Is your feature request related to a problem? Please describe.

Self-hosted operators inside a FedRAMP boundary must run task code on a FIPS-validated cryptographic module (NIST SC-13). For Node, that means building on a FIPS base image such as Chainguard node-fips. Stock Node statically links OpenSSL and can't run in FIPS mode.

The deploy base image is hard-pinned per runtime in BASE_IMAGE and BUILD_IMAGE. Build extensions can't replace it. Today the only option is to yarn patch the CLI.

#5002 proposes a per-project trigger.config.ts option. That would expose the setting to every Cloud user, and the Cloud team would then have to support arbitrary base images and would lose the shared-layer caching from #4602. This issue proposes an instance-operator setting instead.

Describe the solution you'd like to see

A webapp setting that only self-hosted operators can set. Cloud never sets it, so nothing changes there.

DEPLOY_BASE_IMAGES="node-26=registry.example.com/node-fips:26@sha256:..."
DEPLOY_BUILD_BASE_IMAGES="node-26=registry.example.com/node:26-dev@sha256:..."  # optional

1. The webapp returns baseImages for the deployment's runtime in the initialize-deployment response, next to the existing imagePlatform and externalBuildData.
2. The CLI rewrites the generated Containerfile to build on those images. Runtimes without an entry keep the published bases.
3. Docs describe what a base image must provide: node at the runtime's major version, the DEFAULT_PACKAGES, a node user, and glibc. They also note that the apt-based extensions assume Debian.

Because the operator sets the base on the server, it applies to every deploy to the instance regardless of project config. For compliance, that is stronger than relying on each project to opt in.

Describe alternate solutions

• Per-project build.image.base in trigger.config.ts (feat: allow overriding the deploy base image per runtime (FIPS / hardened bases) #5002 / feat(cli): allow overriding the deploy base images per project #5003). It's simpler, but it exposes the option to Cloud users.
• yarn patch the BASE_IMAGE constant. It works, but has to be redone on every CLI release.
• Swap the base with image.instructions, or rewrite the image after push. Neither works: instructions run inside FROM base, and finalize records the digest before anything could change it.

Additional information

• Draft implementation: see the linked PR. It reuses the existing initialize-deployment round trip, and the CLI only rewrites the Containerfile when the server sends baseImages.
• Related: feat: allow overriding the deploy base image per runtime (FIPS / hardened bases) #5002 (per-project alternative), feat: Allow injecting ca cert in project #1210 (self-hoster who needed a CA-cert hook and patched CLI internals), feat(cli): build deployment images on prebuilt base images #4602 (introduced the pinned prebuilt bases).
• This applies to any regulated self-hoster (FedRAMP, DoD IL, HIPAA/PCI hardening, internal golden images).