deploy: switch runtime to Red Hat Hardened core-runtime image

Multi-stage build: move Pulumi plugin installation from runtime to build
stage, then copy binaries + plugins into hi/core-runtime (58 MB glibc base,
minimal CVE surface). Runtime only needs the compiled mapt binary, pulumi
CLI, and pre-installed plugins — no Go toolchain or package manager needed.

Author: jangel97

oci/Containerfile

@@ -16,20 +16,9 @@ RUN unset VERSION \
     && if [ "$TARGETARCH" = "arm64" ]; then export PULUMI_URL="${PULUMI_BASE_URL}-linux-arm64.tar.gz"; fi \
     && echo ${PULUMI_URL} \
     && curl -L ${PULUMI_URL} -o pulumicli.tar.gz \
-    && tar -xzvf pulumicli.tar.gz 
+    && tar -xzvf pulumicli.tar.gz
 
-FROM registry.access.redhat.com/ubi9/go-toolset@sha256:1c1259373e6feb4b57de490452379c40888cf6e876154cd2ace17eae9c64a7ea
-ARG TARGETARCH
-LABEL org.opencontainers.image.authors="Redhat Developer"
-
-COPY --from=builder /workspace/out/mapt /workspace/pulumi/pulumi /usr/local/bin/
-
-ENV PULUMI_CONFIG_PASSPHRASE "passphrase" 
-
-ENV AWS_SDK_LOAD_CONFIG=1 \
-    ARCH_N=x86_64
-
-# Pulumi plugins
+# Pulumi plugins — installed in build stage, copied into runtime
 # renovate: datasource=github-releases depName=pulumi/pulumi-aws
 ARG PULUMI_AWS_VERSION=v7.30.0
 # renovate: datasource=github-releases depName=pulumi/pulumi-awsx
@@ -50,10 +39,9 @@ ARG PULUMI_GITLAB_VERSION=v9.11.0
 ARG PULUMI_IBMCLOUD_VERSION=v0.0.12
 ENV IBMCLOUD_PLUGIN_URL https://github.com/mapt-oss/pulumi-ibmcloud/releases/download/${PULUMI_IBMCLOUD_VERSION}/pulumi-resource-ibmcloud-${PULUMI_IBMCLOUD_VERSION}-linux-${TARGETARCH}.tar.gz
 
-ENV PULUMI_HOME "/opt/mapt/run" 
-WORKDIR ${PULUMI_HOME}
-
-RUN mkdir -p /opt/mapt/run \
+ENV PULUMI_HOME "/opt/pulumi-plugins"
+ENV PATH="/workspace/pulumi:${PATH}"
+RUN mkdir -p ${PULUMI_HOME} \
     && curl -L ${IBMCLOUD_PLUGIN_URL} -o pulumi-resource-ibmcloud.tar.gz \
     && tar -xzvf pulumi-resource-ibmcloud.tar.gz \
     && pulumi plugin install resource ibmcloud ${PULUMI_IBMCLOUD_VERSION} --file pulumi-resource-ibmcloud \
@@ -65,11 +53,28 @@ RUN mkdir -p /opt/mapt/run \
     && pulumi plugin install resource random ${PULUMI_RANDOM_VERSION} \
     && pulumi plugin install resource awsx ${PULUMI_AWSX_VERSION} \
     && pulumi plugin install resource aws-native ${PULUMI_AWS_NATIVE_VERSION} \
-    && pulumi plugin install resource gitlab ${PULUMI_GITLAB_VERSION} \
-    && chown -R 1001:0 /opt/mapt/run \
+    && pulumi plugin install resource gitlab ${PULUMI_GITLAB_VERSION}
+
+# Stage 2: Red Hat Hardened minimal runtime (glibc + coreutils, no toolchain)
+FROM registry.access.redhat.com/hi/core-runtime@sha256:c58439d153bf82ed9c4b4936a14091ce6e15fcd5dc8ca8ba9e0fbb113daa6a5f
+USER 0
+ARG TARGETARCH
+LABEL org.opencontainers.image.authors="Redhat Developer"
+
+COPY --from=builder /workspace/out/mapt /workspace/pulumi/pulumi /usr/local/bin/
+
+ENV PULUMI_CONFIG_PASSPHRASE "passphrase"
+
+ENV AWS_SDK_LOAD_CONFIG=1 \
+    ARCH_N=x86_64
+
+ENV PULUMI_HOME "/opt/mapt/run"
+WORKDIR ${PULUMI_HOME}
+
+COPY --from=builder /opt/pulumi-plugins/ /opt/mapt/run/
+RUN chown -R 65532:0 /opt/mapt/run \
     && chmod -R ug+rwx /opt/mapt/run
 
-USER 1001
+USER 65532
 ENTRYPOINT ["mapt"]
 CMD ["-h"]
-