# Helm pilot — redis-ha (argo-cd 10.10.1, HA only) pins haproxy:3.3.10-alpine.
# Ladder (a)+(c): newest 3.3.x patch (3.3.16; 3.3.11+ carries the CVE-2026-55203/55204 backports) + apk upgrade layer.
ARG UPSTREAM=ecr-public.aws.com/docker/library/haproxy@sha256:96088e311f0f8c13d0fa197255d47fedb4c35090049319187b0038b848d86f82
FROM ${UPSTREAM}
USER root
RUN apk upgrade --no-cache --available && rm -rf /var/cache/apk/* && apk list --installed > /etc/tp-hardened.apk-manifest
USER haproxy
LABEL org.opencontainers.image.version="3.3.16-alpine" \
      io.thepeoples.hardened.upstream="ecr-public.aws.com/docker/library/haproxy:3.3.16-alpine@sha256:96088e311f0f8c13d0fa197255d47fedb4c35090049319187b0038b848d86f82" \
      io.thepeoples.hardened.replaces="ecr-public.aws.com/docker/library/haproxy:3.3.10-alpine@sha256:29c775f541ba6364ac95de998a8d3d16eb4882470c4fd7bbe8de8315edfdd883" \
      io.thepeoples.hardened.ladder="a+c" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"