[whg517]

Summary

Add foundational universal container process management to kubedoop-base in an isolated worktree based on upstream/main (52ae321). Keep the UBI root USER, working directory, default Bash CMD/stdin, uid/gid 1001, product versions and downstream build graph unchanged.

• Checksum-pin Tini 0.19.0 for native amd64/arm64 and install setsid. Supervise the foreground command's owned process group, preserve actual application status, drain descendants before post-hooks, escalate TERM to bounded KILL, and reap orphans.
• Run sorted, root-owned executable pre/post hooks including projected-volume symlinks. Isolate hook stdin/discovery descriptors, fail startup on pre-hook/discovery errors, preserve application status on post-hook failure, and keep diagnostics off stdout without logging command arguments.
• Protect helpers under /usr/local/libexec/kubedoop-base, outside legacy downstream /kubedoop COPY/chown trees. Child CMD overrides inherit supervision; explicit child ENTRYPOINT overrides replace it without nesting supervisors. Docker RUN remains unaffected.
• Add native amd64/arm64 source, image and inheritance regressions to this product's workflow and correct its tag-pattern syntax. No other product implementation or shared build infrastructure is changed.

Local verification (amd64, passed)

Built the original generated Bake graph with local loading and cache export disabled, without pushing images or substituting prebuilt product images:

• kubedoop-base 1.0.0;
• all 14 direct-child versions: helloworld 1.0.0, tools 1.0.0, Vector 0.47.0, Go 1.26.0/1.25.8/1.24.13/1.23.12, JDK 8/11/17/21/22/23/24;
• ZooKeeper 3.9.3 and its original full 20-module Maven source build (BUILD SUCCESS).

Verification completed with exit 0:

• Source behavioral suite as both ordinary user and root, including genuine 7/127/130/142/143 statuses, repeated shutdown signals, descendant draining and timeout escalation. Packaging-path assertions cover Dockerfile installation versus launcher library loading.
• Generic image suite: exact current-source hashes, actual root/default Bash/stdin/clean stdout, protected HOME/helper layout, Tini PID1/adopted orphan, projected hooks, hook failures, TERM/INT and forced shutdown, credential-safe diagnostics.
• Inherited child fixture as uid 1001 and root: three starts of the same container using TERM/INT/docker stop, persistent state, status 42 and exactly-once flush-before-post ordering, despite conflicting legacy entrypoint files; explicit child ENTRYPOINT override also passes.
• Every original direct-child version: exact inherited helper hashes, default Bash/UID and native jq/yq/kubectl, Vector, Go, java/javac behavior as applicable.
• Original source-built ZooKeeper: real foreground JVM startup, native znode creation/read after same-container restart, graceful status 143 without forced KILL.
• Bash syntax, ShellCheck with shared-library/deferred-fixture exclusions, actionlint and staged diff checks. The organization gate reports no applicable Makefile targets for this containers repo; actual image/source checks above are the acceptance evidence.

Functional review found and fixed a private-library path mismatch before commit, reproduced the rejected candidate's startup failure, added packaging-path regression coverage, and rebuilt/retested the complete graph. No known actionable review findings remain.

Scope and CI gate

This is generic foreground supervision. Applications needing specialized graceful-shutdown policies may override the launcher/ENTRYPOINT; detached or setsid-escaping processes are outside this contract. Independent SDK toolchain fixes remain in their own PRs.

Framework feedback: image-side Bash lifecycle belongs in containers, not operator-go; no operator-go defect was exposed. No merge or release is requested. Native amd64/arm64 CI for all 18 path-affected product workflows must pass this exact PR HEAD before the rollout advances; local success is not a claim of remote CI success.