Migrate Konflux images and RPM lockfile to UBI 10#521
Conversation
WalkthroughThis PR upgrades the infrastructure from Red Hat UBI 9 to UBI 10 across container build artifacts, package repositories, and dependency locks. Two Dockerfiles update builder and runtime base images with refreshed digest pins, the yum repository configuration is updated with new repository identifiers and baseurl paths, and the RPM lockfile is refreshed with updated package metadata for all architectures. ChangesUBI 9 to UBI 10 Upgrade
🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @adchauha. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: adchauha The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.konflux/shared-resource/Dockerfile (1)
1-40:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSpecify a non-root USER for the runtime container.
The Dockerfile runs the final container as root without justification. While the
microdnf installat lines 13-16 requires root privileges, the runtime container should drop to a non-root user after package installation completes.🔒 Proposed fix to add non-root user
Add a USER directive before the ENTRYPOINT:
COPY --from=builder /tmp/openshift-builds-shared-resource . COPY LICENSE /licenses/ +USER 65532:65532 + ENTRYPOINT ["./openshift-builds-shared-resource"]Note: UID 65532 is a common non-root user ID. Adjust based on your security requirements or use a named user if the base image provides one.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.konflux/shared-resource/Dockerfile around lines 1 - 40, The final image runs as root; after the RUN microdnf... step you must create or switch to a non-root user and ensure the runtime files are owned appropriately before ENTRYPOINT: create a non-root user/group (or use UID 65532), chown the binary copied from the builder (the file placed by COPY --from=builder /tmp/openshift-builds-shared-resource .) and the /licenses directory, then add a USER directive before ENTRYPOINT ["./openshift-builds-shared-resource"] so the container runs unprivileged.Sources: Coding guidelines, Linters/SAST tools
.konflux/shared-resource-webhook/Dockerfile (1)
1-34:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSpecify a non-root USER for the runtime container.
The Dockerfile runs the final container as root without justification. According to security best practices and coding guidelines, containers should run as a non-root user unless there's a specific operational requirement.
🔒 Proposed fix to add non-root user
Add a USER directive before the ENTRYPOINT:
COPY --from=builder /tmp/openshift-builds-shared-resource-webhook . COPY LICENSE /licenses/ +USER 65532:65532 + ENTRYPOINT ["./openshift-builds-shared-resource-webhook"]Note: UID 65532 is a common non-root user ID. Adjust based on your security requirements or use a named user if the base image provides one.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.konflux/shared-resource-webhook/Dockerfile around lines 1 - 34, The image runs the final stage as root (ENTRYPOINT "./openshift-builds-shared-resource-webhook"); fix by adding a non-root user and switching to it in the runtime stage: create or pick an unprivileged UID/GID (e.g. 65532), ensure ownership of the binary (COPY --from=builder ...) and any runtime paths (WORKDIR /, /licenses) are chowned to that UID/GID, then add a USER directive before ENTRYPOINT so the container runs as that non-root user; update the builder/runtime COPY ownership handling to avoid permission issues with the binary and LICENSE files.Sources: Coding guidelines, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.konflux/shared-resource-webhook/Dockerfile:
- Around line 1-34: The image runs the final stage as root (ENTRYPOINT
"./openshift-builds-shared-resource-webhook"); fix by adding a non-root user and
switching to it in the runtime stage: create or pick an unprivileged UID/GID
(e.g. 65532), ensure ownership of the binary (COPY --from=builder ...) and any
runtime paths (WORKDIR /, /licenses) are chowned to that UID/GID, then add a
USER directive before ENTRYPOINT so the container runs as that non-root user;
update the builder/runtime COPY ownership handling to avoid permission issues
with the binary and LICENSE files.
In @.konflux/shared-resource/Dockerfile:
- Around line 1-40: The final image runs as root; after the RUN microdnf... step
you must create or switch to a non-root user and ensure the runtime files are
owned appropriately before ENTRYPOINT: create a non-root user/group (or use UID
65532), chown the binary copied from the builder (the file placed by COPY
--from=builder /tmp/openshift-builds-shared-resource .) and the /licenses
directory, then add a USER directive before ENTRYPOINT
["./openshift-builds-shared-resource"] so the container runs unprivileged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 5299badc-c941-4dc4-a490-76e076bb85e5
📒 Files selected for processing (4)
.konflux/shared-resource-webhook/Dockerfile.konflux/shared-resource/Dockerfilerpms.lock.yamlubi.repo
|
Image SHAs verified — both Dockerfiles use the latest A few items to address:
Co-Authored-By: Claude Code |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.konflux/shared-resource-webhook/Dockerfile (1)
11-18:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSet an explicit non-root runtime user in the final stage.
The final image has no
USERinstruction, so it defaults to root. Since this Dockerfile is directly used by the PR build pipeline, the published webhook image inherits that posture.Suggested hardening patch
FROM registry.redhat.io/ubi10-minimal@sha256:2c20ac20ca1ecbbbd583603feabd9cc51e7e8ea5a82e5088e20a9494794b2574 WORKDIR / COPY --from=builder /tmp/openshift-builds-shared-resource-webhook . COPY LICENSE /licenses/ +RUN chown -R 1001:0 /openshift-builds-shared-resource-webhook /licenses && \ + chmod -R g=u /openshift-builds-shared-resource-webhook /licenses +USER 1001 + ENTRYPOINT ["./openshift-builds-shared-resource-webhook"]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.konflux/shared-resource-webhook/Dockerfile around lines 11 - 18, The final image runs as root because there is no USER set; create a non-root runtime user and make that the container user: in the final stage (where WORKDIR, COPY and ENTRYPOINT are present) add steps to create a dedicated user/group (e.g., runtime user), ensure ownership of the copied binary and /licenses (chown those targets to the new uid/gid), drop privileges by adding a USER instruction referencing that user, and keep the existing ENTRYPOINT untouched so openshift-builds-shared-resource-webhook runs as the non-root user.Source: Linters/SAST tools
.konflux/shared-resource/Dockerfile (1)
11-23:⚠️ Potential issue | 🟠 Major | ⚡ Quick winHarden runtime image by switching from root to a non-root user.
This final stage also runs as root by default because
USERis not set. Given this Dockerfile is pipeline-built and published, this should be fixed before merge.Suggested hardening patch
FROM registry.redhat.io/ubi10-minimal@sha256:2c20ac20ca1ecbbbd583603feabd9cc51e7e8ea5a82e5088e20a9494794b2574 RUN \ microdnf --assumeyes --nodocs install util-linux && \ microdnf clean all && \ rm -rf /var/cache/yum WORKDIR / COPY --from=builder /tmp/openshift-builds-shared-resource . COPY LICENSE /licenses/ +RUN chown -R 1001:0 /openshift-builds-shared-resource /licenses && \ + chmod -R g=u /openshift-builds-shared-resource /licenses +USER 1001 + ENTRYPOINT ["./openshift-builds-shared-resource"]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.konflux/shared-resource/Dockerfile around lines 11 - 23, The final Dockerfile stage is running as root; add a non-root user and switch to it before the ENTRYPOINT: create a dedicated user/group (e.g., "sbuser"), set ownership and minimal permissions for the copied binary and /licenses (use chown on the files copied by COPY --from=builder and COPY LICENSE), and then add USER sbuser (or the chosen uid:gid) after WORKDIR / and before ENTRYPOINT ["./openshift-builds-shared-resource"]; ensure the binary is executable by that user and avoid granting unnecessary write permissions to root-owned directories.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.konflux/shared-resource-webhook/Dockerfile:
- Around line 11-18: The final image runs as root because there is no USER set;
create a non-root runtime user and make that the container user: in the final
stage (where WORKDIR, COPY and ENTRYPOINT are present) add steps to create a
dedicated user/group (e.g., runtime user), ensure ownership of the copied binary
and /licenses (chown those targets to the new uid/gid), drop privileges by
adding a USER instruction referencing that user, and keep the existing
ENTRYPOINT untouched so openshift-builds-shared-resource-webhook runs as the
non-root user.
In @.konflux/shared-resource/Dockerfile:
- Around line 11-23: The final Dockerfile stage is running as root; add a
non-root user and switch to it before the ENTRYPOINT: create a dedicated
user/group (e.g., "sbuser"), set ownership and minimal permissions for the
copied binary and /licenses (use chown on the files copied by COPY
--from=builder and COPY LICENSE), and then add USER sbuser (or the chosen
uid:gid) after WORKDIR / and before ENTRYPOINT
["./openshift-builds-shared-resource"]; ensure the binary is executable by that
user and avoid granting unnecessary write permissions to root-owned directories.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f247c876-016f-462f-a329-c3b2197a51de
📒 Files selected for processing (4)
.konflux/shared-resource-webhook/Dockerfile.konflux/shared-resource/Dockerfilerpms.lock.yamlubi.repo
✅ Files skipped from review due to trivial changes (1)
- rpms.lock.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- ubi.repo
Addressed review feedback: updated CPE labels to el10, amended commit with sign-off, updated PR title with BUILD-2063. |
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
|
@adchauha: Cannot trigger testing until a trusted user reviews the PR and leaves an DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
Updates ubi.repo, rpms.lock.yaml, and Konflux Dockerfiles from UBI 9 to UBI 10. Signed-off-by: adchauha <adchauha@redhat.com>
|
Reverted CPE labels to el9 per product/certification guidance — the OpenShift Builds 1.8 component CPE remains on el9 even though runtime base images move to UBI 10. Base image digests and RPM lockfile remain on UBI 10. |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.konflux/shared-resource-webhook/Dockerfile (1)
22-22:⚠️ Potential issue | 🟠 Major | ⚡ Quick winCPE label still references
el9instead ofel10.The base images have been migrated to UBI 10, but the CPE label still shows
cpe:/a:redhat:openshift_builds:1.8::el9. This contradicts the PR objectives and the explicit request from psrvere to update CPE labels toel10. This metadata mismatch will cause incorrect CVE matching and compliance tracking.🔧 Proposed fix
- cpe="cpe:/a:redhat:openshift_builds:1.8::el9" \ + cpe="cpe:/a:redhat:openshift_builds:1.8::el10" \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.konflux/shared-resource-webhook/Dockerfile at line 22, Update the CPE label value in the Dockerfile where the cpe string cpe:/a:redhat:openshift_builds:1.8::el9 appears so it references el10 (i.e., change ::el9 to ::el10) to match the migrated UBI 10 base images and ensure CVE/compliance tooling sees the correct OS version; verify there are no other occurrences of the old cpe:/a:redhat:openshift_builds:1.8::el9 string in the same file..konflux/shared-resource/Dockerfile (1)
27-27:⚠️ Potential issue | 🟠 Major | ⚡ Quick winCPE label still references
el9instead ofel10.The base images have been migrated to UBI 10, but the CPE label still shows
cpe:/a:redhat:openshift_builds:1.8::el9. This contradicts the PR objectives and the explicit request from psrvere to update CPE labels toel10. This metadata mismatch will cause incorrect CVE matching and compliance tracking.🔧 Proposed fix
- cpe="cpe:/a:redhat:openshift_builds:1.8::el9" \ + cpe="cpe:/a:redhat:openshift_builds:1.8::el10" \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.konflux/shared-resource/Dockerfile at line 27, The CPE label in the Dockerfile (the cpe variable value "cpe:/a:redhat:openshift_builds:1.8::el9") still references el9; update that string to use el10 ("cpe:/a:redhat:openshift_builds:1.8::el10") and scan the Dockerfile for any other occurrences of "el9" to replace with "el10" so the metadata matches the new UBI 10 base images and ensures correct CVE/compliance matching.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.konflux/shared-resource-webhook/Dockerfile:
- Line 22: Update the CPE label value in the Dockerfile where the cpe string
cpe:/a:redhat:openshift_builds:1.8::el9 appears so it references el10 (i.e.,
change ::el9 to ::el10) to match the migrated UBI 10 base images and ensure
CVE/compliance tooling sees the correct OS version; verify there are no other
occurrences of the old cpe:/a:redhat:openshift_builds:1.8::el9 string in the
same file.
In @.konflux/shared-resource/Dockerfile:
- Line 27: The CPE label in the Dockerfile (the cpe variable value
"cpe:/a:redhat:openshift_builds:1.8::el9") still references el9; update that
string to use el10 ("cpe:/a:redhat:openshift_builds:1.8::el10") and scan the
Dockerfile for any other occurrences of "el9" to replace with "el10" so the
metadata matches the new UBI 10 base images and ensures correct CVE/compliance
matching.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3bf13e2b-8fb5-4da5-85a9-2e52c36a62da
📒 Files selected for processing (4)
.konflux/shared-resource-webhook/Dockerfile.konflux/shared-resource/Dockerfilerpms.lock.yamlubi.repo
🚧 Files skipped from review as they are similar to previous changes (2)
- ubi.repo
- rpms.lock.yaml
|
@adchauha: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Updates ubi.repo, rpms.lock.yaml, and Konflux Dockerfiles from UBI 9 to UBI 10.
Summary by CodeRabbit