[privateip]

Fixes #1158.

The debug image's base used an unpinned tag, so two builds of one commit could differ. It's now pinned to a tag and digest, the same image the floating tag resolves to today, so the built image doesn't change. The image also drops two tools that never worked from a node debug pod, and the README says which and why.

Test plan

• docker build of the image succeeds
• the tools the image keeps are on PATH in the built image
• kubectl and bpftrace are absent from the built image
• task lint passes

[privateip]

Two review passes agreed on this PR.

First pass: pr-adversary said merge. It ran the diff, gh pr checks, greps for kubectl, bpftrace and galactic-debug, a check of renovate.json, and a probe of the pinned base image. pr-conventions-reviewer said hold over PR body length, identifiers and test-plan format, plus two comment and README nits. Both reviewers questioned the base digest. The author confirmed with docker buildx imagetools inspect that nicolaka/netshoot v0.16 and latest resolve to the same digest, and built and smoke-tested the image locally.

Fix commit 7eaa081 removed the Dockerfile comment and the duplicate README line, and the PR body was rewritten.

Second pass: pr-rereviewer said merge, all five findings fixed. It ran the fix diff, git log --show-signature and gh pr view. pr-conventions-reviewer said merge with one nit, which was applied to the PR body. It ran gh pr view, the diff, an open-PR overlap check, greps for dangling references and a check of renovate.json.

CI on 7eaa081 is green. Unit Tests (root) hit two unrelated netlink-test flakes (TestListVRFLinks_SurvivesLinkChurn, then TestLister_ListsTheHandlesNamespace) before passing on the second re-run.

Auto-merge is enabled with the merge method, the only one the ruleset allows. The ruleset requires one approving review, a code owner review and approval of the last push, so it waits for a human approval.

[polylane]

Warning

Polylane could not verify the production impact of this pull request.

This repository deploys to no production resources Polylane knows about and the workspace has no connected cloud accounts or observability integrations, so there is nothing to check this change against.

Polylane has no cloud accounts connected for this workspace, so it cannot see what this repository deploys to. Connect a cloud and every pull request will be checked against your production resources.

_{Polylane analysed 7eaa081 for production impact. You can ask follow-ups by mentioning @polylane in a comment.}

Rate this review: 👍 helpful · 👎 not helpful · 😕 confusing

[ecv]

Approve.

Checked against Docker Hub at 7eaa081: v0.16 and latest both resolve to sha256:b09d9b21...48e70, the digest the PR pins, so the built image keeps its base. CI is green.

• Renovate's dockerfile manager updates tag@digest pins, and the existing "Docker images" group in .github/renovate.json covers it, so the new pin gets update PRs.
• No infra doc, skill or bin script on main calls kubectl or bpftrace inside galactic-debug, so no runbook breaks today.

Follow-ups:

• infra#7842 (move rx-queue-stall and runbooks onto galactic-debug) is still open. Its runbooks must run kubectl from the workstation, since the image no longer has it.