fix: switch operator and api store to use approved distroless containers (#1570)

Co-authored-by: Hannah Zhang <hannahz@nvidia.com>
Co-authored-by: hhzhang16 <54051230+hhzhang16@users.noreply.github.com>

deploy/cloud/api-store/Earthfile

@@ -27,14 +27,20 @@ uv-base:
     WORKDIR /app
     COPY uv.lock pyproject.toml README.md /app
     RUN uv sync --frozen --no-install-project --no-dev --no-install-workspace --no-editable
+    # Copy project files
+    COPY ai_dynamo_store ai_dynamo_store
+    RUN uv pip install .
+    # Save the entire app directory with installed packages
+    SAVE ARTIFACT /app /app
 
 docker:
     ARG DOCKER_SERVER=my-registry
     ARG IMAGE_TAG=latest
     ARG IMAGE=dynamo-api-store
-    FROM +uv-base
-    # Copy project files
-    COPY ai_dynamo_store ai_dynamo_store
-    RUN uv pip install .
+    FROM nvcr.io/nvidia/distroless/python:3.12-v3.4.13-dev
+    # Copy the entire installed environment from uv-base
+    COPY +uv-base/app /app
+    WORKDIR /app
+    ENV PATH="/app/.venv/bin:$PATH"
     ENTRYPOINT ["ai-dynamo-store"]
-    SAVE IMAGE --push $DOCKER_SERVER/$IMAGE:$IMAGE_TAG
\ No newline at end of file
+    SAVE IMAGE --push $DOCKER_SERVER/$IMAGE:$IMAGE_TAG

deploy/cloud/operator/Earthfile

@@ -40,7 +40,7 @@ docker:
     ARG DOCKER_SERVER=my-registry
     ARG IMAGE_TAG=latest
     ARG IMAGE_SUFFIX=dynamo-operator
-    FROM gcr.io/distroless/static-debian11
+    FROM nvcr.io/nvidia/distroless/go:v3.1.9-dev
     WORKDIR /
     COPY +build/manager .
     USER 65532:65532