[ExtraToast]

Part of JorisJonkers-dev/auth-api#80 (epic JorisJonkers-dev/estate#204).

The estate path runs every container non-root, on a read-only root filesystem with no capabilities, and deploy-kit 0.31 renders the images lock's uid beside runAsNonRoot: true. nginx:alpine runs as root and binds 80, so the current image never starts there.

• FROM nginxinc/nginx-unprivileged:alpine: uid 101, pid and temp files under /tmp, as home-portal's image.
• listen 8080, EXPOSE 8080; platform/deployment.yml's health port follows.

Checked locally: the built image, run as --user 101:101 --read-only --tmpfs /tmp --cap-drop ALL, answers 200 on / and /login.

Release order: merge and release this only after fleet-infra's two auth handover PRs have reconciled (orphan, then drop). Before that, fleet-infra's auto-bump would pin this image into the old path's Deployment, which still declares port 80. Then release this before auth-api, whose publish locks auth-ui's latest release. Runbook: JorisJonkers-dev/estate docs/runbooks/auth-handover.md.

[github-actions]

Deploy Preview — auth-ui

Environments: production
Context ref: ghcr.io/jorisjonkers-dev/cluster-deploy-context-public@sha256:95dc39fc695694c8fb4b0c538d7fe13038d407c7302c3725c98f0496c6a83499
Workloads: 1 | Routes: 1 | Gatus endpoints: 1

Image refs

• auth-ui: ghcr.io/jorisjonkers-dev/auth-ui@sha256:0000000000000000000000000000000000000000000000000000000000000000

SC-11 Readiness Scorecard

	Check	Status	Detail
✅	schema_pinned	pass
✅	context_pinned	pass
✅	no_latest_images	pass
✅	health_declared	pass
✅	route_owner_authmode_declared	pass
✅	rollback_retention_acknowledged	pass
✅	no_raw_secrets	pass
➖	stateful_policy_declared	not_applicable	deployment declares no stateful workloads
➖	raw_manifests_guarded	not_applicable	no workload enables rawManifests
➖	npm_signatures_verified	not_applicable	provenance is only evaluated when publishing an artifact

pass = ready · fail = blocks deployment · not_applicable = check does not apply

➖ 3 check(s) not applicable: stateful_policy_declared, raw_manifests_guarded, npm_signatures_verified

---

Updated by deploy-check on push to this PR.