chore(sdk): use Debian's Docker Hardened Image

Using trivy to scan vulnerabilities in Docker images, we found that:

BEFORE: Total: 97 (UNKNOWN: 2, LOW: 82, MEDIUM: 13, HIGH: 0, CRITICAL: 0)
AFTER : Total: 88 (UNKNOWN: 2, LOW: 76, MEDIUM: 10, HIGH: 0, CRITICAL: 0)

Author: endersonmaia

packages/sdk/Dockerfile

@@ -66,6 +66,7 @@ FROM base AS foundry
 ARG FOUNDRY_VERSION
 ARG TARGETARCH
 ARG TARGETOS
+WORKDIR /usr/local/bin
 RUN <<EOF
 mkdir -p /usr/local/bin
 curl -fsSL https://github.com/foundry-rs/foundry/releases/download/v${FOUNDRY_VERSION}/foundry_v${FOUNDRY_VERSION}_${TARGETOS}_${TARGETARCH}.tar.gz \
@@ -130,12 +131,10 @@ ARG DEBIAN_FRONTEND=noninteractive
 RUN <<EOF
 apt-get install -y --no-install-recommends \
     libslirp0 \
-    lua5.4
-rm -rf /var/lib/apt/lists/*
-EOF
+    lua5.4 \
+    passwd
 
-RUN <<EOF
-set -e
+# create cartesi user
 useradd \
     --comment "cartesi user" \
     --no-create-home \
@@ -145,6 +144,9 @@ useradd \
     --uid 102 \
     --user-group \
     cartesi
+
+apt-get remove -y --purge passwd
+rm -rf /var/lib/apt/lists/*
 EOF
 
 # Install cartesi-machine emulator
@@ -305,9 +307,7 @@ apt-get install -y --no-install-recommends \
     liblzo2-2 \
     libslirp0 \
     locales \
-    lua5.4 \
-    xxd \
-    xz-utils
+    xxd
 rm -rf /var/lib/apt/lists/*
 EOF
 

packages/sdk/docker-bake.hcl

@@ -8,8 +8,8 @@ target "default" {
   args = {
     ALTO_VERSION                      = "1.2.5"
     ALTO_PACKAGE_VERSION              = "0.0.18"
-    CARTESI_BASE_IMAGE                = "docker.io/library/debian:trixie-20260223-slim@sha256:1d3c811171a08a5adaa4a163fbafd96b61b87aa871bbc7aa15431ac275d3d430"
-    CARTESI_DEVNET_VERSION            = "2.0.0-alpha.10"
+    CARTESI_BASE_IMAGE                = "dhi.io/debian-base:trixie-dev@sha256:2166e2eaef0651c9ad21de6ab5a34fda12541d89bccf7bcb0a94afceb1b1541b"
+    CARTESI_DEVNET_VERSION            = "2.0.0-alpha.9"
     CARTESI_IMAGE_KERNEL_VERSION      = "0.20.0"
     CARTESI_LINUX_KERNEL_VERSION      = "6.5.13-ctsi-1-v0.20.0"
     CARTESI_MACHINE_EMULATOR_VERSION  = "0.19.0"

packages/sdk/package.json

@@ -3,6 +3,7 @@
     "private": true,
     "version": "0.12.0-alpha.35",
     "scripts": {
-        "build": "docker buildx bake --load --metadata-file=build.json"
+        "build": "docker buildx bake --load --metadata-file=build.json",
+        "digest-update": "../../.github/scripts/update-image-digests.sh ./docker-bake.hcl"
     }
 }