[xuwei-fit2cloud]

Summary

• Build the runtime base in one docker buildx build invocation. Its pg-base stage starts from postgres:17-bookworm, updates inherited Debian packages, and installs pgvector. The PostgreSQL 17 data layout is preserved.
• Fix the shared graphics libraries in the runtime base. Backport the HarfBuzz fix and disable the unused system TIFF loader. Build Canvas and the PostgreSQL and SQL Server drivers against runtime libraries, and take the Dameng TLS libraries from its wheel.
• Update the online standalone Compose fallback to v5.7.0. Offline package contents are controlled separately by the existing packaging workflow.

Validation

• Rebuilt the AMD64 runtime base and application. The runtime base's platform image digest matched the previously verified build.
• Verified the upgrade with a PostgreSQL 17.6 data volume, including pgvector queries and collation compatibility. The application returned HTTP 200, both PostgreSQL drivers queried pgvector, MCP listed seven tools, and MCP served the generated 1280 × 960 PNG. Pillow TIFF read/write also passed.
• Compared the final AMD64 image inventory with the original remediation checklist. The 70 Debian package entries met their recorded fixed versions. Verified the HarfBuzz backport and removal of the system TIFF loader.
• The base Dockerfile passed the AMD64/ARM64 build checks. The runtime checks above were run on AMD64.
• Both Compose downloads matched their official release digests and reported 5.7.0 in Linux containers.

Build and publish the runtime base first. The application workflow accepts its tag or digest through the optional runtimeBaseImage input.