While busybox for a shell is convenient, it kinda defeats the purpose of distroless.

True - but this really is only for local dev and I do know a few people including myself who sometimes need to exec locally i to the pod to do and test something. It should also point as a warning that this isn’t a prod image

Just for reference, the changes here don't completely reflect those from #3914

Notably with the sqlite path being dropped. Which as was detailed in the referenced PR would lose the ownership for the ory user if a bind mount volume was attached to the same location, requiring the user to manually adjust.

Might want to make note to document these caveats (or drop the non-root user to simplify and avoid the issue entirely).

From the referenced PR this was the sqlite related snippet (useful for testing with sqlite even without a volume as DB state will still persist until container is destroyed, restarts are still valid for persistence):

# Create the sqlite directory with ownership to that user and group:
# NOTE: This is required for read/write by SQLite.
# - Path may be a default value somewhere, or only explicitly provided via DSN?
# - Owner/Group is only relevant to permissions allowing the hydra process to read/write to the location.
# - Bind mount volumes will replace the ownership with that of the host directory, requiring correction.
install --owner ory --group ory --directory /var/lib/sqlite

It works fine in my testing - other variants did not, which is why i‘ve set it up like this. But yeah, could be I missed something