OPA's Docker images are built with `docker buildx`, which supports
Rego-based build policies via `Dockerfile.rego`. Adding this file lets
OPA validate its own image builds using OPA — enforcing that base images
come only from the approved chainguard namespace.
Adds `Dockerfile.rego` with a single deny rule: base images must come
from `docker.io/chainguard/`. This covers all four variants built in the
Makefile (`glibc-dynamic`, `glibc-dynamic:latest-dev`, `static`,
`busybox`). Local build context access (used by `COPY`) is allowed
implicitly when no deny rule fires.
The policy follows the same `decision` shape used by buildx's own
`policy/default.rego`. No changes to other files are needed — buildx
automatically evaluates `Dockerfile.rego` when present.
Closes#8401.
Signed-off-by: jasdeepbhalla <jasdeepbhalla@gmail.com>
Jasdeep Singh Bhalla