From ec73830b8f9385f40949fa127f0b8ef2bd62c3b3 Mon Sep 17 00:00:00 2001 From: Assaf Albo Date: Thu, 5 Nov 2026 14:15:21 +0200 Subject: [PATCH] NO-ISSUE: Switch UI images from flightctl-base to ubi-micro Migrate the flightctl-ui runtime images off quay.io/flightctl/flightctl-base (ubi 9.7/10.1, carrying CVEs) to ubi-micro. The runtime runs a FIPS-enabled Go proxy (CGO_ENABLED=1, strictfipsruntime), so openssl-libs and tzdata are installed into /runtime-root in the proxy-build stage and copied into the final image. - el9/el10 Containerfile and Containerfile.ocp runtime base -> ubi-micro (9.8-1793860449 / 10.2-1793858790). --- packaging/images/el10/Containerfile | 9 ++++++++- packaging/images/el10/Containerfile.ocp | 9 ++++++++- packaging/images/el9/Containerfile | 9 ++++++++- packaging/images/el9/Containerfile.ocp | 9 ++++++++- 4 files changed, 32 insertions(+), 4 deletions(-) diff --git a/packaging/images/el10/Containerfile b/packaging/images/el10/Containerfile index 320c8590d..bd92bd5bb 100644 --- a/packaging/images/el10/Containerfile +++ b/packaging/images/el10/Containerfile @@ -16,9 +16,16 @@ FROM registry.access.redhat.com/ubi10/go-toolset:1.26.10-1793622842 as proxy-bui WORKDIR /app COPY proxy /app USER 0 + +# Install runtime dependencies into a separate root for the final image +RUN dnf install -y --installroot=/runtime-root --setopt=install_weak_deps=False --nodocs \ + openssl-libs tzdata && \ + dnf --installroot=/runtime-root clean all + RUN CGO_ENABLED=1 CGO_CFLAGS=-flto GOEXPERIMENT=strictfipsruntime go build -FROM quay.io/flightctl/flightctl-base:10.1-1769518576 +FROM registry.access.redhat.com/ubi10/ubi-micro:10.2-1793858790 +COPY --from=proxy-build /runtime-root/ / COPY --from=ui-build /app/apps/standalone/dist /app/proxy/dist COPY --from=proxy-build /app/flightctl-ui /app/proxy WORKDIR /app/proxy diff --git a/packaging/images/el10/Containerfile.ocp b/packaging/images/el10/Containerfile.ocp index 9e0e73d1f..bcca26390 100644 --- a/packaging/images/el10/Containerfile.ocp +++ b/packaging/images/el10/Containerfile.ocp @@ -18,9 +18,16 @@ FROM registry.access.redhat.com/ubi10/go-toolset:1.26.10-1793622842 as proxy-bui WORKDIR /app COPY proxy /app USER 0 + +# Install runtime dependencies into a separate root for the final image +RUN dnf install -y --installroot=/runtime-root --setopt=install_weak_deps=False --nodocs \ + openssl-libs tzdata && \ + dnf --installroot=/runtime-root clean all + RUN CGO_ENABLED=1 CGO_CFLAGS=-flto GOEXPERIMENT=strictfipsruntime go build -FROM quay.io/flightctl/flightctl-base:10.1-1769518576 +FROM registry.access.redhat.com/ubi10/ubi-micro:10.2-1793858790 +COPY --from=proxy-build /runtime-root/ / COPY --from=ui-build /app/apps/ocp-plugin/dist /app/proxy/dist COPY --from=proxy-build /app/flightctl-ui /app/proxy WORKDIR /app/proxy diff --git a/packaging/images/el9/Containerfile b/packaging/images/el9/Containerfile index 3f1191e87..88fd338cf 100644 --- a/packaging/images/el9/Containerfile +++ b/packaging/images/el9/Containerfile @@ -16,9 +16,16 @@ FROM registry.access.redhat.com/ubi9/go-toolset:1.26.10-1793621864 as proxy-buil WORKDIR /app COPY proxy /app USER 0 + +# Install runtime dependencies into a separate root for the final image +RUN dnf install -y --installroot=/runtime-root --setopt=install_weak_deps=False --nodocs \ + openssl-libs tzdata && \ + dnf --installroot=/runtime-root clean all + RUN CGO_ENABLED=1 CGO_CFLAGS=-flto GOEXPERIMENT=strictfipsruntime go build -FROM quay.io/flightctl/flightctl-base:9.7-1762965531 +FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1793860449 +COPY --from=proxy-build /runtime-root/ / COPY --from=ui-build /app/apps/standalone/dist /app/proxy/dist COPY --from=proxy-build /app/flightctl-ui /app/proxy WORKDIR /app/proxy diff --git a/packaging/images/el9/Containerfile.ocp b/packaging/images/el9/Containerfile.ocp index 9b0bb9110..9d6b4fef6 100644 --- a/packaging/images/el9/Containerfile.ocp +++ b/packaging/images/el9/Containerfile.ocp @@ -18,9 +18,16 @@ FROM registry.access.redhat.com/ubi9/go-toolset:1.26.10-1793621864 as proxy-buil WORKDIR /app COPY proxy /app USER 0 + +# Install runtime dependencies into a separate root for the final image +RUN dnf install -y --installroot=/runtime-root --setopt=install_weak_deps=False --nodocs \ + openssl-libs tzdata && \ + dnf --installroot=/runtime-root clean all + RUN CGO_ENABLED=1 CGO_CFLAGS=-flto GOEXPERIMENT=strictfipsruntime go build -FROM quay.io/flightctl/flightctl-base:9.7-1762965531 +FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1793860449 +COPY --from=proxy-build /runtime-root/ / COPY --from=ui-build /app/apps/ocp-plugin/dist /app/proxy/dist COPY --from=proxy-build /app/flightctl-ui /app/proxy WORKDIR /app/proxy