[jackharrhy]

Summary

• Use node-caged Debian/glibc base; keep the real entrypoint ownership repair, non-root privilege drop, migration-before-boot sequence, optional seed behavior, Remix loader and publishing tags/triggers unchanged.
• Move existing source checks to Node 26 and add a small repository-owned built-image runtime check (no external shared framework).

Actual validation

• docker build --progress=plain -t node-caged-rollout/stickertrade:26 .
• sh scripts/check-runtime.sh node-caged-rollout/stickertrade:26
• Runtime asserts Node v26.12.1 and v8_enable_pointer_compression = 1.
• Default entrypoint migrates an empty disposable database and boots. SQLite write/read, migration replay, sharp PNG round-trip and GET /, /login, /stickers, /assets/app/assets/entry.ts all pass (200). Typecheck and all 117 tests pass under node-caged Node 26.
• mise exec shellcheck@0.11.0 -- uvx --from jactionlint==2.3.0 jactionlint --strict-exit and ShellCheck for the new script passed.

Runtime probes use --network none, ephemeral container filesystems/tmpfs, no published ports, no host production data or secrets. Dependency installation/builds use package registries; no production application calls were made.

Base tested: platformatic/node-caged:26-slim digest sha256:7e05b71d1249f733b465bc3abc6b3e5854f183d2837bdd264f40b94947b9e6fc (linux/amd64). Other architectures were not tested locally.

Rollout boundary

Review only: not merged, not deployed. Existing publisher triggers/tags remain unchanged. Gate the automatic updater before any eventual publisher merge; the rollout owner handles production separately. Existing dependency audit findings are not addressed by this runtime-only change.