fix(docker): remediate container scan vulnerabilities across CI, cluster, and sandbox images (#144)

Author: drew

deploy/docker/Dockerfile.ci

@@ -8,8 +8,8 @@
 
 FROM ubuntu:24.04
 
-ARG DOCKER_VERSION=27.5.1
-ARG BUILDX_VERSION=v0.21.1
+ARG DOCKER_VERSION=29.3.0
+ARG BUILDX_VERSION=v0.32.1
 ARG TARGETARCH
 
 ENV DEBIAN_FRONTEND=noninteractive

deploy/docker/Dockerfile.cluster

@@ -15,7 +15,7 @@
 # The helm charts are built by the docker:build:cluster mise task
 # and placed in deploy/docker/.build/ before this Dockerfile is built.
 
-ARG K3S_VERSION=v1.29.8-k3s1
+ARG K3S_VERSION=v1.34.5-k3s1
 FROM rancher/k3s:${K3S_VERSION}
 
 # Create directories for manifests, charts, and configuration

deploy/docker/sandbox/Dockerfile.base

@@ -107,7 +107,7 @@ RUN groupadd -r supervisor && useradd -r -g supervisor -s /usr/sbin/nologin supe
 # Stage 3: Python dependencies builder
 FROM base AS builder
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.10.8 /uv /usr/local/bin/uv
 
 # Copy project files for dependency resolution
 COPY pyproject.toml uv.lock ./
@@ -128,7 +128,7 @@ FROM base AS coding-agents
 # Include a minimal native toolchain so npm can compile optional native
 # dependencies on platforms where prebuilt artifacts are unavailable.
 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
-    apt-get install -y --no-install-recommends build-essential git nodejs python3 vim-tiny nano && \
+    apt-get install -y --no-install-recommends build-essential git nodejs python3 nano && \
     rm -rf /var/lib/apt/lists/*
 
 # Install GitHub CLI (gh) from the official apt repository
@@ -144,8 +144,11 @@ RUN curl -fsSL https://claude.ai/install.sh | bash \
     && cp /root/.local/bin/claude /usr/local/bin/claude \
     && chmod 755 /usr/local/bin/claude
 
-# Install OpenCode CLI and Codex CLI (OpenAI)
-RUN npm install -g opencode-ai @openai/codex openclaw
+# Install OpenCode CLI, Codex CLI (OpenAI), and OpenClaw with pinned versions
+# for reproducible builds. Force-upgrade tar afterward to resolve transitive
+# dependency vulnerabilities (GHSA-r6q2-hw4h-h46w, GHSA-qffp-2rhf-9h96, etc.)
+RUN npm install -g opencode-ai@1.2.18 @openai/codex@0.111.0 openclaw@2026.3.2 && \
+    npm install -g tar@7.5.10
 
 # Install ai-pim-utils (NVIDIA PIM CLI tools: outlook, calendar, transcripts, etc.)
 # The install script auto-detects Debian and installs via .deb package to /usr/bin.

mise.toml

@@ -38,7 +38,7 @@ SCCACHE_DIR = "{{config_root}}/.cache/sccache"
 NAV_PYPI_REPOSITORY_URL = "https://urm.nvidia.com/artifactory/api/pypi/nv-shared-pypi-local"
 
 # Shared build constants (overridable via environment)
-K3S_VERSION = "{{env.K3S_VERSION | default(value='v1.29.8-k3s1')}}"
+K3S_VERSION = "{{env.K3S_VERSION | default(value='v1.34.5-k3s1')}}"
 DOCKER_BUILDKIT = "1"
 
 [vars]