feat: migrate container images to Project Hummingbird base images

[maxamillion]

Summary

• Migrates all production and CI container images from Ubuntu/Docker Hub base images to Project Hummingbird equivalents for minimal, hardened, and secure container images.

Changes

deploy/docker/Dockerfile.images

Stage	Old base	New base
rust-builder-base	rust:1.88-slim	quay.io/hummingbird/rust:latest-builder
gateway	ubuntu:24.04	quay.io/hummingbird/core-runtime:latest-openssl
k9s download	ubuntu:24.04	quay.io/hummingbird/curl:latest-builder
helm download	ubuntu:24.04	quay.io/hummingbird/curl:latest-builder
nvidia-container-toolkit	ubuntu:24.04	quay.io/hummingbird/core-runtime:latest-builder
cluster	ubuntu:24.04	quay.io/hummingbird/core-runtime:latest-builder

• Gateway uses distroless core-runtime:latest-openssl (ca-certs + OpenSSL included, no package manager needed)
• Gateway user changed from custom openshell user to Hummingbird default UID 65532
• Cluster uses builder variant (needs bash for entrypoint/healthcheck scripts)
• NVIDIA container toolkit switched from Debian apt repo to RPM repo
• All apt-get commands converted to dnf for Fedora-based images

deploy/docker/Dockerfile.ci

• ubuntu:24.04 -> quay.io/hummingbird/core-runtime:latest-builder
• All package installs converted from apt to dnf with Fedora package names

examples/bring-your-own-container/Dockerfile

• python:3.13-slim -> quay.io/hummingbird/python:3.13-builder
• iproute2 -> iproute (Fedora package name)

examples/private-ip-routing/Dockerfile

• python:3.13-slim -> quay.io/hummingbird/python:3.13 (distroless)

Out of scope

• Dockerfile.python-wheels-macos and Dockerfile.cli-macos (macOS cross-compilation)
• cross-build.sh (cross-compilation toolchain — needs separate investigation for Fedora adaptation)
• Community sandbox images (openshell-community repo)

Testing

CI image must be rebuilt after merging. Trigger manually:

gh workflow run "Build CI Image" --repo LobsterTrap/OpenShell --ref midstream

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 41950461-d824-4020-883d-7907f2ac55b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}