From f4838e69aae9291bd813122bb4be4f39cd82d69a Mon Sep 17 00:00:00 2001 From: Theodor Mihalache Date: Tue, 1 Sep 2026 14:57:21 +0300 Subject: [PATCH] fix TC-5834 Signed-off-by: Theodor Mihalache Co-Authored-By: Claude Opus 4.8 (1M context) --- .dockerignore | 12 ++++++++++++ src/main/docker/Dockerfile.jvm | 2 +- src/main/docker/Dockerfile.legacy-jar | 2 +- src/main/docker/Dockerfile.native | 2 +- src/test/README.md | 9 ++++++++- src/test/docker/Dockerfile | 8 +++++--- 6 files changed, 28 insertions(+), 7 deletions(-) diff --git a/.dockerignore b/.dockerignore index 1d34cebb..3d0bd6aa 100644 --- a/.dockerignore +++ b/.dockerignore @@ -81,3 +81,15 @@ coverage/ *.temp .cache/ +# Allow local dev image builds to access Maven build output (target/ is excluded above). +# These negations re-include exactly what the dev Dockerfiles COPY from the build context: +# Dockerfile.native / Dockerfile.native-micro -> target/*-runner (native executable) +# Dockerfile.jvm -> target/quarkus-app/* +# Dockerfile.legacy-jar -> target/lib + target/*-runner.jar +# The shipped Dockerfile.multi-stage builds inside the container and copies none of these, +# so this only affects local dev builds (docker build -f src/main/docker/Dockerfile. ... .). +!target/*-runner +!target/*-runner.jar +!target/quarkus-app +!target/lib + diff --git a/src/main/docker/Dockerfile.jvm b/src/main/docker/Dockerfile.jvm index 1b2d120f..411e2561 100644 --- a/src/main/docker/Dockerfile.jvm +++ b/src/main/docker/Dockerfile.jvm @@ -77,7 +77,7 @@ # accessed directly. (example: "foo.example.com,bar.example.com") # ### -FROM registry.access.redhat.com/ubi8/openjdk-21:1.19 +FROM registry.access.redhat.com/ubi10/openjdk-21:1.24 ENV LANGUAGE='en_US:en' diff --git a/src/main/docker/Dockerfile.legacy-jar b/src/main/docker/Dockerfile.legacy-jar index 3f5e4556..dce326f7 100644 --- a/src/main/docker/Dockerfile.legacy-jar +++ b/src/main/docker/Dockerfile.legacy-jar @@ -77,7 +77,7 @@ # accessed directly. (example: "foo.example.com,bar.example.com") # ### -FROM registry.access.redhat.com/ubi8/openjdk-21:1.19 +FROM registry.access.redhat.com/ubi10/openjdk-21:1.24 ENV LANGUAGE='en_US:en' diff --git a/src/main/docker/Dockerfile.native b/src/main/docker/Dockerfile.native index c4fdf590..55e5a66e 100644 --- a/src/main/docker/Dockerfile.native +++ b/src/main/docker/Dockerfile.native @@ -14,7 +14,7 @@ # docker run -i --rm -p 8080:8080 quarkus/exploit-iq-client # ### -FROM registry.redhat.io/ubi9/ubi-minimal:9.5 +FROM registry.redhat.io/ubi10/ubi-minimal:10.2 WORKDIR /work/ RUN chown 1001 /work \ && chmod "g+rwX" /work \ diff --git a/src/test/README.md b/src/test/README.md index 2debb47a..9d79dee6 100644 --- a/src/test/README.md +++ b/src/test/README.md @@ -57,10 +57,17 @@ Pipelines expect that image tag to exist in Quay before `maven-test` can succeed From the **repository root** (requires access to `registry.redhat.io`; use `docker login` or `podman login` as appropriate): ```bash -docker build -f src/test/docker/Dockerfile \ +docker build --push -f src/test/docker/Dockerfile \ -t quay.io/ecosystem-appeng/exploit-iq-test-image:latest \ src/test/docker +``` + +`--push` builds and uploads in one step. It is **required** when the Buildx `docker-container` driver is active (the modern default): a plain `docker build -t …` leaves the result only in the build cache, so a follow-up `docker push` fails with `image not known`. If you prefer two steps, use `--load` to import the image into the local daemon first, then push: +```bash +docker build --load -f src/test/docker/Dockerfile \ + -t quay.io/ecosystem-appeng/exploit-iq-test-image:latest \ + src/test/docker docker push quay.io/ecosystem-appeng/exploit-iq-test-image:latest ``` diff --git a/src/test/docker/Dockerfile b/src/test/docker/Dockerfile index eb243fcb..4ac70fb9 100644 --- a/src/test/docker/Dockerfile +++ b/src/test/docker/Dockerfile @@ -2,9 +2,11 @@ # Syft installation mirrors src/main/docker/Dockerfile.multi-stage (mandrel stage + COPY /tmp/syft). # Build (repo root): docker build -f src/test/docker/Dockerfile -t quay.io/ecosystem-appeng/exploit-iq-test-image:latest src/test/docker # -# Why mandrel for syft only: unpacking the Syft .tar.gz needs gzip; ubi9/openjdk-21 +# Why mandrel for syft only: unpacking the Syft .tar.gz needs gzip; ubi10/openjdk-21 # slim variants may not ship gzip, which causes "tar (child): gzip: Cannot exec". -FROM registry.redhat.io/quarkus/mandrel-for-jdk-21-rhel8:23.1 AS syft +# Uses the same mandrel-25-rhel9 image (and digest) as Dockerfile.multi-stage so the +# syft-install infra matches the shipped image exactly. +FROM registry.redhat.io/quarkus/mandrel-25-rhel9@sha256:b19bdb7a74ed8827d5bc97dd95386da862a57571f7e8c2b77347912fdc0578f3 AS syft USER 0 # Pin Syft with checksum verification (APPENG-5702 / T-041) — keep in sync with Dockerfile.multi-stage ARG SYFT_VERSION=1.46.0 @@ -14,7 +16,7 @@ RUN curl -sSfL "https://github.com/anchore/syft/releases/download/v${SYFT_VERSIO && tar -xzf /tmp/syft.tar.gz -C /tmp syft \ && rm /tmp/syft.tar.gz -FROM registry.redhat.io/ubi9/openjdk-21:latest +FROM registry.redhat.io/ubi10/openjdk-21:1.24 LABEL org.opencontainers.image.title="exploit-iq-client-test-image" LABEL org.opencontainers.image.description="UBI OpenJDK 21 with pinned Syft (same install as Dockerfile.multi-stage)"