ROX-33563: Migrate scanner image to ubi-micro by janisz · Pull Request #17430 · stackrox/stackrox

janisz · 2025-10-22T08:01:01Z

Migrate scanner images from ubi8-minimal to ubi8-micro following the same best practices used for collector migration.

Tested:

  export KUBECONFIG=/tmp/tests/kubeconfig
  kubectl -n stackrox set image deployment/central \
    central=quay.io/rhacs-eng/release-main:4.11.0-388-gc4b4bc65c1-fast
  kubectl -n stackrox set image deployment/scanner-v4-indexer \
    indexer=quay.io/rhacs-eng/release-scanner-v4:4.11.0-394-g97746fa495-fast

  kubectl -n stackrox set image deployment/scanner-v4-matcher \
    matcher=quay.io/rhacs-eng/release-scanner-v4:4.11.0-394-g97746fa495-fast

  kubectl -n stackrox rollout status deployment/central --timeout=5m
  kubectl -n stackrox rollout status deployment/scanner-v4-indexer --timeout=5m
  kubectl -n stackrox rollout status deployment/scanner-v4-matcher --timeout=5m

Then check in UI if everything is healthy and followed and check if scanner is working

roxctl --insecure-skip-tls-verify image scan --image=quay.io/rhacs-eng/release-scanner-v4:4.11.0-394-g97746fa495-fast --output=table
Scan results for image: quay.io/rhacs-eng/release-scanner-v4:4.11.0-394-g97746fa495-fast
   (TOTAL-COMPONENTS: 19, TOTAL-VULNERABILITIES: 50, LOW: 41, MODERATE: 9, IMPORTANT: 0, CRITICAL: 0)
   ```

rhacs-bot · 2025-10-22T08:24:25Z

Images are ready for the commit at e5ba21f.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.10.x-80-ge5ba21f2af.

codecov · 2025-10-22T08:41:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.32%. Comparing base (4f8098a) to head (48486bb).
⚠️ Report is 21 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #17430      +/-   ##
==========================================
+ Coverage   49.28%   49.32%   +0.04%     
==========================================
  Files        2735     2737       +2     
  Lines      206215   206445     +230     
==========================================
+ Hits       101633   101838     +205     
- Misses      97041    97062      +21     
- Partials     7541     7545       +4

Flag	Coverage Δ
go-unit-tests	`49.32% <ø> (+0.04%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

janisz · 2025-10-22T16:16:36Z

/retest

scanner/image/scanner/Dockerfile

The scanner-v4-indexer and scanner-v4-matcher containers were crashing immediately with exit code 1 because the migration to ubi8-micro removed essential shell utilities that the entrypoint scripts depend on. Root cause: - entrypoint.sh uses #!/usr/bin/env bash - ubi8-micro has no utilities pre-installed (unlike ubi8-minimal) - The container fails immediately when trying to execute the bash script This fix applies the same multi-stage build pattern used in: - PR #17406 for the main image - commit cc55af9 for scanner-v4-db Changes: 1. Added dependency_builder stage using ubi8 (full) 2. Install bash, coreutils, findutils, util-linux, ca-certificates to /out/ 3. Copy dependencies from builder to ubi8-micro final stage 4. Removed microdnf/rpm operations from final stage (not available in ubi8-micro) 5. Changed BASE_IMAGE from ubi8-minimal to ubi8-micro This enables the entrypoint scripts to execute successfully while maintaining the minimal footprint of ubi8-micro. Fixes: ROX-30858 Related: #17406, #17430 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

rhacs-bot · 2025-10-23T18:30:23Z

/retest

rhacs-bot · 2025-10-23T19:59:15Z

/retest

rhacs-bot · 2025-10-23T20:12:41Z

/retest

rhacs-bot · 2025-10-23T21:12:09Z

Images are ready for the commit at 39afde2.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-337-g39afde24e7.

dcaravel

IIUC this may break image scanners

scanner/image/scanner/Dockerfile

The scanner-v4-indexer and scanner-v4-matcher containers were crashing immediately with exit code 1 because the migration to ubi8-micro removed essential shell utilities that the entrypoint scripts depend on. Root cause: - entrypoint.sh uses #!/usr/bin/env bash - ubi8-micro has no utilities pre-installed (unlike ubi8-minimal) - The container fails immediately when trying to execute the bash script This fix applies the same multi-stage build pattern used in: - PR #17406 for the main image - commit cc55af9 for scanner-v4-db Changes: 1. Added dependency_builder stage using ubi8 (full) 2. Install bash, coreutils, findutils, util-linux, ca-certificates to /out/ 3. Copy dependencies from builder to ubi8-micro final stage 4. Removed microdnf/rpm operations from final stage (not available in ubi8-micro) 5. Changed BASE_IMAGE from ubi8-minimal to ubi8-micro This enables the entrypoint scripts to execute successfully while maintaining the minimal footprint of ubi8-micro. Fixes: ROX-30858 Related: #17406, #17430 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

msugakov · 2026-03-20T16:59:34Z

scanner/image/scanner/Dockerfile

 ARG MAPPINGS_REGISTRY=registry.access.redhat.com
 ARG MAPPINGS_BASE_IMAGE=ubi8
 ARG MAPPINGS_BASE_TAG=latest
+ARG RPMS_REGISTRY=registry.access.redhat.com
+ARG RPMS_BASE_IMAGE=ubi8
+ARG RPMS_BASE_TAG=latest
 ARG BASE_REGISTRY=registry.access.redhat.com
-ARG BASE_IMAGE=ubi8-minimal
+ARG BASE_IMAGE=ubi8-micro
 ARG BASE_TAG=latest


If the scanner team does not object, I suggest getting rid of these ARGs similar to how I described here #17406 (comment)

scanner/image/scanner/Dockerfile

scanner/image/scanner/konflux.Dockerfile

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

gitguardian · 2026-03-23T17:29:02Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
28930366	Triggered	Generic High Entropy Secret	`557483a`	sensor/kubernetes/fake/secret.go	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

Complete scanner UBI 9 upgrade while preserving ubi-micro architecture. Resolved conflicts in scanner Dockerfiles: - Updated all ubi8 references to ubi9 - Updated releasever from 8 to 9 - Preserved package_installer pattern with ubi9/ubi-micro - Updated save-dir-contents path to /etc/pki/ca-trust/source - Kept direct FROM statements (not ARG-based) User request: merge master and resolve conflicts after UBI 9 upgrade. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

rhacs-bot · 2026-03-24T19:10:51Z

Images are ready for the commit at 48486bb.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-466-g48486bbafd.

dcaravel

Few nits for consideration - also believe title of PR should read ubi9-micro (currently says ubi8)

Thanks for taking care of this!

scanner/image/scanner/konflux.Dockerfile

scanner/image/scanner/Dockerfile

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

…eed them Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

scanner/image/scanner/Dockerfile

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

janisz · 2026-03-26T14:44:46Z

/retest

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

janisz · 2026-03-27T12:40:02Z

/retest

rhacs-bot · 2026-03-27T15:01:48Z

/retest

openshift-ci · 2026-03-27T17:34:17Z

@janisz: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp-4-20-scanner-v4-install-tests	`e78bb32`	link	false	`/test ocp-4-20-scanner-v4-install-tests`
ci/prow/ocp-4-12-scanner-v4-install-tests	`48486bb`	link	false	`/test ocp-4-12-scanner-v4-install-tests`
ci/prow/gke-scanner-v4-install-tests	`48486bb`	link	false	`/test gke-scanner-v4-install-tests`
ci/prow/ocp-4-21-scanner-v4-install-tests	`48486bb`	link	false	`/test ocp-4-21-scanner-v4-install-tests`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

janisz requested a review from a team as a code owner October 22, 2025 08:01

github-actions bot added the area/scanner label Oct 22, 2025

janisz changed the title ~~ROX-30858: Migrate scanner image from ubi8-minimal to ubi8-micro~~ WIP: ROX-30858: Migrate scanner image from ubi8-minimal to ubi8-micro Oct 22, 2025

openshift-ci bot added the do-not-merge/work-in-progress label Oct 22, 2025

janisz mentioned this pull request Oct 22, 2025

ROX-30858: Migrate scanner DB image from ubi8-minimal to ubi8-micro #17431

Open

janisz added the auto-retest PRs with this label will be automatically retested if prow checks fails label Oct 22, 2025

janisz commented Oct 22, 2025

View reviewed changes

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

janisz changed the title ~~WIP: ROX-30858: Migrate scanner image from ubi8-minimal to ubi8-micro~~ WIP: ROX-30858: Migrate scanner image to ubi8-micro Oct 24, 2025

janisz changed the title ~~WIP: ROX-30858: Migrate scanner image to ubi8-micro~~ ROX-30858: Migrate scanner image to ubi8-micro Oct 29, 2025

openshift-ci bot removed the do-not-merge/work-in-progress label Oct 29, 2025

dcaravel requested changes Nov 26, 2025

View reviewed changes

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

janisz changed the title ~~ROX-30858: Migrate scanner image to ubi8-micro~~ ROX-33563: Migrate scanner image to ubi8-micro Mar 11, 2026

janisz added the konflux-build Run Konflux in PR. Push commit to trigger it. label Mar 11, 2026

janisz force-pushed the ubi-mirco-scanner branch from 7ec8ef2 to 8761059 Compare March 11, 2026 13:16

janisz requested review from a team and rhacs-bot as code owners March 11, 2026 13:16

rhacs-bot requested a review from a team March 11, 2026 13:16

janisz force-pushed the ubi-mirco-scanner branch 2 times, most recently from 53adcac to 400c63d Compare March 16, 2026 14:47

msugakov reviewed Mar 20, 2026

View reviewed changes

janisz and others added 7 commits March 23, 2026 11:39

Update scanner/image/scanner/konflux.Dockerfile

4d8f51e

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Apply suggestion from @msugakov

0a74399

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Apply suggestion from @msugakov

08cccc6

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Apply suggestion from @msugakov

8416bfa

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

fix comment

2eb02ea

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

remove args

e672b40

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

Apply suggestion from @janisz

934fe1e

openshift-ci bot added the needs-rebase label Mar 23, 2026

Merge branch 'master' into ubi-mirco-scanner

557483a

openshift-ci bot removed the needs-rebase label Mar 23, 2026

dcaravel approved these changes Mar 25, 2026

View reviewed changes

scanner/image/scanner/konflux.Dockerfile Show resolved Hide resolved

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

janisz added 5 commits March 25, 2026 08:34

Merge branch 'master' into ubi-mirco-scanner

1a4eebe

Apply suggestion from @janisz

0ddcc29

Apply suggestion from @janisz

0614429

fix

1ef0139

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

WIP: just for testing remove findutils and util-linx to check if we n…

c3162fe

…eed them Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

janisz commented Mar 25, 2026

View reviewed changes

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

janisz changed the title ~~ROX-33563: Migrate scanner image to ubi8-micro~~ ROX-33563: Migrate scanner image to ubi-micro Mar 25, 2026

janisz added 2 commits March 25, 2026 10:14

move comment to rpms.in.yaml

e78bb32

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

remove findutils and util-linux

1ae3297

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

add missing pacakges

48486bb

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

stackrox deleted a comment from rhacs-bot Mar 27, 2026

Conversation

janisz commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rhacs-bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

janisz commented Oct 22, 2025

Uh oh!

Uh oh!

rhacs-bot commented Oct 23, 2025

Uh oh!

rhacs-bot commented Oct 23, 2025

Uh oh!

rhacs-bot commented Oct 23, 2025

Uh oh!

rhacs-bot commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dcaravel left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

msugakov Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gitguardian bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

rhacs-bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dcaravel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

janisz commented Mar 26, 2026

Uh oh!

janisz commented Mar 27, 2026

Uh oh!

rhacs-bot commented Mar 27, 2026

Uh oh!

openshift-ci bot commented Mar 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

janisz commented Oct 22, 2025 •

edited

Loading

rhacs-bot commented Oct 22, 2025 •

edited

Loading

codecov bot commented Oct 22, 2025 •

edited

Loading

rhacs-bot commented Oct 23, 2025 •

edited

Loading

dcaravel left a comment •

edited

Loading

gitguardian bot commented Mar 23, 2026 •

edited

Loading

rhacs-bot commented Mar 24, 2026 •

edited

Loading