------------- ##

# 默认以非root用户运行，uid=1000
USER monty

# 标准化区域设置，不生成.pyc文件，开启段错误回溯
ENV LANG C.UTF-8
ENV LC_ALL C.UTF-8
ENV PYTHONDONTWRITEBYTECODE 1
ENV PYTHONFAULTHANDLER 1

ENTRYPOINT ["/usr/local/bin/python"]

内容的提问来源于stack exchange，提问作者wdtjl