Float the base images and update packages at build time

[aaaaaaaalex]

📝 Links

• Same remediation for the Forklift images: Address image CVE burden: float bases, trim runtime, unify Go toolchain forklift#4
• The same change for the release-2.12 line (consoles up to 4.21): Float the base images and update packages at build time (release-2.12) #2

📝 Description

Brings the image up to date and keeps it there.

• Bases float. Both stages were pinned by digest, so they never picked up rebuilt bases. The builder now uses ubi9/nodejs-22:latest; the web server moves from nginx-122 to ubi9/nginx-126:latest, because the 1.22 image has not been rebuilt since January and floating it would gain nothing.
• Runtime packages are updated at build time, picking up errata released since the base was last rebuilt. Updating nginx resets /var/log/nginx to the package's root:root 0711, discarding the base image's ownership for uid 1001 — without restoring it, the container crash-loops on startup — so the ownership is re-applied before dropping back to uid 1001.
• The update re-runs on every build. Otherwise it is served from the build cache whenever the base is unchanged, shipping updates as old as the cached layer. BUILD_DATE is declared ahead of the update; builds pass a new value each time.
• Non-breaking dependency security fixes (npm audit fix). Shipped dependencies go from 3 high to 2; the remaining two (react-router, via the console SDK) are only fixed in an SDK 4.23 prerelease.

Only build/Containerfile and package-lock.json change; build/Containerfile-downstream is untouched.

🎥 Demo

Built and run locally:

• Runs as uid 1001 with no restarts; /var/log/nginx owned by 1001:0; RHEL 9.8, nginx 1.26.3; plugin-manifest.json served (HTTP 200).
• Entry script still uses the 4.22 loader: __load_plugin_entry__("forklift-console-plugin", …).
• No package updates pending in the built image.
• Same BUILD_DATE twice leaves the update cached; a new value makes it re-run.

📝 CC://

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Image build workflows must pass a changing BUILD_DATE to ensure package updates rerun.

Review effort: Lite
Findings: 1

Open (1)

• Pass BUILD_DATE to production image builds to refresh package updates · New

What changed in this PR

Updates container base images, applies runtime package updates, and refreshes dependency resolutions.

Changes:

• Floats UBI Node.js and nginx base images.
• Adds runtime package updates and restores nginx log permissions.
• Updates dependency lockfile entries.

File	Summary
package-lock.json	Refreshes dependency resolutions and metadata.
build/​Containerfile	Floats images and adds runtime package updates; build paths do not pass BUILD_DATE, so updates may remain cached.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.