fix TC-5834

.dockerignore

@@ -81,3 +81,15 @@ coverage/
 *.temp
 .cache/
 
+# Allow local dev image builds to access Maven build output (target/ is excluded above).
+# These negations re-include exactly what the dev Dockerfiles COPY from the build context:
+#   Dockerfile.native / Dockerfile.native-micro -> target/*-runner (native executable)
+#   Dockerfile.jvm                              -> target/quarkus-app/*
+#   Dockerfile.legacy-jar                       -> target/lib + target/*-runner.jar
+# The shipped Dockerfile.multi-stage builds inside the container and copies none of these,
+# so this only affects local dev builds (docker build -f src/main/docker/Dockerfile.<x> ... .).
+!target/*-runner
+!target/*-runner.jar
+!target/quarkus-app
+!target/lib
+

src/main/docker/Dockerfile.jvm

@@ -77,7 +77,7 @@
 #   accessed directly. (example: "foo.example.com,bar.example.com")
 #
 ###
-FROM registry.access.redhat.com/ubi8/openjdk-21:1.19
+FROM registry.access.redhat.com/ubi10/openjdk-21:1.24
 
 ENV LANGUAGE='en_US:en'
 

src/main/docker/Dockerfile.legacy-jar

@@ -77,7 +77,7 @@
 #   accessed directly. (example: "foo.example.com,bar.example.com")
 #
 ###
-FROM registry.access.redhat.com/ubi8/openjdk-21:1.19
+FROM registry.access.redhat.com/ubi10/openjdk-21:1.24
 
 ENV LANGUAGE='en_US:en'
 

src/main/docker/Dockerfile.native

@@ -14,7 +14,7 @@
 # docker run -i --rm -p 8080:8080 quarkus/exploit-iq-client
 #
 ###
-FROM registry.redhat.io/ubi9/ubi-minimal:9.5
+FROM registry.redhat.io/ubi10/ubi-minimal:10.2
 WORKDIR /work/
 RUN chown 1001 /work \
     && chmod "g+rwX" /work \

src/test/README.md

@@ -57,10 +57,17 @@ Pipelines expect that image tag to exist in Quay before `maven-test` can succeed
 From the **repository root** (requires access to `registry.redhat.io`; use `docker login` or `podman login` as appropriate):
 
 ```bash
-docker build -f src/test/docker/Dockerfile \
+docker build --push -f src/test/docker/Dockerfile \
   -t quay.io/ecosystem-appeng/exploit-iq-test-image:latest \
   src/test/docker
+```
+
+`--push` builds and uploads in one step. It is **required** when the Buildx `docker-container` driver is active (the modern default): a plain `docker build -t …` leaves the result only in the build cache, so a follow-up `docker push` fails with `image not known`. If you prefer two steps, use `--load` to import the image into the local daemon first, then push:
 
+```bash
+docker build --load -f src/test/docker/Dockerfile \
+  -t quay.io/ecosystem-appeng/exploit-iq-test-image:latest \
+  src/test/docker
 docker push quay.io/ecosystem-appeng/exploit-iq-test-image:latest
 ```
 

src/test/docker/Dockerfile

@@ -2,9 +2,11 @@
 # Syft installation mirrors src/main/docker/Dockerfile.multi-stage (mandrel stage + COPY /tmp/syft).
 # Build (repo root): docker build -f src/test/docker/Dockerfile -t quay.io/ecosystem-appeng/exploit-iq-test-image:latest src/test/docker
 #
-# Why mandrel for syft only: unpacking the Syft .tar.gz needs gzip; ubi9/openjdk-21
+# Why mandrel for syft only: unpacking the Syft .tar.gz needs gzip; ubi10/openjdk-21
 # slim variants may not ship gzip, which causes "tar (child): gzip: Cannot exec".
-FROM registry.redhat.io/quarkus/mandrel-for-jdk-21-rhel8:23.1 AS syft
+# Uses the same mandrel-25-rhel9 image (and digest) as Dockerfile.multi-stage so the
+# syft-install infra matches the shipped image exactly.
+FROM registry.redhat.io/quarkus/mandrel-25-rhel9@sha256:b19bdb7a74ed8827d5bc97dd95386da862a57571f7e8c2b77347912fdc0578f3 AS syft
 USER 0
 # Pin Syft with checksum verification (APPENG-5702 / T-041) — keep in sync with Dockerfile.multi-stage
 ARG SYFT_VERSION=1.46.0
@@ -14,7 +16,7 @@ RUN curl -sSfL "https://github.com/anchore/syft/releases/download/v${SYFT_VERSIO
   && tar -xzf /tmp/syft.tar.gz -C /tmp syft \
   && rm /tmp/syft.tar.gz
 
-FROM registry.redhat.io/ubi9/openjdk-21:latest
+FROM registry.redhat.io/ubi10/openjdk-21:1.24
 
 LABEL org.opencontainers.image.title="exploit-iq-client-test-image"
 LABEL org.opencontainers.image.description="UBI OpenJDK 21 with pinned Syft (same install as Dockerfile.multi-stage)"