# Helm pilot — redis-ha (argo-cd 10.10.1, HA only) pins haproxy:3.3.10-alpine.
# Ladder (a)+(c): 3.4 LTS (PhreeStyle 2026-10-21: 3.4.1+ for CVE-2026-55203/55204) + apk upgrade.
# Latest upstream stable on that line is 3.4.7 (2026-10-14). Never retag 3.3.16-alpine-tpio.1.
ARG UPSTREAM=ecr-public.aws.com/docker/library/haproxy@sha256:251da69821897ec8c4819f12b1babbc4b71f562943addc9b9eb14bb6ece40dc6
FROM ${UPSTREAM}
USER root
RUN apk upgrade --no-cache --available && rm -rf /var/cache/apk/* && apk list --installed > /etc/tp-hardened.apk-manifest
USER haproxy
LABEL org.opencontainers.image.version="3.4.7-alpine" \
      io.thepeoples.hardened.upstream="ecr-public.aws.com/docker/library/haproxy:3.4.7-alpine@sha256:251da69821897ec8c4819f12b1babbc4b71f562943addc9b9eb14bb6ece40dc6" \
      io.thepeoples.hardened.replaces="ecr-public.aws.com/docker/library/haproxy:3.3.10-alpine@sha256:29c775f541ba6364ac95de998a8d3d16eb4882470c4fd7bbe8de8315edfdd883" \
      io.thepeoples.hardened.ladder="a+c" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"