fix(security): Enable ML_KEP capability

Dockerfile

@@ -12,11 +12,15 @@ RUN INSTALL_PKGS=" \
       llvm \
       cyrus-sasl-devel \
       libtool \
+      crypto-policies-scripts \
       " && \
     dnf install -y $INSTALL_PKGS && \
     rpm -V $INSTALL_PKGS && \
     dnf clean all
 
+# Enable post-quantum cryptography
+RUN update-crypto-policies --set DEFAULT:PQ
+
 ENV HOME=/root
 RUN curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.92.0 -y
 ENV CARGO_HOME=$HOME/.cargo
@@ -31,9 +35,12 @@ RUN PROTOC=/src/thirdparty/protoc/protoc-linux-$(arch) make build
 
 FROM registry.access.redhat.com/ubi9/ubi-minimal
 
-RUN microdnf install -y systemd tar && \
+RUN microdnf install -y systemd tar crypto-policies-scripts && \
     microdnf clean all
 
+# Copy PQ crypto-policies configuration from builder
+COPY --from=builder /etc/crypto-policies/ /etc/crypto-policies/
+
 COPY --from=builder /src/target/release/vector /usr/bin
 WORKDIR /usr/bin
 CMD ["/usr/bin/vector"]

Dockerfile.art

@@ -7,10 +7,14 @@ RUN INSTALL_PKGS=" \
       openssl-devel \
       llvm-toolset \
       rust-toolset-1.88.0 \
+      crypto-policies-scripts \
       " && \
     microdnf install -y $INSTALL_PKGS && \
     rpm -V $INSTALL_PKGS
 
+# Enable post-quantum cryptography
+RUN update-crypto-policies --set DEFAULT:PQ
+
 COPY . /opt/app-root/src
 WORKDIR /opt/app-root/src
 
@@ -21,7 +25,10 @@ RUN cp /opt/app-root/src/target/release/vector /usr/bin
 FROM registry.access.redhat.com/ubi9/ubi-minimal
 
 COPY --from=builder /usr/bin/vector /usr/bin/
-RUN microdnf install -y systemd
+RUN microdnf install -y systemd crypto-policies-scripts
+
+# Copy PQ crypto-policies configuration from builder
+COPY --from=builder /etc/crypto-policies/ /etc/crypto-policies/
 
 WORKDIR /usr/bin
 CMD ["/usr/bin/vector"]