Skip to content

ROX-30858: Migrate main image Dockerfiles to ubi9-micro#19653

Open
janisz wants to merge 1 commit intomasterfrom
ROX-30858/migrate_main_to_ubi_micro
Open

ROX-30858: Migrate main image Dockerfiles to ubi9-micro#19653
janisz wants to merge 1 commit intomasterfrom
ROX-30858/migrate_main_to_ubi_micro

Conversation

@janisz
Copy link
Copy Markdown
Contributor

@janisz janisz commented Mar 27, 2026

Description

Migrate both image/rhel/Dockerfile and image/rhel/konflux.Dockerfile from ubi9-minimal to ubi9-micro base images.

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

@janisz janisz requested review from a team and rhacs-bot as code owners March 27, 2026 13:11
@rhacs-bot rhacs-bot requested a review from a team March 27, 2026 13:11
@github-actions github-actions bot added area/helm konflux-build Run Konflux in PR. Push commit to trigger it. labels Mar 27, 2026
@janisz @claude
ROX-30858: Migrate main image Dockerfiles to ubi9-micro
57976be 
Migrate both image/rhel/Dockerfile and image/rhel/konflux.Dockerfile from
ubi9-minimal to ubi9-micro base images following the proven pattern from
PR #19500 (roxctl migration).

Changes:
- Use multi-stage build with package_installer pattern
- Install packages to /out/ using dnf --installroot
- Preserve ubi9-micro rpmdb by copying before package installation
- Move directory setup and save-dir-contents to package_installer stage
- Remove HEALTHCHECK from Dockerfile (curl not available in ubi9-micro)
- Pin SHA digests in konflux.Dockerfile for reproducible builds
- Use --setopt=reposdir=/etc/yum.repos.d for Cachi2 compatibility

Expected benefits:
- 30-35% image size reduction (from ~450MB to ~350MB)
- Smaller attack surface and reduced CVE exposure
- Faster image pull/push operations

This migration maintains full functionality while following the pattern
established in PR #17406 and successfully merged in PR #19500.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>
@janisz janisz force-pushed the ROX-30858/migrate_main_to_ubi_micro branch from d3344ba to 57976be Compare March 27, 2026 13:25
@rhacs-bot
Copy link
Copy Markdown
Contributor

rhacs-bot commented Mar 27, 2026 •
edited
Loading

Images are ready for the commit at 57976be.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-469-g57976be6f0.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 27, 2026

/konflux-retest main-on-push

2 similar comments
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 27, 2026

/konflux-retest main-on-push

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 27, 2026

/konflux-retest main-on-push

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 27, 2026

/konflux-retest roxctl-on-push

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 27, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.37%. Comparing base (42bd5ac) to head (57976be).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master   #19653   +/-   ##
=======================================
  Coverage   49.36%   49.37%           
=======================================
  Files        2742     2743    +1     
  Lines      206999   207019   +20     
=======================================
+ Hits       102194   102223   +29     
+ Misses      97222    97214    -8     
+ Partials     7583     7582    -1
Flag Coverage Δ
go-unit-tests 49.37% <ø> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 27, 2026

/konflux-retest operator-bundle-on-push

2 similar comments
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 27, 2026

/konflux-retest operator-bundle-on-push

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 27, 2026

/konflux-retest operator-bundle-on-push

@janisz
Copy link
Copy Markdown
Contributor Author

janisz commented Mar 27, 2026

/retest

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 27, 2026

@janisz: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/ocp-4-21-qa-e2e-tests 57976be link false /test ocp-4-21-qa-e2e-tests
ci/prow/ocp-4-21-nongroovy-e2e-tests 57976be link false /test ocp-4-21-nongroovy-e2e-tests
ci/prow/gke-nongroovy-e2e-tests 57976be link true /test gke-nongroovy-e2e-tests
ci/prow/ocp-4-12-qa-e2e-tests 57976be link false /test ocp-4-12-qa-e2e-tests
ci/prow/ocp-4-12-nongroovy-e2e-tests 57976be link false /test ocp-4-12-nongroovy-e2e-tests
ci/prow/ocp-4-21-operator-e2e-tests 57976be link false /test ocp-4-21-operator-e2e-tests
ci/prow/ocp-4-12-operator-e2e-tests 57976be link false /test ocp-4-12-operator-e2e-tests
ci/prow/ocp-4-12-scanner-v4-install-tests 57976be link false /test ocp-4-12-scanner-v4-install-tests
ci/prow/ocp-4-21-scanner-v4-install-tests 57976be link false /test ocp-4-21-scanner-v4-install-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rhacs-bot rhacs-bot Awaiting requested review from rhacs-bot rhacs-bot is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

area/helm konflux-build Run Konflux in PR. Push commit to trigger it.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@janisz @rhacs-bot