# Helm pilot — argo/argo-cd 10.10.1 pins redis:8.6.4-alpine. Ladder (c): same upstream digest + apk upgrade layer.
ARG UPSTREAM=ecr-public.aws.com/docker/library/redis@sha256:2cc044fc5a07c9b701f8f1255a309ae9ad7856e694ac03513bf3648c01e40763
FROM ${UPSTREAM}
RUN apk upgrade --no-cache --available && rm -rf /var/cache/apk/* && apk list --installed > /etc/tp-hardened.apk-manifest
LABEL org.opencontainers.image.version="8.6.4-alpine" \
      io.thepeoples.hardened.upstream="ecr-public.aws.com/docker/library/redis:8.6.4-alpine@sha256:2cc044fc5a07c9b701f8f1255a309ae9ad7856e694ac03513bf3648c01e40763" \
      io.thepeoples.hardened.replaces="ecr-public.aws.com/docker/library/redis:8.6.4-alpine@sha256:2cc044fc5a07c9b701f8f1255a309ae9ad7856e694ac03513bf3648c01e40763" \
      io.thepeoples.hardened.ladder="c" \
      io.thepeoples.hardened.license="RSALv2 OR SSPLv1 OR AGPLv3 (redis 8.x); alpine packages per their own licenses" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"