[Go SDK] Use distroless:debian12 (no-ssl) as base image. (#30011)

* [Go SDK] Use distroless:debian12 (no-ssl) as base image.

* ws lint

* Update changes

* add space

---------

Co-authored-by: lostluck <[email protected]>

CHANGES.md

@@ -82,6 +82,7 @@
 
 ## Security Fixes
 * Fixed (CVE-YYYY-NNNN)[https://www.cve.org/CVERecord?id=CVE-YYYY-NNNN] (Java/Python/Go) ([#X](https://github.com/apache/beam/issues/X)).
+* Go SDK base container image moved to distroless/base-nossl-debian12, reducing vulnerable container surface to kernel and glibc ([#30011](https://github.com/apache/beam/pull/30011)).
 
 ## Known Issues
 

sdks/go/container/Dockerfile

@@ -16,30 +16,17 @@
 # limitations under the License.
 ###############################################################################
 
-FROM debian:bookworm
+FROM gcr.io/distroless/base-nossl-debian12:latest
 LABEL Author "Apache Beam <[email protected]>"
 
 ARG TARGETOS
 ARG TARGETARCH
 
-ARG pull_licenses
-
-RUN apt-get update && \
-    DEBIAN_FRONTEND=noninteractive apt-get install -y \
-        ca-certificates \
-        && \
-    rm -rf /var/lib/apt/lists/*
-
 ADD target/${TARGETOS}_${TARGETARCH}/boot /opt/apache/beam/
 
 COPY target/LICENSE /opt/apache/beam/
 COPY target/NOTICE /opt/apache/beam/
 
 # Add Go licenses.
 COPY target/go-licenses/* /opt/apache/beam/third_party_licenses/golang/
-RUN if [ "$pull_licenses" = "false" ] ; then \
-    # Remove above golang license and dir if pull licenses false
-    rm -rf /opt/apache/beam/third_party_licenses ; \
-   fi
-
 ENTRYPOINT ["/opt/apache/beam/boot"]