feat(Dockerfile): use a minimal base container

[jcpunk]

This is a followup to #2255

Since the user space is only provided to ease troubleshooting, fedora-minimal should:

• reduce the size of the image
• have a low CVE list
• not require regular version bumps (RHEL8 -> RHEL9 -> RHEL10)

I think ubi-micro is probably the way to go, but didn't see consensus in the original PR.

If maintaining the version (8->9->10) is too concerning, alpine:latest might be an alternative.

[Copilot]

Pull request overview

This PR updates the runtime container base image in the root Dockerfile to reduce image size and vulnerability surface area compared to the current UBI9-based image, following up on the earlier “FROM scratch” discussion.

Changes:

• Switch the final-stage runtime base image from registry.access.redhat.com/ubi9:latest to quay.io/fedora/fedora-minimal:latest.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jcpunk]

I wonder if hummingbird core-runtime might be a good choice?

[laurall974]

I think @nikimanoledaki also mentioned ubi-micro in the orginal PR #2255

Any new thoughts Niki?

[jcpunk]

I'd be happy to go with the smaller image (ubi-micro), but, since the userspace is provided for troubleshooting, fedora might have more up to date tooling and avoid needing someone to bump the version to RHEL11.

[iacker]

I scanned the released v0.11.4 image with Trivy 0.73.0: 32 HIGH findings and no CRITICAL ones. Most come from base OS packages, with a few in the Go runtime and x/net. A refreshed minimal base image should reduce this significantly. I can rescan the PR image once it is available.