- Switch Dockerfile from distroless/static to alpine:3.21 - Install openssh-client-default in runtime image - Mount SSH key in scheduler service (docker-compose) - Add NET_RAW capability for ping checks - Wire OIKOS_SSH_KEY_PATH and OIKOS_SSH_USER env vars in scheduler - sshExec uses configured key path with StrictHostKeyChecking=no