# Batch 2 — official Envoy Gateway Helm chart v1.9.2. Approved pin docker.io/envoyproxy/envoy:v1.39.3
# (chart default proxy image distroless-v1.39.3 is not followed). linux/amd64 only.
# Ladder (c): same upstream digest + apt dist-upgrade layer (Ubuntu 22.04 + /usr/local/bin/envoy).
# Digests from helm-pilot/batch2/digests.txt (crane v0.22.1, 2026-10-10T18:08:48Z):
#   index sha256:dd85940439de19a0b6ae8419610363ea0ad351d9a994ea007161c206ec1e1865
#   linux/amd64 sha256:e877a955cc8fde1d54b6b4141b95240511fe1494a7d98759c71a0cf43573ae33
ARG UPSTREAM=docker.io/envoyproxy/envoy@sha256:dd85940439de19a0b6ae8419610363ea0ad351d9a994ea007161c206ec1e1865
FROM ${UPSTREAM}
USER root
RUN apt-get update && apt-get -y --only-upgrade dist-upgrade && rm -rf /var/lib/apt/lists/* && dpkg-query -W > /etc/tp-hardened.dpkg-manifest
LABEL org.opencontainers.image.version="v1.39.3" \
      io.thepeoples.hardened.upstream="docker.io/envoyproxy/envoy:v1.39.3@sha256:dd85940439de19a0b6ae8419610363ea0ad351d9a994ea007161c206ec1e1865" \
      io.thepeoples.hardened.replaces="docker.io/envoyproxy/envoy:v1.39.3@sha256:dd85940439de19a0b6ae8419610363ea0ad351d9a994ea007161c206ec1e1865" \
      io.thepeoples.hardened.ladder="c" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"