Update dockerfile packages (#4448)

Update packages for CVEs. Also removed unnecessary library from UBI build.

Author: sjberman

build/Dockerfile.nginx

@@ -12,6 +12,9 @@ ARG NJS_DIR
 ARG NGINX_CONF_DIR
 ARG BUILD_AGENT
 
+# Fixes for CVEs; can be removed once base image is updated
+RUN apk update && apk add --no-cache 'libpng>=1.6.53-r0' 'ssl_client>=1.37.0-r20' 'busybox-binsh>=1.37.0-r20'
+
 RUN --mount=type=bind,from=nginx-files,src=nginx_signing.rsa.pub,target=/etc/apk/keys/nginx_signing.rsa.pub \
     printf "%s\n" "https://packages.nginx.org/nginx-agent/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
     && apk add --no-cache nginx-agent=${NGINX_AGENT_VERSION#v}

build/ubi/Dockerfile.nginx

@@ -43,7 +43,7 @@ RUN --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_s
     && microdnf --nodocs install -y nginx nginx-module-njs nginx-module-otel \
     # Install nginx-agent
     && microdnf --nodocs install -y nginx-agent-${NGINX_AGENT_VERSION#v}* \
-    # Clean up (only remove what we can)
+    # Clean up
     && microdnf clean all \
     && rm -rf /var/cache/yum
 

build/ubi/Dockerfile.nginxplus

@@ -36,9 +36,8 @@ RUN --mount=type=bind,from=nginx-files,src=nginx-plus.repo,target=/etc/yum.repos
     --mount=type=bind,from=ubi9-packages,src=/,target=/ubi-bin/ \
     --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
 	--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
-    # Install shadow-utils for useradd
-    microdnf --nodocs install -y shadow-utils  \
-    && rpm --import /tmp/nginx_signing.key \
+    # Import NGINX signing key
+    rpm --import /tmp/nginx_signing.key \
     # Install c-ares from the dependencies image (contains required libs)
     && rpm -Uvh /ubi-bin/c-ares-*.rpm \
     # Create nginx user with consistent UID/GID
@@ -50,7 +49,6 @@ RUN --mount=type=bind,from=nginx-files,src=nginx-plus.repo,target=/etc/yum.repos
     # Install nginx-agent
     && microdnf --nodocs install -y nginx-agent-${NGINX_AGENT_VERSION#v}* \
     # Clean up
-    && microdnf remove -y shadow-utils \
     && microdnf clean all \
     && rm -rf /var/cache/yum