the redirect URL is a localhost one with a random port, so there's no way I can interactively login from within a container.

Note that you can set

PULUMI_ACCESS_TOKEN

env var to provide the login information without need for interactive login. See https://pulumi.io/reference/cli/pulumi_login.html for details.