fix(security): eMudhra CA distrust in game images and tailscale v1.104.2

containers/common/steamcmd/Dockerfile

@@ -60,7 +60,7 @@ ARG GAMESERVER_GID=10000
 # install is idempotent and cheap either way, so it stays as a safety net —
 # `apt-get install` on an already-installed package is a no-op.
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends ca-certificates=20260601~26.04.1 && \
+    apt-get install -y --no-install-recommends ca-certificates=20260816ubuntu0.26.04.1 && \
     rm -rf /var/lib/apt/lists/*
 
 # Copy the shared installation helper script.

containers/games/beammp/Dockerfile

@@ -1,19 +1,19 @@
-FROM alpine:3.20
+FROM alpine:3.24
 
 LABEL org.opencontainers.image.title="Gameplane BeamMP Dedicated Server" \
       org.opencontainers.image.description="Dedicated server container for BeamNG.drive (BeamMP) with diagnostic idle support for missing auth keys" \
       org.opencontainers.image.authors="Gameplane Maintainers" \
       org.opencontainers.image.source="https://github.com/GameplanePanel/Gameplane"
 
 RUN apk add --no-cache \
-    bash~=5.2.26 \
-    curl~=8.14.1 \
-    ca-certificates~=20260413 \
+    bash~=5.3.9 \
+    curl~=8.22.0 \
+    ca-certificates~=20261020 \
     tini~=0.19.0 \
-    procps~=4.0.4 \
-    libstdc++~=13.2.1_git20240309 \
-    libgcc~=13.2.1_git20240309 \
-    openssl~=3.3.7 \
+    procps-ng~=4.0.6 \
+    libstdc++~=15.2.0 \
+    libgcc~=15.2.0 \
+    openssl~=3.5.9 \
     zlib~=1.3.2
 
 # Create gameplane runtime user with fixed UID/GID 1000

containers/games/euro-truck-simulator-2/Dockerfile

@@ -12,7 +12,7 @@ RUN dpkg --add-architecture i386 && \
     apt-get install -y --no-install-recommends \
         bash=5.2.15-2+b13 \
         curl=7.88.1-10+deb12u15 \
-        ca-certificates=20250419~deb12u1 \
+        ca-certificates=20250419~deb12u2 \
         tini=0.19.0-1+b3 \
         procps=2:4.0.2-3 \
         lib32gcc-s1=12.2.0-14+deb12u1 \

containers/games/farming-simulator-25/Dockerfile

@@ -12,7 +12,7 @@ RUN dpkg --add-architecture i386 && \
     apt-get install -y --no-install-recommends \
         bash=5.2.15-2+b13 \
         curl=7.88.1-10+deb12u15 \
-        ca-certificates=20250419~deb12u1 \
+        ca-certificates=20250419~deb12u2 \
         tini=0.19.0-1+b3 \
         procps=2:4.0.2-3 \
         xvfb=2:21.1.7-3+deb12u13 \

containers/games/fivem/Dockerfile

@@ -1,23 +1,24 @@
-FROM alpine:3.20
+FROM alpine:3.24
 
 LABEL org.opencontainers.image.title="Gameplane FiveM Dedicated Server" \
       org.opencontainers.image.description="Dedicated server container for FiveM (GTA V MP) with txAdmin and embedded database supervision" \
       org.opencontainers.image.authors="Gameplane Maintainers" \
       org.opencontainers.image.source="https://github.com/GameplanePanel/Gameplane"
 
 RUN apk add --no-cache \
-    bash~=5.2.26 \
-    curl~=8.14.1 \
-    ca-certificates~=20260413 \
+    bash~=5.3.9 \
+    curl~=8.22.0 \
+    ca-certificates~=20261020 \
     tini~=0.19.0 \
-    procps~=4.0.4 \
-    libstdc++~=13.2.1_git20240309 \
-    libgcc~=13.2.1_git20240309 \
-    icu-libs~=74.2 \
-    mariadb~=10.11.18 \
-    mariadb-client~=10.11.18 \
-    sqlite~=3.45.3 \
-    tzdata~=2026b
+    procps-ng~=4.0.6 \
+    libstdc++~=15.2.0 \
+    libgcc~=15.2.0 \
+    icu-libs~=78.1 \
+    mariadb~=11.8.9 \
+    mariadb-client~=11.8.9 \
+    mariadb-server-utils~=11.8.9 \
+    sqlite~=3.53.4 \
+    tzdata~=2026e
 
 # Create gameplane runtime user with fixed UID/GID 1000
 RUN addgroup -g 1000 gameplane && \

containers/games/fivem/entrypoint.sh

@@ -70,6 +70,25 @@ if [ "${ENABLE_EMBEDDED_DB:-true}" = "true" ]; then
         fi
         sleep 0.5
     done
+    # A MariaDB major upgrade (10.11 -> 11.8 with the Alpine 3.24 base) leaves
+    # existing system tables on the old layout. mariadb-upgrade brings them
+    # current and is a no-op when they already are. mysql_install_db --user
+    # created gameplane@localhost with unix_socket auth, matching uid 1000.
+    # The socket can appear before MariaDB accepts authenticated connections,
+    # so retry briefly. A final failure only logs: the next start retries it.
+    if [ -S /tmp/mysql.sock ]; then
+        upgraded=false
+        for i in $(seq 1 10); do
+            if mariadb-upgrade --socket=/tmp/mysql.sock --user=gameplane >/dev/null 2>&1; then
+                upgraded=true
+                break
+            fi
+            sleep 1
+        done
+        if [ "$upgraded" != true ]; then
+            echo "[gameplane-fivem] mariadb-upgrade failed after 10 attempts; continuing with existing system tables"
+        fi
+    fi
 fi
 
 # Ensure txAdmin data directory exists

tunnel/Dockerfile.tailscale

@@ -27,7 +27,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \
 # Copy tailscale binaries from the official upstream image pinned by digest.
 # tailscale is distributed as official OCI images; pinning by digest
 # ensures reproducible builds. The image ships both tailscaled and tailscale CLI.
-FROM tailscale/tailscale:v1.104.1@sha256:87c55d6be56ad85b3d8bceca5f87f73de288c609131460dd1be1874c250cc41d AS tailscale-stage
+FROM tailscale/tailscale:v1.104.2@sha256:b11583ad2e93e4671128538c88cf11f460444a5d7e449311dd1933a400ab849d AS tailscale-stage
 
 FROM gcr.io/distroless/static:nonroot
 WORKDIR /

tunnel/specs.md

@@ -114,7 +114,7 @@ playit.gg assigns a tunnel's public address server-side, so the supervisor learn
 
 ### Tailscale Tag Application
 
-Tailscale ACL tags can only be requested when a device registers. tailscaled's declarative `--config` file has no field for them (see the `TAILSCALE_TAGS` row above). `tailscale set` has no `--advertise-tags` flag, and changing the tags of a registered node needs a fresh login. So when `TAILSCALE_TAGS` holds valid tags, the supervisor lets tailscaled start unauthenticated and registers it itself. Flags below are confirmed against tailscale v1.102.4, the version `Dockerfile.tailscale` ships.
+Tailscale ACL tags can only be requested when a device registers. tailscaled's declarative `--config` file has no field for them (see the `TAILSCALE_TAGS` row above). `tailscale set` has no `--advertise-tags` flag, and changing the tags of a registered node needs a fresh login. So when `TAILSCALE_TAGS` holds valid tags, the supervisor lets tailscaled start unauthenticated and registers it itself. Flags below are confirmed against tailscale v1.104.2, the version `Dockerfile.tailscale` ships.
 
 1. `renderTailscaleConfig` writes the config with `version`, `hostname` and `"locked": false`, and no `authKey`. The auth key goes to `/tmp/gameplane-tunnel-tailscale-authkey` (mode 0600). `locked` must be false: `ipn.ConfigVAlpha.Locked` defaults to true, and a locked config makes tailscaled reject every CLI prefs change.
 2. `tailscaled` is started as usual, with `--socket=/tmp/gameplane-tunnel-tailscaled.sock`. Its Linux default, `/run/tailscale/tailscaled.sock`, can't be created by the non-root distroless image; this is the same reasoning as `playitSocketPath`. The `tailscale` CLI, bundled in `Dockerfile.tailscale` alongside `tailscaled`, reaches it over the same socket via `--socket=`. With no auth key, tailscaled waits in `NeedsLogin`.