Pull base images and reference BUILD_DATE in the package update

[aaaaaaaalex]

📝 Links

• Follow-up to Float the base images and update packages at build time #1, addressing its review.
• Same fixes for the release-2.12 line (consoles up to 4.21): Pull base images and reference BUILD_DATE in the package update (release-2.12) #6

📝 Description

Makes sure the package update in the image actually runs, on a current base, however the image is built.

• Reference BUILD_DATE in the package update. Docker re-runs a RUN when an ARG declared ahead of it changes, but other builders — including podman, which ci/build-and-push-images.sh uses — need the value used in the instruction itself. The update now echoes it.
• The local build script pulls base images and passes BUILD_DATE. It reused any local copy of nginx-126:latest without checking the registry and never passed BUILD_DATE, so it could build on a stale base and reuse a cached update.

Not changed: the on-push-main and on-push-release workflows publish to upstream's quay.io/kubev2v, do not run on this fork, and build on fresh runners with no layer cache, so the update already runs there.

🎥 Demo

Built with docker build --pull and run locally:

• The base is fetched from the registry (lookup 1.1s rather than 0.0s from a local copy) and is the registry's current nginx-126 (build date 2026-09-30).
• The same BUILD_DATE twice leaves the update cached; a new value makes it re-run.
• Runs as uid 1001 with no restarts, /var/log/nginx owned by 1001:0, 4.22 loader __load_plugin_entry__("forklift-console-plugin", …), no package updates pending.

The podman script path is untested (podman is not installed here).

📝 CC://

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.