Dockerfile: bump base alpine image (#14604)

Bump the versions to pick up some CVE patches. They don't affect us, but
customer scanners will complain.

Updates #cleanup

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>

ALPINE.txt

@@ -1 +1 @@
-3.18
+3.21

Dockerfile

@@ -62,7 +62,7 @@ RUN GOARCH=$TARGETARCH go install -ldflags="\
       -X tailscale.com/version.gitCommitStamp=$VERSION_GIT_HASH" \
       -v ./cmd/tailscale ./cmd/tailscaled ./cmd/containerboot
 
-FROM alpine:3.18
+FROM alpine:3.21
 RUN apk add --no-cache ca-certificates iptables iproute2 ip6tables
 
 COPY --from=build-env /go/bin/* /usr/local/bin/

Dockerfile.base

@@ -1,5 +1,5 @@
 # Copyright (c) Tailscale Inc & AUTHORS
 # SPDX-License-Identifier: BSD-3-Clause
 
-FROM alpine:3.18
+FROM alpine:3.21
 RUN apk add --no-cache ca-certificates iptables iproute2 ip6tables iputils