Repository navigation
NO-ISSUE: Switch UI images from flightctl-base to ubi-micro - #881
Merged
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review: 1
Please check the settings in the CodeRabbit UI or the
 |
asafbss
force-pushed
the
switch-to-ubi-micro-release-1.4
branch
from
November 5, 2026 12:14
6094429 to
c83c380
Compare
Migrate the flightctl-ui runtime images off quay.io/flightctl/flightctl-base (ubi 9.7/10.1, carrying CVEs) to ubi-micro. The runtime runs a FIPS-enabled Go proxy (CGO_ENABLED=1, strictfipsruntime), so openssl-libs and tzdata are installed into /runtime-root in the proxy-build stage and copied into the final image. - el9/el10 Containerfile and Containerfile.ocp runtime base -> ubi-micro (9.8-1793860449 / 10.2-1793858790). - Pin the nodejs-22-minimal build stage (was :latest) to 9.8-1793616223 / 10.2-1793210640 for reproducible builds.
asafbss
force-pushed
the
switch-to-ubi-micro-release-1.4
branch
from
November 5, 2026 12:20
c83c380 to
0de03ce
Compare
celdrake
approved these changes
Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrate the
flightctl-uiruntime images offquay.io/flightctl/flightctl-base(ubi9.7/10.1, carrying CVEs) toubi-microon the current9.8/10.2streams — the same approach used by the main flightctl services.The runtime stage runs a FIPS-enabled Go proxy (
CGO_ENABLED=1,GOEXPERIMENT=strictfipsruntime), which needsopenssl-libs(RPM-installed, for FIPS policy setup) andtzdata. These are installed into a/runtime-rootinstallroot during theproxy-buildstage and copied into the final image.Changes
packaging/images/el9/Containerfile,el9/Containerfile.ocp,el10/Containerfile,el10/Containerfile.ocp: runtime baseflightctl-base→ubi-micro(9.8-1793860449/10.2-1793858790), with/runtime-rootcarryingopenssl-libs+tzdata.nodejs-22-minimalbuild stage (was:latest) to9.8-1793616223/10.2-1793210640for reproducible builds.go-toolsetbuild stage to1.26.10(-1793621864/-1793622842), aligning with release-1.3, main, and the flightctl service images (build-only; carries the Go toolchain CVE fix).Build-only
nodejs-22-minimalandgo-toolsetstages are not shipped.Verification
podman buildof the el9 standalone image (identical pattern) succeeds; runtime image shipslibssl/libcrypto+ tzdata, the proxy binary, and the UIdist/on RHEL 9.8.flightctl-basereferences remain.Assisted-by: Claude noreply@anthropic.com