test/images: add glibc-dns-testing image (replaces jessie-dnsutils)

The jessie-dnsutils image build has been failing since Debian Jessie reached
end-of-life (EOL) and its repositories were moved to archive.debian.org:

  W: Failed to fetch http://deb.debian.org/debian/dists/jessie/Release
     404  Not Found [IP: 151.101.86.132 80]
  E: Some index files failed to download.

This adds a new glibc-dns-testing image to replace jessie-dnsutils. The new
name better reflects the image's purpose: testing glibc DNS resolution behavior
(vs. musl in Alpine-based agnhost).

The name glibc-dns-testing was recommended by maintainers to reflect that
the image's purpose is testing glibc-based DNS resolution, which behaves
differently from musl libc (used by Alpine/agnhost). Key differences include:
- glibc queries nameservers sequentially; musl queries in parallel
- glibc and musl handle ndots and search domains differently
- The hostname command behaves differently between glibc and musl

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

test/images/glibc-dns-testing/BASEIMAGE

@@ -0,0 +1,7 @@
+linux/amd64=debian:bookworm-slim
+linux/arm=arm32v7/debian:bookworm-slim
+linux/arm64=arm64v8/debian:bookworm-slim
+linux/ppc64le=ppc64le/debian:bookworm-slim
+linux/s390x=s390x/debian:bookworm-slim
+windows/amd64/1809=REGISTRY/busybox:1.29-2-windows-amd64-1809
+windows/amd64/ltsc2022=REGISTRY/busybox:1.29-2-windows-amd64-ltsc2022

test/images/glibc-dns-testing/Dockerfile

@@ -12,21 +12,27 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# glibc-dns-testing: A glibc-based image for testing DNS resolution behavior.
+#
+# This image exists to test that glibc-based programs can resolve Service DNS
+# names correctly. It complements agnhost (which uses Alpine/musl) to ensure
+# Kubernetes DNS works correctly regardless of which C library the application
+# uses. See issue #10161 for the original discussion about libc DNS differences.
+#
+# Key differences between glibc and musl DNS resolution:
+# - glibc queries nameservers sequentially; musl queries in parallel
+# - glibc and musl handle ndots and search domains differently
+# - The hostname command behaves differently between glibc and musl
+
 ARG BASEIMAGE
 FROM $BASEIMAGE
 
 CROSS_BUILD_COPY qemu-QEMUARCH-static /usr/bin/
 
-# WARNING: Please note that the script below removes the security packages from arm64 and ppc64el images
-# as they do not exist anymore in the debian repositories for jessie. So we do not recommend using this
-# image for any production use and limit use of this image to just test scenarios.
-
-COPY fixup-apt-list.sh /
-RUN ["/fixup-apt-list.sh"]
-
-RUN apt-get -q update && \
-    apt-get install -y --force-yes dnsutils && \
-    apt-get clean
+RUN apt-get update && \
+    apt-get install -y dnsutils && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 
 ADD https://github.com/coredns/coredns/releases/download/v1.5.0/coredns_1.5.0_linux_BASEARCH.tgz /coredns.tgz
 RUN tar -xzvf /coredns.tgz && rm -f /coredns.tgz

test/images/glibc-dns-testing/README.md

@@ -0,0 +1,46 @@
+# glibc-dns-testing
+
+A glibc-based test image for verifying DNS resolution behavior in Kubernetes.
+
+## Purpose
+
+This image exists to test that **glibc-based programs** can resolve Service DNS
+names correctly. It complements `agnhost` (which uses Alpine/musl libc) to ensure
+Kubernetes DNS works correctly regardless of which C library the application uses.
+
+## Why glibc Testing Matters
+
+DNS resolution behavior differs between glibc (used by Debian, Ubuntu, RHEL) and
+musl libc (used by Alpine Linux):
+
+- **glibc** queries nameservers sequentially; **musl** queries in parallel
+- glibc and musl handle `ndots` and search domains differently
+- The `hostname` command behaves differently between glibc and musl (see issue #134737)
+
+Many production workloads use glibc-based distributions, so testing DNS resolution
+with glibc ensures compatibility with:
+- Java applications
+- Python/Ruby/PHP applications
+- Most enterprise Linux distributions
+
+## History
+
+This image was originally named `jessie-dnsutils` (based on Debian Jessie). It was
+renamed to `glibc-dns-testing` to better reflect its actual purpose: testing glibc
+DNS resolution behavior, not any specific Debian version.
+
+See issue #10161 for the original discussion about libc DNS differences that
+motivated creating this image.
+
+## Contents
+
+- **Base**: Debian Bookworm (glibc-based)
+- **dnsutils**: Provides `dig`, `nslookup`, and `host` commands
+- **CoreDNS**: Embedded DNS server for testing
+
+## Usage
+
+This image is used in Kubernetes E2E tests alongside `agnhost` to verify DNS
+resolution works correctly with both musl and glibc resolvers.
+
+**Note**: This image is for test purposes only, not for production use.

test/images/glibc-dns-testing/VERSION

@@ -0,0 +1 @@
+2.0

test/images/jessie-dnsutils/BASEIMAGE

@@ -1,7 +0,0 @@
-linux/amd64=debian:jessie
-linux/arm=arm32v7/debian:jessie
-linux/arm64=arm64v8/debian:jessie
-linux/ppc64le=ppc64le/debian:jessie
-linux/s390x=s390x/debian:jessie
-windows/amd64/1809=REGISTRY/busybox:1.29-2-windows-amd64-1809
-windows/amd64/ltsc2022=REGISTRY/busybox:1.29-2-windows-amd64-ltsc2022

test/images/jessie-dnsutils/README.md

@@ -1,4 +0,0 @@
-# jessie-dnsutils
-
-DNS utils but implemented in a different OS to have some basic check across OSes.
-See issue #10161 for original issue and discussion.

test/images/jessie-dnsutils/VERSION

@@ -1 +0,0 @@
-1.7

test/images/jessie-dnsutils/fixup-apt-list.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright 2017 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-DEB_ARCH=$(dpkg --print-architecture)
-
-# http://security.debian.org/debian-security/dists/jessie/updates/InRelease is missing
-# entries for some platforms, so we just remove the last line in sources.list in
-# /etc/apt/sources.list which is "deb http://deb.debian.org/debian jessie-updates main"
-
-case ${DEB_ARCH} in
-    s390x|arm64|ppc64el)
-        # We have to use the archive mirrors.
-        # See: https://lists.debian.org/debian-devel-announce/2019/03/msg00006.html
-        echo "deb http://archive.debian.org/debian/ jessie main contrib non-free" | tee /etc/apt/sources.list
-        echo "deb-src http://archive.debian.org/debian/ jessie main contrib non-free" | tee -a /etc/apt/sources.list
-       ;;
-esac
-
-exit 0