[mrrobot47]

Applies pending Alpine updates when the cron image is built.

mcuadros/ofelia:0.3.22 (2026-04-11) is still the latest stable ofelia release (0.4.0 is in beta), and its image hasn't been rebuilt since, so the Alpine base is stuck at 3.23.3. Our Dockerfile only adds labels, which is why every rebuild of easyengine/cron since v4.11.0 has had the same content. apk upgrade brings the base to Alpine 3.23.7: libcrypto3/libssl3 3.5.5 → 3.5.9, musl 1.2.5-r21 → r24, zlib 1.3.1 → 1.3.2, ca-certificates 20251003 → 20261020, tzdata 2026a → 2026e, plus apk-tools and alpine-baselayout. The ofelia binary, entrypoint and command are unchanged.

The image grows from 39 MB to 53 MB, since the upgraded files land in a new layer.

Testing

• Built locally and on GitHub Actions; apk list -u in the built image is empty.
• A job-local job (@every 2s) runs and finishes with failed: false, with no errors in the log.
• On the CI runner, with the Docker socket mounted the way EasyEngine runs the scheduler, a job-exec job runs its command in a sibling container every 2 s (StdOut: exec-ok).

[Copilot]

🟢 Approval recommended

The change is narrowly scoped, has no identified blocking issues, and includes reported build and scheduler smoke-test validation.

No open issues 🎉

What changed in this PR

Updates the cron image’s Alpine packages during image builds while leaving Ofelia’s binary, entrypoint, and command unchanged.

Changes:

• Adds RUN apk upgrade --no-cache to apply available Alpine package updates.
• Documents why updates are needed between upstream Ofelia releases.

File	Description
cron/​Dockerfile	Applies Alpine package updates and explains the upstream rebuild limitation.

_{Review effort: Balanced}