deploy/core.Dockerfile: Ubuntu 24.04, digest-pinned, toolchain in, Harnesses out

[qcentic-dev]

Part of #23. Spec: ADR 0016 — The 0.1.0 shape, clauses D5, D6, D7, D8, D12, D14, D15, D40.

Phase 2 — Images and container
Blocked by: #33
Blocks: #38, #44, #45, #46, #47, #49, #60

What

The Core image. This is the file #9 deleted without replacing — deploy/dev/core.Dockerfile is what container-image.yml:194 currently builds the published core image from, so this ticket must land before T16 deletes that tree.

Target: 1248 → ~38 distinct CVEs, 751 → ~190 MB. Say it accurately in the file's header comment: the base did change, but the mechanism is the package set — build-essential → libc6-dev → linux-libc-dev is 1200 of 1328 OS findings, and dropping that one package alone takes an unchanged ubuntu:24.04 build from 1248 to 38.

Both halves of the base pin are load-bearing and do different jobs: the digest, because 24.04 is a rolling tag that moves on every point release; and apt-get upgrade -y in the same RUN, because apt resolves noble-security at build time, so a weekly rebuild on an unchanged digest still collects every fix Canonical has shipped. Without the upgrade the pin freezes the CVEs too and T22's cadence is theatre.

Done when

• deploy/core.Dockerfile exists; container-image.yml and scripts/__tests__/panel-image.test.mjs build/assert against the new path
• FROM ubuntu:24.04@sha256:<digest>, tag in the comment, with apt-get update && apt-get upgrade -y && apt-get install … in one layer
• Package set exactly: bash sudo ca-certificates curl git openssh-client build-essential python3 ripgrep jq less vim-tiny unzip lsof xz-utils tini — tini is not optional (D14)
• Node 24 from https://nodejs.org/dist/v${NODE_VERSION}/, verified against that release's own SHASUMS256.txt. ARG NODE_VERSION=24.18.1
• A comment warns against "simplifying" to apt-get install nodejs: it would get Node 18 and move it onto Ubuntu's Pro-gated universe security stream in one move
• The stock ubuntu:x:1000:1000 user is removed and core is created with explicit --uid 1000 --gid 1000, with the reason written beside it — useradd without them lands on 1001:100 (measured) and breaks every bind-mounted repo
• ENTRYPOINT ["/usr/bin/tini", "--"], CMD ["actana", "daemon"] — daemon is PID 2, and this is baked, not --init, so a bare docker run is not the broken configuration
• Container-mode env baked: ACTANA_CONTAINER=1, AC_CORE_REMOTE=1, AC_CORE_LINK_HOST=0.0.0.0, AC_USER_DATA_DIR, AC_APP_PATH, AC_CORE_MATERIAL_FILE, NPM_CONFIG_PREFIX=/home/core/.local, PATH
• EXPOSE reads from the same ARG as ACTANA_PORT rather than hardcoding 8443
• NOPASSWD sudo for core only; no user:-override accommodation (D12)
• Harnesses are not baked — the image is ~190 MB, not ~1.4 GB
• Measurement, recorded in the PR: whether apt-get upgrade actually takes the OS surface from 21 distinct to ~6. 15 of the 21 are marked fixable so it should, but that is an inference from Trivy's fixable column, not a scan. One build and one trivy image against docs/research/core-base-measure/. It does not change the base pick; it decides whether T22's cadence justification is real

---

_{Decisions are locked in ADR 0016. If this ticket needs one changed, amend the ADR in the same PR — do not decide it in a comment.}