ci: bump the all-docker-dependencies group across 8 directories with 3 updates

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the all-docker-dependencies group with 2 updates in the /.pipelines/build/dockerfiles directory: oss/v2/fluent/fluent-bit and windows/servercore.
Bumps the all-docker-dependencies group with 1 update in the /azure-ip-masq-merger directory: oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 1 update in the /azure-ipam directory: oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 1 update in the /azure-iptables-monitor directory: oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 1 update in the /bpf-prog/ipv6-hp-bpf directory: oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 2 updates in the /cilium-log-collector directory: oss/v2/fluent/fluent-bit and oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 1 update in the /cni directory: oss/go/microsoft/golang.
Bumps the all-docker-dependencies group with 1 update in the /cns directory: oss/go/microsoft/golang.

Updates oss/v2/fluent/fluent-bit from v4.2.3-16 to v4.2.3-18

Updates windows/servercore from 3a2a2fd to 76cf422

Updates oss/v2/fluent/fluent-bit from v4.2.3-16 to v4.2.3-18

Updates oss/go/microsoft/golang from 829285f to 9f6b5c4

Updates oss/go/microsoft/golang from 829285f to 9f6b5c4

Updates oss/go/microsoft/golang from 829285f to 9f6b5c4

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/go/microsoft/golang from 1.26.7 to 1.26.8-1

Updates oss/v2/fluent/fluent-bit from v4.2.3-16 to v4.2.3-18

Updates oss/go/microsoft/golang from 829285f to 9f6b5c4

Updates oss/v2/fluent/fluent-bit from v4.2.3-16 to v4.2.3-18

Updates oss/go/microsoft/golang from 829285f to 9f6b5c4

Updates oss/go/microsoft/golang from 829285f to 9f6b5c4

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

The changes are straightforward base-image pin updates with no behavioral code changes, with only a minor Dockerfile comment inconsistency noted for follow-up.

Pull request overview

Updates pinned container base images used by ACN component builds and pipeline Dockerfiles to pick up the latest published digests/tags for the same toolchain generation.

Changes:

• Bump MS Go builder image digest for mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0 across multiple component Dockerfiles.
• Update bpf-prog/ipv6-hp-bpf to use mcr.microsoft.com/oss/go/microsoft/golang:1.26.8-1@sha... (tag + digest).
• Bump Fluent Bit runtime image to mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.3-18 and update Windows servercore:ltsc2022 digest used in the pipeline build Dockerfile.

File summaries

File	Description
cns/Dockerfile	Updates MS Go builder image digest used to build CNS binaries.
cni/Dockerfile	Updates MS Go builder image digest used to build CNI binaries.
cilium-log-collector/Dockerfile	Updates MS Go builder digest and Fluent Bit runtime tag for the log collector plugin image.
bpf-prog/ipv6-hp-bpf/linux.Dockerfile	Bumps MS Go image tag+digest used for building the ipv6-hp-bpf artifact.
azure-iptables-monitor/Dockerfile	Updates MS Go builder image digest for the iptables-monitor build stages.
azure-ipam/Dockerfile	Updates MS Go builder image digest for the azure-ipam build stages.
azure-ip-masq-merger/Dockerfile	Updates MS Go builder image digest for the ip-masq-merger build stage.
.pipelines/build/dockerfiles/npm.Dockerfile	Updates Windows servercore:ltsc2022 digest for pipeline packaging.
.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile	Updates Fluent Bit runtime tag used in the pipeline artifact packaging image.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The Fluent Bit version was updated in autogenerated Dockerfiles but the corresponding .Dockerfile.tmpl sources still reference the old version, so regeneration/CI may revert or fail consistency checks.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

bpf-prog/ipv6-hp-bpf/linux.Dockerfile:4

• The helper comment for resolving the Go image digest still references 1.26.7, but the FROM line now uses 1.26.8-1. This makes the instructions misleading when updating the digest in the future.

# IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.26.7
# echo "${IMG}@$(skopeo inspect docker://${IMG} --format '{{.Digest}}')"
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26.8-1@sha256:ba131ad163f2058687b1849aba44fab3e61e4d9fef758bd772c3ac597dc57c19 AS go

• Files reviewed: 9/9 changed files
• Comments generated: 2
• Review effort level: Lite

[Evan Baker (rbtr)]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

🔵 Needs a closer look

The Fluent Bit version bump was applied to generated Dockerfiles but not to their source .Dockerfile.tmpl templates, so regeneration (make dockerfiles) is likely to revert the update.

Review details

Suppressed comments (3)

.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile:5

• This file is autogenerated from .pipelines/build/dockerfiles/cilium-log-collector.Dockerfile.tmpl, but that template still pins fluent-bit v4.2.3-16. Regeneration will likely revert this change unless the template is updated as well.

FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.3-18 as linux

bpf-prog/ipv6-hp-bpf/linux.Dockerfile:4

• The helper comment above the base image reference still points to Go 1.26.7, but the Dockerfile now pins 1.26.8-1. This makes the skopeo-inspect instructions misleading when someone refreshes the digest later.

# IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.26.7
# echo "${IMG}@$(skopeo inspect docker://${IMG} --format '{{.Digest}}')"
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26.8-1@sha256:1a08ffa20128fcb5003fc5ee7423b76ff7c1664899e2b4cbca7a758fae09577c AS go

cilium-log-collector/Dockerfile:16

• This Dockerfile is marked as autogenerated (see header) but the source template still references fluent-bit v4.2.3-16; regenerating via make dockerfiles will likely revert this file back to -16. Update cilium-log-collector/Dockerfile.tmpl (and regenerate) so the committed output stays consistent with the template.

FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.3-18 as linux

• Files reviewed: 9/9 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The cilium-log-collector generated Dockerfiles were updated but their source templates still reference the older Fluent Bit tag, so regeneration will likely revert changes and fail the Dockerfile sync check.

Review details

Suppressed comments (3)

cilium-log-collector/Dockerfile:16

• This file is marked as autogenerated from cilium-log-collector/Dockerfile.tmpl, but the template still references fluent-bit v4.2.3-16, so the next make dockerfiles run will revert this change and likely fail the Dockerfile regeneration check. Update the template(s) to v4.2.3-18 as well.

FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.3-18 as linux

.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile:5

• This file is marked as autogenerated from .pipelines/build/dockerfiles/cilium-log-collector.Dockerfile.tmpl, but that template still uses fluent-bit v4.2.3-16; regeneration will undo this update. Please bump the template to v4.2.3-18 to keep generated output stable.

FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.3-18 as linux

bpf-prog/ipv6-hp-bpf/linux.Dockerfile:4

• The helper comment above the pinned Go builder image still says 1.26.7, but the actual image was bumped to 1.26.8-1. Updating the comment avoids confusion when re-resolving the digest later.

# IMG=mcr.microsoft.com/oss/go/microsoft/golang:1.26.7
# echo "${IMG}@$(skopeo inspect docker://${IMG} --format '{{.Digest}}')"
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26.8-1@sha256:2deab8229e22cf236b94e8f2a18fdca8b1c70009ab31660bfc400c4cd6922529 AS go

• Files reviewed: 9/9 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Five moderate review findings remain unresolved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (4)

.pipelines/build/dockerfiles/cilium-log-collector.Dockerfile:5

• This rendered pipeline Dockerfile is sourced from .pipelines/build/dockerfiles/cilium-log-collector.Dockerfile.tmpl, which still specifies fluent-bit:v4.2.3-16. The next make dockerfiles run will revert this v4.2.3-18 pin and fail the generated-file check; update the template and regenerate the artifact.

FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.3-18 as linux

bpf-prog/ipv6-hp-bpf/linux.Dockerfile:4

• This patch bump is not propagated to the other plain Go image consumers: npm/linux.Dockerfile and npm/windows.Dockerfile still use mcr.microsoft.com/oss/go/microsoft/golang:1.26.7. Those are active NPM build paths, so the NPM artifacts will continue to be built with the old toolchain while this image uses 1.26.8-1; update both files consistently.

FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26.8-1@sha256:2deab8229e22cf236b94e8f2a18fdca8b1c70009ab31660bfc400c4cd6922529 AS go

cilium-log-collector/Dockerfile:16

• This rendered Dockerfile is sourced from cilium-log-collector/Dockerfile.tmpl, but that template still specifies fluent-bit:v4.2.3-16. Running make dockerfiles will overwrite this v4.2.3-18 change and the base-image consistency workflow will fail; update the template and regenerate the rendered file.

FROM mcr.microsoft.com/oss/v2/fluent/fluent-bit:v4.2.3-18 as linux

cns/Dockerfile:8

• The generated pins here now use digest 9f6b5c4…, but .pipelines/build/scripts/install-go.sh still hardcodes the old Azure Linux fallback digest 8f638b0…. If source-image parsing falls back, the pipeline installs a stale Go image; the Go version-check workflow also treats this digest mismatch as drift. Update DEFAULT_IMAGE to the new digest.

FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang:1.26-azurelinux3.0@sha256:9f6b5c480db643ca536db638fc0346b5a8424fd738c916db5db6443e68ad130e AS go

• Files reviewed: 9/9 changed files
• Comments generated: 2
• Review effort level: Lite