Feature: allow the pgBackRest binary to come from an image volume #150

Today the sidecar image ships pgBackRest itself: containers/Dockerfile.sidecar installs it from the PGDG apt repository at build time. The pgBackRest version is therefore whatever was current when a given plugin release was built, and the only ways to change it are to wait for a new plugin release or to build and host the sidecar image yourself.

That coupling is awkward in two situations. A pgBackRest fix or CVE stays out of reach until the plugin cuts a release. And a fleet that has to stay on one known pgBackRest version cannot pin it without maintaining a fork of the sidecar image.

Kubernetes image volumes already solve the same problem for extensions in CloudNativePG 1.27, where .spec.postgresql.extensions mounts an OCI image read only into the instance pods. The mechanism fits here too.

Proposal: an optional image volume on the Archive.

spec:
  instanceSidecarConfiguration:
    pgbackrestImage:
      reference: example.com/pgbackrest:2.56.1
      pullPolicy: IfNotPresent

When it is set, the plugin adds the image volume to the pod, mounts it into its own sidecar, and points the sidecar at the binaries inside it. When it is unset nothing changes and the copy baked into the sidecar image is used.

One detail is worth stating up front, because it constrains what such an image has to contain. pgBackRest is dynamically linked and carries no RPATH or RUNPATH:

$ readelf -d /usr/bin/pgbackrest | grep NEEDED
libbz2.so.1.0  libssl.so.3  libcrypto.so.3  liblz4.so.1  libsystemd.so.0
libpq.so.5     libssh2.so.1 libxml2.so.2    libz.so.1    libzstd.so.1
libgcc_s.so.1  libc.so.6

So the image has to carry those libraries as well, and the sidecar needs LD_LIBRARY_PATH pointing into the volume. That is the same shape the current Dockerfile already relies on, since it copies /usr/lib/*-linux-gnu out of the installer stage. In practice the volume would be a Debian based image with pgBackRest installed, and the plugin prepends its /usr/bin to PATH and its library directory to LD_LIBRARY_PATH. The command building code needs no changes, because the call sites already run pgbackrest by name through PATH.

Both the instance pods and the full recovery Job go through reconcilePodSpec, so one place covers both.

The requirements come from the Kubernetes feature itself: 1.35 and later have ImageVolume enabled by default, 1.33 and 1.34 need the feature gate, and the runtime has to be containerd 2.1 or later or CRI-O 1.31 or later. Clusters that do not meet them leave the field unset and keep the current behaviour.

Happy to send the PR if the direction looks right.