chore: bump miniblue image to sha-fba5d05

Author: lonegunmanb

.github/copilot-instructions.md

@@ -140,7 +140,7 @@ Follow the structure in `https://github.com/killercoda/scenarios-istio`.
 For Azure-flavoured scenarios (e.g. `terraform-cli-apply-azure`), substitute LocalStack with [miniblue](https://miniblue.io/):
 
 - `init/background.sh` calls `start_miniblue` instead of `start_localstack`. Do NOT call both — each scenario picks one cloud emulator.
-- `assets/docker-compose.yml` uses image `ghcr.io/lonegunmanb/miniblue:sha-decf9af` (a fork that fixes case-insensitive ARM routing for azurerm v4 compatibility, persists blob metadata on `?comp=metadata` and plain `PUT {blob}`, and adds the `MINIBLUE_DISABLE_SHAREDKEY_AUTH` env var so the azurerm backend's lock + state-write flow works without per-request SharedKey signing; version pinned by SHA tag, never `latest`), exposes ports `4566` (HTTP) and `4567` (HTTPS), and limits memory to 512M. The compose `environment:` block sets `MINIBLUE_STORAGE_ENDPOINT=http://localhost:4566` (so ARM returns local blob endpoints) and `MINIBLUE_DISABLE_SHAREDKEY_AUTH=1` (so curl/azlocal can hit the data plane without HMAC-SHA256 signing — strictly a tutorial convenience; real Azure always requires SharedKey). Do NOT bind-mount the cert directory — the image is distroless and runs as `nonroot`, so the cert lives at `/home/nonroot/.miniblue/cert.pem` inside the container; `start_miniblue` extracts it via `docker cp` instead.
+- `assets/docker-compose.yml` uses image `ghcr.io/lonegunmanb/miniblue:sha-fba5d05` (a fork that fixes case-insensitive ARM routing for azurerm v4 compatibility, persists blob metadata on `?comp=metadata` and plain `PUT {blob}`, and adds the `MINIBLUE_DISABLE_SHAREDKEY_AUTH` env var so the azurerm backend's lock + state-write flow works without per-request SharedKey signing; version pinned by SHA tag, never `latest`), exposes ports `4566` (HTTP) and `4567` (HTTPS), and limits memory to 512M. The compose `environment:` block sets `MINIBLUE_STORAGE_ENDPOINT=http://localhost:4566` (so ARM returns local blob endpoints) and `MINIBLUE_DISABLE_SHAREDKEY_AUTH=1` (so curl/azlocal can hit the data plane without HMAC-SHA256 signing — strictly a tutorial convenience; real Azure always requires SharedKey). Do NOT bind-mount the cert directory — the image is distroless and runs as `nonroot`, so the cert lives at `/home/nonroot/.miniblue/cert.pem` inside the container; `start_miniblue` extracts it via `docker cp` instead.
 - `start_miniblue` writes `SSL_CERT_FILE=/root/.miniblue/cert.pem` to both `/etc/profile.d/miniblue.sh` and `/root/.bashrc` (Killercoda terminals are non-login shells), and exports it for the current shell. It ALSO installs the cert into the system CA trust store via `update-ca-certificates` (`/usr/local/share/ca-certificates/miniblue.crt`) — this is the primary trust mechanism, because Killercoda terminals are opened BEFORE `background.sh` runs, so the `~/.bashrc` append does not affect the user's existing shell. With the cert in the system store, Terraform/azurerm trusts `https://localhost:4567` regardless of `SSL_CERT_FILE`.
 - After `start_miniblue`, call `install_azlocal` to extract the bundled `azlocal` binary (`/azlocal` inside the container) to `/usr/local/bin/`. `azlocal` is a standalone Go CLI (no `az` dependency) that talks to miniblue over HTTP 4566 — use it in step text instead of raw `curl` for resource verification (`azlocal group list`, `azlocal dns zone list --resource-group ...`, `azlocal network vnet list --resource-group ...`, `azlocal network vnet subnet list --resource-group <rg> --vnet-name <vnet>`).
 - `assets/main.tf` MUST use the **azurerm v4** provider:
@@ -181,8 +181,8 @@ For Azure-flavoured scenarios (e.g. `terraform-cli-apply-azure`), substitute Loc
 
 ### Miniblue Image Pin
 
-- **Source of truth**: `scripts/miniblue-image.mjs` exports the canonical image tag (e.g. `ghcr.io/lonegunmanb/miniblue:sha-decf9af`).
-- **Auto-propagated**: `scripts/sync-miniblue-image.mjs` rewrites every `image: ghcr.io/lonegunmanb/miniblue:sha-decf9af` line in `terraform-tutorial/*/assets/docker-compose.yml`, `terraform-tutorial/*/init/background.sh`, and the docs reference in this file.
+- **Source of truth**: `scripts/miniblue-image.mjs` exports the canonical image tag (e.g. `ghcr.io/lonegunmanb/miniblue:sha-fba5d05`).
+- **Auto-propagated**: `scripts/sync-miniblue-image.mjs` rewrites every `image: ghcr.io/lonegunmanb/miniblue:sha-fba5d05` line in `terraform-tutorial/*/assets/docker-compose.yml`, `terraform-tutorial/*/init/background.sh`, and the docs reference in this file.
 - Run `npm run sync-miniblue` after bumping, or it runs automatically via `prebuild`.
 - Do NOT edit the image tag in any docker-compose.yml or background.sh by hand — change `miniblue-image.mjs` and resync.
 

scripts/miniblue-image.mjs

@@ -14,7 +14,7 @@
  * Never edit those references by hand — they are managed.
  */
 
-export const MINIBLUE_IMAGE = 'ghcr.io/lonegunmanb/miniblue:sha-decf9af'
+export const MINIBLUE_IMAGE = 'ghcr.io/lonegunmanb/miniblue:sha-fba5d05'
 
 // Loose-but-anchored regex matching only the lonegunmanb miniblue image with
 // any tag, so we never accidentally rewrite unrelated lines.

terraform-tutorial/terraform-backend-azure/assets/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   miniblue:
     # 使用 fork 后的镜像（修复 ARM 路由大小写、blob metadata 持久化、SharedKey 旁路），版本锁定
-    image: ghcr.io/lonegunmanb/miniblue:sha-decf9af
+    image: ghcr.io/lonegunmanb/miniblue:sha-fba5d05
     ports:
       - "4566:4566"
       - "4567:4567"

terraform-tutorial/terraform-backend-azure/init/background.sh

@@ -12,7 +12,7 @@ if [ ! -f docker-compose.yml ]; then
 cat > docker-compose.yml <<'EOF'
 services:
   miniblue:
-    image: ghcr.io/lonegunmanb/miniblue:sha-decf9af
+    image: ghcr.io/lonegunmanb/miniblue:sha-fba5d05
     ports:
       - "4566:4566"
       - "4567:4567"

terraform-tutorial/terraform-basics-azure/assets/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   miniblue:
     # 使用 fork 后的镜像（修复了 ARM 路由大小写敏感与 vnet privateEndpointVNetPolicies 不回传问题，兼容 azurerm v4），版本锁定
-    image: ghcr.io/lonegunmanb/miniblue:sha-decf9af
+    image: ghcr.io/lonegunmanb/miniblue:sha-fba5d05
     ports:
       - "4566:4566"
       - "4567:4567"

terraform-tutorial/terraform-basics-azure/init/background.sh

@@ -12,7 +12,7 @@ if [ ! -f docker-compose.yml ]; then
 cat > docker-compose.yml <<'EOF'
 services:
   miniblue:
-    image: ghcr.io/lonegunmanb/miniblue:sha-decf9af
+    image: ghcr.io/lonegunmanb/miniblue:sha-fba5d05
     ports:
       - "4566:4566"
       - "4567:4567"

terraform-tutorial/terraform-cli-apply-azure/assets/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   miniblue:
     # 使用 fork 后的镜像（修复了 ARM 路由大小写敏感与 vnet privateEndpointVNetPolicies 不回传问题，兼容 azurerm v4），版本锁定
-    image: ghcr.io/lonegunmanb/miniblue:sha-decf9af
+    image: ghcr.io/lonegunmanb/miniblue:sha-fba5d05
     ports:
       - "4566:4566"
       - "4567:4567"

terraform-tutorial/terraform-cli-apply-azure/init/background.sh

@@ -12,7 +12,7 @@ if [ ! -f docker-compose.yml ]; then
 cat > docker-compose.yml <<EOF
 services:
   miniblue:
-    image: ghcr.io/lonegunmanb/miniblue:sha-decf9af
+    image: ghcr.io/lonegunmanb/miniblue:sha-fba5d05
     ports:
       - "4566:4566"
       - "4567:4567"

terraform-tutorial/terraform-cli-basics-azure/assets/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   miniblue:
     # 使用 fork 后的镜像（修复 ARM 路由大小写敏感、blob metadata 持久化，并新增 MINIBLUE_DISABLE_SHAREDKEY_AUTH
     # 用于教学场景下绕过 SharedKey 校验），版本锁定
-    image: ghcr.io/lonegunmanb/miniblue:sha-decf9af
+    image: ghcr.io/lonegunmanb/miniblue:sha-fba5d05
     ports:
       - "4566:4566"
       - "4567:4567"

terraform-tutorial/terraform-cli-basics-azure/init/background.sh

@@ -12,7 +12,7 @@ if [ ! -f docker-compose.yml ]; then
 cat > docker-compose.yml <<'EOF'
 services:
   miniblue:
-    image: ghcr.io/lonegunmanb/miniblue:sha-decf9af
+    image: ghcr.io/lonegunmanb/miniblue:sha-fba5d05
     ports:
       - "4566:4566"
       - "4567:4567"