deploy: bump base images to Alpine 3.23

Move the build stage and final image to alpine 3.23 (current
stable, released 2025-12-03) so that a rebuild picks up:

- busybox 1.37.0-r20+ (addresses CVE-2024-58251, BusyBox netstat
  ANSI-escape DoS)
- Go 1.25.10 via golang:1.25-alpine3.23 (addresses CVE-2025-58183,
  archive/tar unbounded sparse-region allocation, fixed in 1.25.9)

Refs #3837

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

docker: fix nil pointer dereference when GraphDriver is nil

The migration to github.com/moby/moby modules in b20bcf1 changed
GraphDriver from a value type to a pointer type. This causes a nil
pointer dereference when Docker doesn't include GraphDriver in the
container inspect response (which can happen with certain storage
drivers or container configurations).

Add a nil check before accessing GraphDriver.Data and log a warning
at V(4) verbosity level when GraphDriver is not found.

Fixes #3815

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Update healthcheck.sh

docker: migrate to github.com/moby/moby modules

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

manager: fix race condition in Stop() using sync.Once

The switch from RWMutex to sync.Map in commit 20e39fc introduced a
race condition in destroyContainer(). When multiple goroutines attempt
to destroy the same container simultaneously, they can all call Stop()
on the same containerData, causing a "close of closed channel" panic.

The panic manifests as:
  panic: close of closed channel
  goroutine N [running]:
  github.com/google/cadvisor/manager.(*containerData).Stop(...)
          manager/container.go:143 +0x46

Fix this by using sync.Once to ensure the stop channel is only closed
once, making Stop() safe to call multiple times.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

add cpu burst metrics

container/docker: GetStats: prevent nil-pointer

stats can be nil if an error occurs during collecting

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

fix: handle nil Health state in docker container handler

Container.State.Health can be nil when no health check is configured.
Check for nil before accessing .Status to prevent panic.

Fixes nil pointer dereference in newDockerContainerHandler when
inspecting containers without health checks.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Use built-in error wrapping instead of pkg/errors (#3689)

github.com/pkg/errors is archived and unmaintained; this replaces that
as follows:
* instead of extracting the cause for os.IsNotExist, use errors.Is
  directly (which unwraps errors itself)
* wrap errors using fmt.Errorf (wrapped errors using pkg/errors add
  the error message after a colon, so this changes the format to
  match)
* errors.Wrapf is replaced with fmt.Errorf

Signed-off-by: Stephen Kitt <skitt@redhat.com>
Co-authored-by: Davanum Srinivas <davanum@gmail.com>

Make resctrl optional/pluggable

Signed-off-by: Davanum Srinivas <davanum@gmail.com>