chore: replace tini with catatonit for EC compliance

Containerfile

@@ -47,6 +47,11 @@ RUN if [ -f /cachi2/cachi2.env ]; then \
 # ---------------------------------------------------------------------------
 FROM registry.redhat.io/openshift4/ose-cli-rhel9:v4.21 AS origincli
 
+# ---------------------------------------------------------------------------
+# podman stage: provides catatonit init binary
+# ---------------------------------------------------------------------------
+FROM registry.redhat.io/ubi9/podman:9.8 AS podman
+
 # ---------------------------------------------------------------------------
 # Runtime stage: minimal image with only what the agent needs
 # ---------------------------------------------------------------------------
@@ -58,14 +63,9 @@ WORKDIR /app
 # System packages (resolved from rpms.in.yaml via rpm prefetch).
 # Split into functional groups for readability.
 
-# EPEL repo + GPG key (tini lives in EPEL; cachi2 overrides this in hermetic builds)
-COPY epel.repo /etc/yum.repos.d/epel.repo
-COPY RPM-GPG-KEY-EPEL-9 /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-9
-RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-9
-
-# Claude Code SDK requirements + container init
+# Claude Code SDK requirements
 RUN dnf install -y --nodocs \
-    bash git wget jq tini \
+    bash git wget jq \
     && dnf clean all
 
 # SRE debugging toolkit
@@ -95,6 +95,9 @@ RUN ln -s /app/node_modules/@anthropic-ai/claude-code/bin/claude.exe /usr/local/
 COPY --from=origincli /usr/bin/oc /usr/bin/oc
 RUN ln -s /usr/bin/oc /usr/bin/kubectl
 
+# catatonit init binary from the podman stage
+COPY --from=podman /usr/libexec/podman/catatonit /usr/bin/catatonit
+
 # Install generic-fetched binaries (ripgrep).
 # In hermetic builds these are at /cachi2/output/deps/generic/.
 # In non-hermetic builds fall back to fetching from the network.
@@ -132,7 +135,7 @@ USER 1001:1001
 
 EXPOSE 8080
 
-ENTRYPOINT ["/usr/bin/tini", "--"]
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["python3.12", "-m", "uvicorn", "lightspeed_agentic.app:app", "--host", "0.0.0.0", "--port", "8080"]
 
 LABEL name="lightspeed-agentic-sandbox" \

rpms.in.yaml

@@ -22,7 +22,6 @@ packages:
   - gzip
   - python3.12
   - python3.12-pip
-  - tini
 contentOrigin:
-  repofiles: ["./ubi.repo", "./epel.repo"]
+  repofiles: ["./ubi.repo"]
 arches: [x86_64, aarch64]

rpms.lock.yaml

@@ -4,13 +4,6 @@ lockfileVendor: redhat
 arches:
 - arch: aarch64
   packages:
-  - url: http://ftp.iij.ad.jp/pub/linux/Fedora/epel/9/Everything/aarch64/Packages/t/tini-0.19.0-5.el9.aarch64.rpm
-    repoid: epel
-    size: 22568
-    checksum: sha256:486454b6e2e84c96850a12038b5e70348bb85da0266332e203acd967fd91db90
-    name: tini
-    evr: 0.19.0-5.el9
-    sourcerpm: tini-0.19.0-5.el9.src.rpm
   - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/appstream/os/Packages/b/bind-libs-9.16.23-34.el9_7.2.aarch64.rpm
     repoid: ubi-9-for-aarch64-appstream-rpms
     size: 1258934
@@ -1135,13 +1128,6 @@ arches:
   module_metadata: []
 - arch: x86_64
   packages:
-  - url: http://ftp.iij.ad.jp/pub/linux/Fedora/epel/9/Everything/x86_64/Packages/t/tini-0.19.0-5.el9.x86_64.rpm
-    repoid: epel
-    size: 22793
-    checksum: sha256:1cedbdf9afa27bf03ee70681ff9b8bd68d681a48050d6d35d69014964f90ce2b
-    name: tini
-    evr: 0.19.0-5.el9
-    sourcerpm: tini-0.19.0-5.el9.src.rpm
   - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/b/bind-libs-9.16.23-34.el9_7.2.x86_64.rpm
     repoid: ubi-9-for-x86_64-appstream-rpms
     size: 1308196