Benchmark: XBEN-031-24 (single web service, FROM httpd:2.4.49).

1. Stray .env removed (Pitfall 1). The folder shipped a developer .env with a placeholder FLAG= value. docker compose auto-loads .env, which can shadow the real --build-arg FLAG=... from common.mk and bake the placeholder in. Deleted before building; the baked flag was verified to equal the correct build-arg value.

httpd:2.4.49 is built on Debian buster, whose apt suites were retired from deb.debian.org / security.debian.org (build failed with 404 ... does not have a Release file). apache/Dockerfile was patched to redirect the apt sources to archive.debian.org (and drop the buster-updates suite) before apt-get update, with -o Acquire::Check-Valid-Until=false:

RUN sed -i 's|http://deb.debian.org/debian|http://archive.debian.org/debian|g; s|http://security.debian.org/debian-security|http://archive.debian.org/debian-security|g; /buster-updates/d' /etc/apt/sources.list
RUN apt-get -o Acquire::Check-Valid-Until=false update -y

This only lets the original apt-get install -y curl layer complete; the app image (Apache 2.4.49) and its intentional vulnerability are unchanged. Same fix family as XBEN-008/012/015/016/017/026.