Skip to content

ROX-30858: Migrate main image Dockerfiles to ubi9-micro#19653

Open
janisz wants to merge 1 commit intomasterfrom
ROX-30858/migrate_main_to_ubi_micro
Open

ROX-30858: Migrate main image Dockerfiles to ubi9-micro#19653
janisz wants to merge 1 commit intomasterfrom
ROX-30858/migrate_main_to_ubi_micro

Conversation

@janisz
Copy link
Copy Markdown
Contributor

@janisz janisz commented Mar 27, 2026

Description

Migrate both image/rhel/Dockerfile and image/rhel/konflux.Dockerfile from ubi9-minimal to ubi9-micro base images.

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

@janisz janisz requested review from a team and rhacs-bot as code owners March 27, 2026 13:11
@rhacs-bot rhacs-bot requested a review from a team March 27, 2026 13:11
@github-actions github-actions bot added area/helm konflux-build Run Konflux in PR. Push commit to trigger it. labels Mar 27, 2026
@janisz janisz force-pushed the ROX-30858/migrate_main_to_ubi_micro branch from d3344ba to 57976be Compare March 27, 2026 13:25
@rhacs-bot
Copy link
Copy Markdown
Contributor

rhacs-bot commented Mar 27, 2026

Images are ready for the commit at aedfb9a.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-483-gaedfb9adb4.

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 27, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.40%. Comparing base (df8c4bc) to head (aedfb9a).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #19653   +/-   ##
=======================================
  Coverage   49.39%   49.40%           
=======================================
  Files        2745     2745           
  Lines      207225   207225           
=======================================
+ Hits       102368   102374    +6     
+ Misses      97265    97259    -6     
  Partials     7592     7592           
Flag Coverage Δ
go-unit-tests 49.40% <ø> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@janisz
Copy link
Copy Markdown
Contributor Author

janisz commented Mar 27, 2026

/retest

1 similar comment
@janisz
Copy link
Copy Markdown
Contributor Author

janisz commented Mar 30, 2026

/retest

Migrate both image/rhel/Dockerfile and image/rhel/konflux.Dockerfile from
ubi9-minimal to ubi9-micro base images following the proven pattern from
PR #19500 (roxctl migration).

Changes:
- Use multi-stage build with package_installer pattern
- Install packages to /out/ using dnf --installroot
- Preserve ubi9-micro rpmdb by copying before package installation
- Move directory setup and save-dir-contents to package_installer stage
- Remove HEALTHCHECK from Dockerfile (curl not available in ubi9-micro)
- Pin SHA digests in konflux.Dockerfile for reproducible builds
- Use --setopt=reposdir=/etc/yum.repos.d for Cachi2 compatibility

Expected benefits:
- 30-35% image size reduction (from ~450MB to ~350MB)
- Smaller attack surface and reduced CVE exposure
- Faster image pull/push operations

This migration maintains full functionality while following the pattern
established in PR #17406 and successfully merged in PR #19500.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>
@janisz janisz force-pushed the ROX-30858/migrate_main_to_ubi_micro branch from 57976be to aedfb9a Compare March 30, 2026 15:33
@janisz janisz added the auto-retest PRs with this label will be automatically retested if prow checks fails label Mar 30, 2026
@github-actions
Copy link
Copy Markdown
Contributor

/konflux-retest operator-bundle-on-push

2 similar comments
@github-actions
Copy link
Copy Markdown
Contributor

/konflux-retest operator-bundle-on-push

@github-actions
Copy link
Copy Markdown
Contributor

/konflux-retest operator-bundle-on-push

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 30, 2026

@janisz: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/ocp-4-12-nongroovy-e2e-tests aedfb9a link false /test ocp-4-12-nongroovy-e2e-tests
ci/prow/ocp-4-12-operator-e2e-tests aedfb9a link false /test ocp-4-12-operator-e2e-tests
ci/prow/ocp-4-12-qa-e2e-tests aedfb9a link false /test ocp-4-12-qa-e2e-tests
ci/prow/ocp-4-21-operator-e2e-tests aedfb9a link false /test ocp-4-21-operator-e2e-tests
ci/prow/ocp-4-21-nongroovy-e2e-tests aedfb9a link false /test ocp-4-21-nongroovy-e2e-tests
ci/prow/ocp-4-21-qa-e2e-tests aedfb9a link false /test ocp-4-21-qa-e2e-tests
ci/prow/ocp-4-12-scanner-v4-install-tests aedfb9a link false /test ocp-4-12-scanner-v4-install-tests
ci/prow/ocp-4-21-scanner-v4-install-tests aedfb9a link false /test ocp-4-21-scanner-v4-install-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/helm auto-retest PRs with this label will be automatically retested if prow checks fails konflux-build Run Konflux in PR. Push commit to trigger it.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants