chore: preinstall linux acceptance deps in build image

[danskmt]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages are release-note ready, emphasizing what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Adds docker.io, xdg-utils, and uv to .circleci/Dockerfile so Linux acceptance jobs can rely on the build image instead of installing these during CircleCI. Does not change install-deps-linux-acceptance-tests or executor image tags yet — follow-up after Create Build Image publishes new tags.

Where should the reviewer start?

• .circleci/Dockerfile — apt packages and uv install for the circleci user

How should this be manually tested?

1. After merge, run Create Build Image (workflow_dispatch) and confirm amd64/arm64 images build.

What's the product update that needs to be communicated to CLI users?

None — internal CI image only.

Risk assessment

Low — slightly larger image and longer build; no CLI behavior change until executor tags are updated.

What are the relevant tickets?

CLI-1443

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 Security concerns The PR uses curl | sh to install uv from astral.sh. While common in CI, this pulls and executes an unverified remote script during the build process. If the domain or transport is compromised, malicious code could be injected into the build image.

⚡ Recommended focus areas for review Potential Path Mismatch 🟡 [minor] The uv installation script is executed via curl | sh. Depending on the active USER in the Dockerfile at this point, the script might install to /root/.local/bin or /home/circleci/.local/bin. If it installs to root's home but the PATH is updated for circleci, the utility will not be found by the user running the tests. Explicitly setting the installation target or ensuring the correct USER is active is safer. RUN curl -LsSf https://astral.sh/uv/install.sh | sh ENV PATH=/home/circleci/.local/bin:$PATH

📚 Repository Context Analyzed This review considered 5 relevant code sections from 3 files (average relevance: 0.73) CONTRIBUTING.md (3 segments, lines 387-464) scripts/create-build-image.sh (lines 1-81) dangerfile.js (lines 1-111)