diff --git a/.tekton/on-cm-runner.yaml b/.tekton/on-cm-runner.yaml index 5a22261b8..bcbee4ce9 100644 --- a/.tekton/on-cm-runner.yaml +++ b/.tekton/on-cm-runner.yaml @@ -62,7 +62,7 @@ spec: type: string steps: - name: parse-eval-flag - image: registry.redhat.io/ubi9/ubi-micro:latest + image: registry.redhat.io/ubi10/ubi-micro:10.2-1787684489 env: - name: TRIGGER_COMMENT value: $(params.TRIGGER_COMMENT) @@ -339,7 +339,7 @@ spec: - name: otel-config-volume mountPath: /etc/otelcol-contrib/ - name: trace-collector - image: registry.access.redhat.com/ubi9/python-312:9.6 + image: registry.access.redhat.com/ubi10/python-312-minimal:10.2-1788165617 volumeMounts: - name: openshift-service-ca mountPath: /app/certs diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml index bcc49a183..cadc08a85 100644 --- a/.tekton/on-pull-request.yaml +++ b/.tekton/on-pull-request.yaml @@ -72,7 +72,7 @@ spec: type: string steps: - name: read-eval-toggle - image: registry.redhat.io/ubi9/ubi-micro:latest + image: registry.redhat.io/ubi10/ubi-micro:10.2-1787684489 env: - name: POST_INTEGRATION_EVAL_ENABLED valueFrom: @@ -171,7 +171,7 @@ spec: - name: unit-test-cache steps: - name: setup-cache-link - image: registry.redhat.io/ubi9/ubi-micro:latest + image: registry.redhat.io/ubi10/ubi-micro:10.2-1787684489 workingDir: $(workspaces.source.path) script: | #!/bin/bash @@ -205,7 +205,7 @@ spec: volumeMounts: - name: $(workspaces.unit-test-cache.volume) mountPath: /exploit-iq-data - image: registry.access.redhat.com/ubi9/ubi-minimal:9.8 + image: registry.access.redhat.com/ubi10/ubi:1780550950 workingDir: $(workspaces.source.path) script: | #!/bin/bash @@ -216,9 +216,9 @@ spec: echo "----------- ${1} -----------" } - # ubi-minimal has no dev tools — install the essentials + # Full UBI ships dnf and shadow-utils; install the dev tools needed for the build. print_banner "Installing system packages" - microdnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic + dnf install -y git tar gzip findutils make gcc gcc-c++ krb5-devel bsdtar xz libatomic # Install Node.js 26.5.0 manually print_banner "Installing Node.js 26.5.0" @@ -524,7 +524,7 @@ spec: - name: otel-config-volume mountPath: /etc/otelcol-contrib/ - name: trace-collector - image: registry.access.redhat.com/ubi9/python-312:9.6 + image: registry.access.redhat.com/ubi10/python-312-minimal:10.2-1788165617 volumeMounts: - name: openshift-service-ca mountPath: /app/certs diff --git a/.tekton/on-tag.yaml b/.tekton/on-tag.yaml index c8721f1c1..dc152f655 100644 --- a/.tekton/on-tag.yaml +++ b/.tekton/on-tag.yaml @@ -89,7 +89,7 @@ spec: - name: target-image steps: - name: format-image - image: registry.redhat.io/ubi9/ubi-minimal:9.4 + image: registry.redhat.io/ubi10/ubi-minimal:10.2-1788137716 script: | #!/usr/bin/env bash IMAGE="$(params.image_name):$(echo $(params.tag_name) | sed 's|refs/tags/||')" diff --git a/Dockerfile b/Dockerfile index 78ae1a8f6..e23ff4dab 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,13 +13,17 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG BASE_IMAGE_URL=registry.redhat.io/ubi9/ubi -ARG BASE_IMAGE_TAG=9.8-1782841664 +ARG BASE_IMAGE_URL=registry.redhat.io/ubi10/ubi +ARG BASE_IMAGE_TAG=1780550950 ARG PYTHON_VERSION=3.12 # Specified on the command line with --build-arg VULN_ANALYSIS_VERSION=$(python -m setuptools_scm) ARG VULN_ANALYSIS_VERSION=2.0.0 +# Go toolchain source: Red Hat go-toolset (UBI 10). Its GOROOT (/usr/lib/golang, Go 1.24.6) +# is copied into the runtime image below, replacing the previous go.dev download. +FROM registry.redhat.io/ubi10/go-toolset:1.24-1763548447 AS go-builder + FROM ${BASE_IMAGE_URL}:${BASE_IMAGE_TAG} AS base COPY --from=ghcr.io/astral-sh/uv:0.7.15 /uv /uvx /bin/ ARG VULN_ANALYSIS_VERSION @@ -50,9 +54,9 @@ RUN dnf install -y --nodocs \ && update-ca-trust -RUN curl -L -X GET https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go1.24.1.linux-amd64.tar.gz \ - && tar -C /usr/local -xzf /tmp/go1.24.1.linux-amd64.tar.gz \ - && rm /tmp/go1.24.1.linux-amd64.tar.gz +# Go toolchain from Red Hat go-toolset (was: go.dev download of go1.24.1). GOROOT is /usr/lib/golang +# in the builder; copying it to /usr/local/go keeps the existing PATH entry (/usr/local/go/bin) valid. +COPY --from=go-builder /usr/lib/golang /usr/local/go ENV GOTOOLCHAIN=auto diff --git a/kustomize/base/nginx.yaml b/kustomize/base/nginx.yaml index 616a52e7e..3ac316df0 100644 --- a/kustomize/base/nginx.yaml +++ b/kustomize/base/nginx.yaml @@ -22,7 +22,7 @@ spec: imagePullSecrets: [] initContainers: - name: render-nginx-config - image: registry.redhat.io/ubi9/python-312@sha256:55ddb67dcfc6c7ec072fce58753910b290c2903b10cd71d0d64c631d44ef4ab0 + image: registry.redhat.io/ubi10/python-312-minimal:10.2-1788165617 command: ["python3", "-c"] args: - | @@ -89,8 +89,11 @@ spec: mountPath: /generated containers: - name: nginx - image: registry.access.redhat.com/hi/nginx:1.30.3 + image: registry.access.redhat.com/ubi10/nginx-126:10.2-1788242896 imagePullPolicy: IfNotPresent + # The UBI 10 nginx s2i image's default command only prints usage; start nginx directly + # against the mounted /etc/nginx/nginx.conf (binary at /usr/sbin/nginx). + command: ["nginx", "-g", "daemon off;"] ports: - name: http protocol: TCP