ROX-30858: Migrate main image to ubi-micro by janisz · Pull Request #17406 · stackrox/stackrox

janisz · 2025-10-21T11:14:41Z

This commit migrates the main container image from ubi-minimal (~92 MB) to ubi-micro (~28 MB) base image, reducing the final image size and improving security posture by minimizing the attack surface.

Changes

Base image: ubi8-minimal (~92 MB) → ubi8-micro (~28 MB)
Build strategy: Multi-stage build with ubi8 builder for dependencies
Final image size: 188 MB → 122 MB

Build Architecture

Builder stage (ubi8): Install runtime dependencies using dnf/rpm
Final stage (ubi8-micro): Copy dependencies, no package managers

Related Work

This continues the image optimization efforts:

ROX-9598: Use ubi-minimal image #1054 - Initial migration to ubi8-minimal
chore(deps): remove unix utils from release image #14487 - Removed linux-utils package
chore(deps): remove lz4 and bzip2 #14489 - Removed lz4 and bzip2 packages
Use ubi8-micro image for operator #1220 - Operator migrated to ubi8-micro
Earlier ubi-micro migration attempts

Testing

  export KUBECONFIG=/tmp/tests/kubeconfig
  kubectl -n stackrox set image deployment/central \
    central=quay.io/rhacs-eng/release-main:4.11.0-388-gc4b4bc65c1-fast
  kubectl -n stackrox set image deployment/scanner-v4-indexer \
    indexer=quay.io/rhacs-eng/release-scanner-v4:4.11.0-394-g97746fa495-fast

  kubectl -n stackrox set image deployment/scanner-v4-matcher \
    matcher=quay.io/rhacs-eng/release-scanner-v4:4.11.0-394-g97746fa495-fast

  kubectl -n stackrox rollout status deployment/central --timeout=5m
  kubectl -n stackrox rollout status deployment/scanner-v4-indexer --timeout=5m
  kubectl -n stackrox rollout status deployment/scanner-v4-matcher --timeout=5m

Then check in UI if everything is healthy and followed and check if scanner is working

roxctl --insecure-skip-tls-verify image scan --image=quay.io/rhacs-eng/release-scanner-v4:4.11.0-394-g97746fa495-fast --output=table
Scan results for image: quay.io/rhacs-eng/release-scanner-v4:4.11.0-394-g97746fa495-fast
   (TOTAL-COMPONENTS: 19, TOTAL-VULNERABILITIES: 50, LOW: 41, MODERATE: 9, IMPORTANT: 0, CRITICAL: 0)
   ```

rhacs-bot · 2025-10-21T11:40:59Z

Images are ready for the commit at d885375.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.10.x-202-gd885375b71.

codecov · 2025-10-21T11:49:07Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.25%. Comparing base (123b457) to head (505607e).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #17406   +/-   ##
=======================================
  Coverage   49.25%   49.25%           
=======================================
  Files        2735     2735           
  Lines      206138   206138           
=======================================
+ Hits       101539   101540    +1     
+ Misses      97051    97050    -1     
  Partials     7548     7548

Flag	Coverage Δ
go-unit-tests	`49.25% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

msugakov

https://github.com/msugakov/msugakov/blob/main/No_I_will_not_review_your_LLM_generated_code.md

janisz · 2025-10-23T09:45:05Z

@msugakov I used claude to format and test this and finally generate a commit message. It has quite good idea about using chroot that I have not thought about. Look at my previous attempts so you'd now that I spent some time working on that and I'm happy that I finally have something that is working although I need to fix some issues with scanner but that are separated PRs.

msugakov · 2025-10-23T10:02:40Z

Following up in Slack DM https://redhat-internal.slack.com/archives/C06750NAYSG/p1761213744579499

The scanner-v4-db container was crashing with exit code 127 (command not found) because the migration to ubi8-micro removed essential shell utilities that the entrypoint scripts depend on. Root cause: - docker-entrypoint.sh uses #!/usr/bin/env bash - ubi8-micro has no utilities pre-installed (unlike ubi8-minimal) - The chroot commands for user creation need /bin/sh, id, etc. This fix adds the missing packages that PR #17406 correctly included for the main image: - bash: Required for entrypoint scripts - coreutils: Basic commands (id, mkdir, cat, etc.) - findutils: File operations - util-linux: System utilities These packages enable the existing chroot user creation and locale setup commands to execute successfully. Fixes: ROX-30858 Related: #17406 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

The scanner-v4-indexer and scanner-v4-matcher containers were crashing immediately with exit code 1 because the migration to ubi8-micro removed essential shell utilities that the entrypoint scripts depend on. Root cause: - entrypoint.sh uses #!/usr/bin/env bash - ubi8-micro has no utilities pre-installed (unlike ubi8-minimal) - The container fails immediately when trying to execute the bash script This fix applies the same multi-stage build pattern used in: - PR #17406 for the main image - commit cc55af9 for scanner-v4-db Changes: 1. Added dependency_builder stage using ubi8 (full) 2. Install bash, coreutils, findutils, util-linux, ca-certificates to /out/ 3. Copy dependencies from builder to ubi8-micro final stage 4. Removed microdnf/rpm operations from final stage (not available in ubi8-micro) 5. Changed BASE_IMAGE from ubi8-minimal to ubi8-micro This enables the entrypoint scripts to execute successfully while maintaining the minimal footprint of ubi8-micro. Fixes: ROX-30858 Related: #17406, #17430 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

rhacs-bot · 2025-10-30T15:42:18Z

/retest

sourcery-ai

Hey - I've found 1 issue, and left some high level feedback:

The main rhel Dockerfile removed the HEALTHCHECK entirely; if Central still expects an in-container liveness check, consider reintroducing an equivalent healthcheck that works without curl (or using a static curl binary) rather than dropping it.
The package_installer logic and package lists for ubi8-micro are now duplicated between image/rhel/Dockerfile and image/rhel/konflux.Dockerfile; factoring this into a shared build fragment or aligning the package lists in one place would reduce future drift and simplify maintenance.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The main rhel Dockerfile removed the HEALTHCHECK entirely; if Central still expects an in-container liveness check, consider reintroducing an equivalent healthcheck that works without curl (or using a static curl binary) rather than dropping it.
- The `package_installer` logic and package lists for ubi8-micro are now duplicated between `image/rhel/Dockerfile` and `image/rhel/konflux.Dockerfile`; factoring this into a shared build fragment or aligning the package lists in one place would reduce future drift and simplify maintenance.

## Individual Comments

### Comment 1
<location path="image/rhel/Dockerfile" line_range="100" />
<code_context>

 ENTRYPOINT ["/stackrox/roxctl"]
-
-HEALTHCHECK CMD curl --insecure --fail https://127.0.0.1:8443/v1/ping
</code_context>
<issue_to_address>
**question (bug_risk):** Dropping the HEALTHCHECK removes built‑in liveness monitoring for Central.

This image previously defined a `HEALTHCHECK` using `curl` on `/v1/ping`, which runtimes and deployment manifests may depend on for health reporting. With it removed and no replacement, container health won’t be surfaced at the image level. Unless equivalent checks are guaranteed elsewhere (e.g., Kubernetes liveness/readiness probes mirroring this endpoint), please consider restoring a health check or providing an alternative mechanism.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

image/rhel/Dockerfile

msugakov

Made the first pass. Will likely find more in subsequent iterations.

image/rhel/Dockerfile

image/rhel/konflux.Dockerfile

image/rhel/Dockerfile

image/rhel/konflux.Dockerfile

msugakov · 2026-03-20T15:07:03Z

image/rhel/konflux.Dockerfile

+COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/static-bin/* /out/stackrox/
+RUN chroot /out /stackrox/save-dir-contents /etc/pki/ca-trust /etc/ssl


This could be copied and executed (without chroot) in the final stage. Is there a reason to have it here?

My idea was to not add unnecessary layers in the final image

You don't need to worry about layers in the Konflux image. They get all squashed.

You also don't need to worry about layers in the GHA-built image, we did not attempt to reduce them historically.

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

msugakov

Sharing some thoughts from looking at the inter-diff

msugakov · 2026-03-24T12:13:41Z

image/rhel/konflux.Dockerfile

+        findutils \
+        openssl \
+        postgresql  \
+        util-linux && \


What's with util-linux in konflux.Dockerfile, is it needed?
Similar to #17406 (comment)

msugakov · 2026-03-24T12:15:10Z

image/rhel/konflux.Dockerfile

+RUN mkdir -p /out/stackrox && \
+    mkdir -p /out/etc/pki/ca-tr
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:093a704be0eaef9bb52d9bc0219c67ee9db13c2e797da400ddb5d5ae6849fa10 AS ubi-micro-base
+
+FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:6ed9f6f637fe731d93ec60c065dbced79273f1e0b5f512951f2c0b0baedb16ad AS package_installerust/source/anchors /out/etc/ssl && \
+    mkdir -p /out/var/lib/stackrox /out/var/log/stackrox /out/var/cache/stackrox && \
+    chown -R 4000:4000 /out/etc/pki/ca-trust /out/etc/ssl /out/var/lib/stackrox /out/var/log/stackrox /out/var/cache/stackrox /out/tmp


Look what a mess we have here. I think, committing suggestions from GitHub UI is not safe for the time being.

msugakov · 2026-03-24T12:20:18Z

image/rhel/konflux.Dockerfile

+COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/static-bin/* /out/stackrox/
+RUN chroot /out /stackrox/save-dir-contents /etc/pki/ca-trust /etc/ssl


You don't need to worry about layers in the Konflux image. They get all squashed.

You also don't need to worry about layers in the GHA-built image, we did not attempt to reduce them historically.

msugakov · 2026-03-24T12:23:14Z

image/rhel/konflux.Dockerfile

 COPY --from=ubi-micro-base / /out/

-# Install packages not in ubi-micro (bash and coreutils-single already present)
+# Install packages directly to /out/ using --installroot


Minor nitpick, but...

This comment

# Install packages directly to /out/ using --installroot

is present in konflux.Dockerfile but absent in Dockerfile although both do the same thing in this regard.

I suggest you stick with one way of doing things and do it consistently in this PR and in other ongoing PRs.

The scanner-v4-db container was crashing with exit code 127 (command not found) because the migration to ubi8-micro removed essential shell utilities that the entrypoint scripts depend on. Root cause: - docker-entrypoint.sh uses #!/usr/bin/env bash - ubi8-micro has no utilities pre-installed (unlike ubi8-minimal) - The chroot commands for user creation need /bin/sh, id, etc. This fix adds the missing packages that PR #17406 correctly included for the main image: - bash: Required for entrypoint scripts - coreutils: Basic commands (id, mkdir, cat, etc.) - findutils: File operations - util-linux: System utilities These packages enable the existing chroot user creation and locale setup commands to execute successfully. Fixes: ROX-30858 Related: #17406 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

Resolves merge conflicts from master's UBI 9 upgrade (ROX-33603) while preserving the ubi-micro branch's package_installer architecture. Changes: - Upgrade final stage from ubi8/ubi-micro to ubi9/ubi-micro - Update Go builder from RHEL 8 to RHEL 9 - Change PostgreSQL installation to releasever=9 - Update image labels from rhel8 to rhel9 - Sync nodejs-20 SHA with master - Maintain package_installer pattern for rpmdb preservation The ubi-micro approach uses a package_installer stage to preserve the minimal rpmdb from ubi-micro while installing packages via --installroot, resulting in a smaller final image compared to ubi-minimal. User request: merge master into ubi-micro branch, resolving UBI 9 conflicts while maintaining ubi-micro architecture. AI-assisted merge conflict resolution.

github-actions · 2026-03-24T17:23:30Z

/konflux-retest main-on-push

rhacs-bot · 2026-03-24T17:36:10Z

/retest

github-actions · 2026-03-24T17:55:27Z

/konflux-retest main-on-push

github-actions · 2026-03-24T18:23:39Z

/konflux-retest main-on-push

github-actions · 2026-03-24T19:33:16Z

/konflux-retest operator-bundle-on-push

openshift-ci · 2026-03-24T19:40:41Z

@janisz: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp-4-19-scanner-v4-install-tests	`d885375`	link	false	`/test ocp-4-19-scanner-v4-install-tests`
ci/prow/ocp-4-20-nongroovy-e2e-tests	`505607e`	link	false	`/test ocp-4-20-nongroovy-e2e-tests`
ci/prow/ocp-4-21-operator-e2e-tests	`505607e`	link	false	`/test ocp-4-21-operator-e2e-tests`
ci/prow/ocp-4-21-qa-e2e-tests	`505607e`	link	false	`/test ocp-4-21-qa-e2e-tests`
ci/prow/ocp-4-20-qa-e2e-tests	`505607e`	link	false	`/test ocp-4-20-qa-e2e-tests`
ci/prow/ocp-4-21-scanner-v4-install-tests	`505607e`	link	false	`/test ocp-4-21-scanner-v4-install-tests`
ci/prow/ocp-4-20-scanner-v4-install-tests	`505607e`	link	false	`/test ocp-4-20-scanner-v4-install-tests`
ci/prow/ocp-4-21-nongroovy-e2e-tests	`505607e`	link	false	`/test ocp-4-21-nongroovy-e2e-tests`
ci/prow/ocp-4-12-qa-e2e-tests	`505607e`	link	false	`/test ocp-4-12-qa-e2e-tests`
ci/prow/ocp-4-12-scanner-v4-install-tests	`505607e`	link	false	`/test ocp-4-12-scanner-v4-install-tests`
ci/prow/ocp-4-12-operator-e2e-tests	`505607e`	link	false	`/test ocp-4-12-operator-e2e-tests`
ci/prow/ocp-4-12-nongroovy-e2e-tests	`505607e`	link	false	`/test ocp-4-12-nongroovy-e2e-tests`
ci/prow/ocp-4-20-operator-e2e-tests	`505607e`	link	false	`/test ocp-4-20-operator-e2e-tests`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

github-actions · 2026-03-24T22:16:31Z

/konflux-retest operator-bundle-on-push

github-actions · 2026-03-25T00:58:47Z

/konflux-retest operator-bundle-on-push

Migrate both image/rhel/Dockerfile and image/rhel/konflux.Dockerfile from ubi9-minimal to ubi9-micro base images following the proven pattern from PR #19500 (roxctl migration). Changes: - Use multi-stage build with package_installer pattern - Install packages to /out/ using dnf --installroot - Preserve ubi9-micro rpmdb by copying before package installation - Move directory setup and save-dir-contents to package_installer stage - Remove HEALTHCHECK from Dockerfile (curl not available in ubi9-micro) - Pin SHA digests in konflux.Dockerfile for reproducible builds - Use --setopt=reposdir=/etc/yum.repos.d for Cachi2 compatibility Expected benefits: - 30-35% image size reduction (from ~450MB to ~350MB) - Smaller attack surface and reduced CVE exposure - Faster image pull/push operations This migration maintains full functionality while following the pattern established in PR #17406 and successfully merged in PR #19500. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

openshift-ci bot added the do-not-merge/work-in-progress label Oct 21, 2025

github-actions bot added the area/helm label Oct 21, 2025

janisz force-pushed the ubi-micro branch 5 times, most recently from 390b723 to 89a6e2e Compare October 22, 2025 06:38

janisz changed the title ~~WIP: ROX-30858: Migrate main image from ubi8-minimal to ubi8-micro~~ ROX-30858: Migrate main image from ubi8-minimal to ubi8-micro Oct 22, 2025

openshift-ci bot removed the do-not-merge/work-in-progress label Oct 22, 2025

janisz requested a review from BradLugo October 22, 2025 07:19

janisz added ci-all-qa-tests Tells CI to run all API tests (not just BAT). auto-retest PRs with this label will be automatically retested if prow checks fails ai-review ai-assisted labels Oct 22, 2025

This was referenced Oct 22, 2025

ROX-33563: Migrate scanner image to ubi-micro #17430

Open

ROX-30858: Migrate scanner DB image from ubi8-minimal to ubi8-micro #17431

Open

janisz requested a review from msugakov October 22, 2025 16:01

janisz changed the title ~~ROX-30858: Migrate main image from ubi8-minimal to ubi8-micro~~ ROX-30858: Migrate main image to ubi8-micro Oct 22, 2025

msugakov reviewed Oct 22, 2025

View reviewed changes

janisz requested a review from msugakov October 23, 2025 09:45

janisz force-pushed the ubi-micro branch from 89a6e2e to d885375 Compare October 30, 2025 12:46

janisz requested a review from a team as a code owner October 30, 2025 12:46

github-actions bot added the konflux-build Run Konflux in PR. Push commit to trigger it. label Oct 30, 2025

sourcery-ai bot reviewed Mar 20, 2026

View reviewed changes

image/rhel/Dockerfile Show resolved Hide resolved

msugakov reviewed Mar 20, 2026

View reviewed changes

janisz and others added 5 commits March 23, 2026 11:44

Update image/rhel/konflux.Dockerfile

094811c

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Update image/rhel/Dockerfile

664251b

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Apply suggestions from code review

26b876b

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

fix

753ce9e

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

Update image/rhel/Dockerfile

56f4c69

openshift-ci bot added the needs-rebase label Mar 23, 2026

Merge branch 'master' into ubi-micro

b30c520

openshift-ci bot removed the needs-rebase label Mar 24, 2026

stackrox deleted a comment from openshift-ci bot Mar 24, 2026

msugakov reviewed Mar 24, 2026

View reviewed changes

janisz changed the title ~~ROX-30858: Migrate main image to ubi8-micro~~ ROX-30858: Migrate main image to ubi-micro Mar 25, 2026

		COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/static-bin/* /out/stackrox/
		RUN chroot /out /stackrox/save-dir-contents /etc/pki/ca-trust /etc/ssl

Conversation

janisz commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Build Architecture

Related Work

Testing

Uh oh!

rhacs-bot commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

msugakov left a comment

Choose a reason for hiding this comment

Uh oh!

janisz commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

msugakov commented Oct 23, 2025

Uh oh!

rhacs-bot commented Oct 30, 2025

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

msugakov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

msugakov Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

janisz Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

msugakov Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

msugakov left a comment

Choose a reason for hiding this comment

Uh oh!

msugakov Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

msugakov Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

msugakov Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

msugakov Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 24, 2026

Uh oh!

rhacs-bot commented Mar 24, 2026

Uh oh!

github-actions bot commented Mar 24, 2026

Uh oh!

github-actions bot commented Mar 24, 2026

Uh oh!

github-actions bot commented Mar 24, 2026

Uh oh!

openshift-ci bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 24, 2026

Uh oh!

janisz commented Oct 21, 2025 •

edited

Loading

rhacs-bot commented Oct 21, 2025 •

edited

Loading

codecov bot commented Oct 21, 2025 •

edited

Loading

janisz commented Oct 23, 2025 •

edited

Loading

openshift-ci bot commented Mar 24, 2026 •

edited

Loading