From dfcede7ea34d71d3e3c26d7ee8f5187d4bb0d2fc Mon Sep 17 00:00:00 2001 From: Assaf Albo Date: Thu, 5 Nov 2026 14:10:35 +0200 Subject: [PATCH] NO-ISSUE: Switch UI images from flightctl-base to ubi-micro Migrate the flightctl-ui runtime images off quay.io/flightctl/flightctl-base (ubi 9.7/10.1, carrying CVEs) to ubi-micro. The runtime runs a FIPS-enabled Go proxy (CGO_ENABLED=1, strictfipsruntime), so openssl-libs and tzdata are installed into /runtime-root in the proxy-build stage and copied into the final image. - el9/el10 Containerfile and Containerfile.ocp runtime base -> ubi-micro (9.8-1793860449 / 10.2-1793858790). --- packaging/images/el10/Containerfile | 9 ++++++++- packaging/images/el10/Containerfile.ocp | 9 ++++++++- packaging/images/el9/Containerfile | 9 ++++++++- packaging/images/el9/Containerfile.ocp | 9 ++++++++- 4 files changed, 32 insertions(+), 4 deletions(-) diff --git a/packaging/images/el10/Containerfile b/packaging/images/el10/Containerfile index f054b61b9..bd92bd5bb 100644 --- a/packaging/images/el10/Containerfile +++ b/packaging/images/el10/Containerfile @@ -16,9 +16,16 @@ FROM registry.access.redhat.com/ubi10/go-toolset:1.26.10-1793622842 as proxy-bui WORKDIR /app COPY proxy /app USER 0 + +# Install runtime dependencies into a separate root for the final image +RUN dnf install -y --installroot=/runtime-root --setopt=install_weak_deps=False --nodocs \ + openssl-libs tzdata && \ + dnf --installroot=/runtime-root clean all + RUN CGO_ENABLED=1 CGO_CFLAGS=-flto GOEXPERIMENT=strictfipsruntime go build -FROM quay.io/flightctl/flightctl-base:el10-10.1-1769518576 +FROM registry.access.redhat.com/ubi10/ubi-micro:10.2-1793858790 +COPY --from=proxy-build /runtime-root/ / COPY --from=ui-build /app/apps/standalone/dist /app/proxy/dist COPY --from=proxy-build /app/flightctl-ui /app/proxy WORKDIR /app/proxy diff --git a/packaging/images/el10/Containerfile.ocp b/packaging/images/el10/Containerfile.ocp index 0afebd4de..bcca26390 100644 --- a/packaging/images/el10/Containerfile.ocp +++ b/packaging/images/el10/Containerfile.ocp @@ -18,9 +18,16 @@ FROM registry.access.redhat.com/ubi10/go-toolset:1.26.10-1793622842 as proxy-bui WORKDIR /app COPY proxy /app USER 0 + +# Install runtime dependencies into a separate root for the final image +RUN dnf install -y --installroot=/runtime-root --setopt=install_weak_deps=False --nodocs \ + openssl-libs tzdata && \ + dnf --installroot=/runtime-root clean all + RUN CGO_ENABLED=1 CGO_CFLAGS=-flto GOEXPERIMENT=strictfipsruntime go build -FROM quay.io/flightctl/flightctl-base:el10-10.1-1769518576 +FROM registry.access.redhat.com/ubi10/ubi-micro:10.2-1793858790 +COPY --from=proxy-build /runtime-root/ / COPY --from=ui-build /app/apps/ocp-plugin/dist /app/proxy/dist COPY --from=proxy-build /app/flightctl-ui /app/proxy WORKDIR /app/proxy diff --git a/packaging/images/el9/Containerfile b/packaging/images/el9/Containerfile index 6ad7d5c36..2c7847671 100644 --- a/packaging/images/el9/Containerfile +++ b/packaging/images/el9/Containerfile @@ -16,9 +16,16 @@ FROM registry.access.redhat.com/ubi9/go-toolset:1.26.10-1793621864 as proxy-buil WORKDIR /app COPY proxy /app USER 0 + +# Install runtime dependencies into a separate root for the final image +RUN dnf install -y --installroot=/runtime-root --setopt=install_weak_deps=False --nodocs \ + openssl-libs tzdata && \ + dnf --installroot=/runtime-root clean all + RUN CGO_ENABLED=1 CGO_CFLAGS=-flto GOEXPERIMENT=strictfipsruntime go build -FROM quay.io/flightctl/flightctl-base:9.7-1762965531 +FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1793860449 +COPY --from=proxy-build /runtime-root/ / COPY --from=ui-build /app/apps/standalone/dist /app/proxy/dist COPY --from=proxy-build /app/flightctl-ui /app/proxy WORKDIR /app/proxy diff --git a/packaging/images/el9/Containerfile.ocp b/packaging/images/el9/Containerfile.ocp index d71ee6975..5ac46758e 100644 --- a/packaging/images/el9/Containerfile.ocp +++ b/packaging/images/el9/Containerfile.ocp @@ -18,9 +18,16 @@ FROM registry.access.redhat.com/ubi9/go-toolset:1.26.10-1793621864 as proxy-buil WORKDIR /app COPY proxy /app USER 0 + +# Install runtime dependencies into a separate root for the final image +RUN dnf install -y --installroot=/runtime-root --setopt=install_weak_deps=False --nodocs \ + openssl-libs tzdata && \ + dnf --installroot=/runtime-root clean all + RUN CGO_ENABLED=1 CGO_CFLAGS=-flto GOEXPERIMENT=strictfipsruntime go build -FROM quay.io/flightctl/flightctl-base:9.7-1762965531 +FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1793860449 +COPY --from=proxy-build /runtime-root/ / COPY --from=ui-build /app/apps/ocp-plugin/dist /app/proxy/dist COPY --from=proxy-build /app/flightctl-ui /app/proxy WORKDIR /app/proxy