title: Remove /bin/busybox at build time
body: <p>For reasons such as hardening a Docker image, I want local users not be able to use <code>wget</code>. Since <code>wget</code> is a function of <code>/bin/busybox</code>, removal seems appropriate, even if a little drastic, and would apparently work at for and at runtime.</p>
  
  <p>However <code>RUN rm /bin/busybox</code> will cause <code>go</code> stack traces, when run on top of Kubernetes or locally.</p>
  
  <p>Is there any build time solution?</p>
  
  <p>The example would be </p>
  
  <pre><code>FROM haproxy:1.6-alpine
  
  RUN addgroup -S haproxy &amp;&amp; adduser -S -g haproxy haproxy
  RUN rm /bin/busybox
  
  COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
  </code></pre>
  
  <p>With the HAProxy's default <code>ENTRYPOINT</code></p>
  
  <pre><code>#!/bin/sh
  set -e
  
  # first arg is `-f` or `--some-option`
  if [ "${1#-}" != "$1" ]; then
      set -- haproxy "$@"
  fi
  
  if [ "$1" = 'haproxy' ]; then
      # if the user wants "haproxy", let's use "haproxy-systemd-wrapper" instead so we can have proper reloadability implemented by upstream
      shift # "haproxy"
      set -- "$(which haproxy-systemd-wrapper)" -p /run/haproxy.pid "$@"
  fi
  
  exec "$@"
  </code></pre>