fix: [NPM] [Backport] Update Ubuntu Base Image to 24.04

[rayaisaiah]

Reason for Change:
Backports #3741 from master branch.

Bumps the NPM Ubuntu base image version from 20.04 to 24.04 as 20.04 is EOL and no longer supported (https://ubuntu.com/blog/ubuntu-20-04-lts-end-of-life-standard-support-is-coming-to-an-end-heres-how-to-prepare).

Manually updates the Ubuntu packages libsystemd0 and libudev1 to 255.4-1ubuntu8.8 or else CVE-2025-4598 is present in the image (Will revert later when base image updates packages to resolve the vulnerability):

acnpublic.azurecr.io/azure-npm:v1.6.26Test (ubuntu 24.04)
=========================================================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0)

┌─────────────┬───────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────┐
│   Library   │ Vulnerability │ Severity │ Status │ Installed Version │  Fixed Version   │                        Title                         │
├─────────────┼───────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────┤
│ libsystemd0 │ CVE-2025-4598 │ MEDIUM   │ fixed  │ 255.4-1ubuntu8.6  │ 255.4-1ubuntu8.8 │ systemd-coredump: race condition that allows a local │
│             │               │          │        │                   │                  │ attacker to crash a SUID...                          │
│             │               │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-4598            │
├─────────────┤               │          │        │                   │                  │                                                      │
│ libudev1    │               │          │        │                   │                  │                                                      │
│             │               │          │        │                   │                  │                                                      │
│             │               │          │        │                   │                  │                                                      │
└─────────────┴───────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────┘

Trivy scan of NPM linux with changes to dockerfile (with manual package updates):

acnpublic.azurecr.io/azure-npm:v1.6.26Test2 (ubuntu 24.04)
==========================================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Tests Ran:

• Conformance
• Scale
• Cyclonus
• Cyclonus-Extended

Issue Fixed:

mcr.microsoft.com/containernetworking/azure-npm:v1.5.48 (ubuntu 20.04)
======================================================================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0)

┌──────────┬───────────────┬──────────┬────────┬───────────────────┬──────────────────┬───────────────────────────────────────────────────────────┐
│ Library  │ Vulnerability │ Severity │ Status │ Installed Version │  Fixed Version   │                           Title                           │
├──────────┼───────────────┼──────────┼────────┼───────────────────┼──────────────────┼───────────────────────────────────────────────────────────┤
│ libc-bin │ CVE-2025-4802 │ MEDIUM   │ fixed  │ 2.31-0ubuntu9.17  │ 2.31-0ubuntu9.18 │ glibc: static setuid binary dlopen may incorrectly search │
│          │               │          │        │                   │                  │ LD_LIBRARY_PATH                                           │
│          │               │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-4802                 │
├──────────┤               │          │        │                   │                  │                                                           │
│ libc6    │               │          │        │                   │                  │                                                           │
│          │               │          │        │                   │                  │                                                           │
│          │               │          │        │                   │                  │                                                           │
└──────────┴───────────────┴──────────┴────────┴───────────────────┴──────────────────┴───────────────────────────────────────────────────────────┘

usr/bin/azure-npm (gobinary)
============================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 1, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version  │                            Title                             │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2025-22874 │ HIGH     │ fixed  │ v1.23.9           │ 1.23.10, 1.24.4 │ crypto/x509: Usage of ExtKeyUsageAny disables policy         │
│         │                │          │        │                   │                 │ validation in crypto/x509                                    │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-22874                   │
│         ├────────────────┼──────────┤        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-0913  │ MEDIUM   │        │                   │                 │ Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows │
│         │                │          │        │                   │                 │ in os in syscall...                                          │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-0913                    │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-4673  │          │        │                   │                 │ Proxy-Authorization and Proxy-Authenticate headers persisted │
│         │                │          │        │                   │                 │ on cross- ...                                                │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2025-4673                    │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────────────┘

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:
Releasing from release/v1.6 branch instead of release/v1.5 due to Ubuntu base image update as well as v1.5 will be not be supported soon (due to k8s dependencies not matching with our offerings as it is tied to 1.27-1.29).

[Copilot]

Pull Request Overview

This PR backports updates to Ubuntu base image and manually pins certain Ubuntu packages to address known vulnerabilities.

• Upgrade Ubuntu base image from 20.04 to 24.04.
• Manually update libsystemd0 and libudev1 versions to address CVE-2025-4598.

Comments suppressed due to low confidence (2)

npm/linux.Dockerfile:9

• Consider adding an inline comment explaining the upgrade to Ubuntu 24.04 due to Ubuntu 20.04 reaching EOL, to help future maintainers understand the reason behind this change.

FROM mcr.microsoft.com/mirror/docker/library/ubuntu:24.04 as linux

npm/linux.Dockerfile:11

• Please add a brief comment explaining the manual version pinning for libsystemd0 and libudev1 (addressing CVE-2025-4598), which will enhance clarity for future reviews.

RUN apt-get update && apt-get install -y libsystemd0=255.4-1ubuntu8.8 libudev1=255.4-1ubuntu8.8 iptables ipset ca-certificates && apt-get autoremove -y && apt-get clean

[rayaisaiah]

/azp run Azure Container Networking PR

[rayaisaiah]

/azp run NPM Conformance Tests

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rayaisaiah]

/azp run NPM Scale Test

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).