From d06edffaa2b44710f12044ad0b18986cef57b50b Mon Sep 17 00:00:00 2001 From: Dale Haiducek <19750917+dhaiducek@users.noreply.github.com> Date: Fri, 12 Jun 2026 13:36:28 -0400 Subject: [PATCH] :seedling: chore: update base image to distroless (#1556) * chore: update base image to distroless Reduces attack surface of the image and increase CVE maintainability Signed-off-by: Jian Qiu * fix: set default for `SKIP_IMAGE_BUILD` Signed-off-by: Dale Haiducek <19750917+dhaiducek@users.noreply.github.com> --------- Signed-off-by: Jian Qiu Signed-off-by: Dale Haiducek <19750917+dhaiducek@users.noreply.github.com> Co-authored-by: Jian Qiu --- .github/workflows/post.yml | 2 +- .github/workflows/releaseimage.yml | 2 +- build/Dockerfile.addon | 2 +- build/Dockerfile.placement | 2 +- build/Dockerfile.registration | 2 +- build/Dockerfile.registration-operator | 2 +- build/Dockerfile.work | 2 +- test/e2e-test.mk | 1 + 8 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/post.yml b/.github/workflows/post.yml index 07bff22d4..0764981ef 100644 --- a/.github/workflows/post.yml +++ b/.github/workflows/post.yml @@ -60,7 +60,7 @@ jobs: - name: install imagebuilder run: go install github.com/openshift/imagebuilder/cmd/imagebuilder@v1.2.3 - name: pull base image - run: docker pull registry.access.redhat.com/ubi9/ubi-minimal:latest --platform=linux/${{ matrix.arch }} + run: docker pull registry.access.redhat.com/ubi9/ubi-micro:latest --platform=linux/${{ matrix.arch }} - name: images run: | IMAGE_TAG=latest-${{ matrix.arch }} \ diff --git a/.github/workflows/releaseimage.yml b/.github/workflows/releaseimage.yml index ffb8bebb6..fb6da0468 100644 --- a/.github/workflows/releaseimage.yml +++ b/.github/workflows/releaseimage.yml @@ -61,7 +61,7 @@ jobs: - name: install imagebuilder run: go install github.com/openshift/imagebuilder/cmd/imagebuilder@v1.2.3 - name: pull base image - run: docker pull registry.access.redhat.com/ubi9/ubi-minimal:latest --platform=linux/${{ matrix.arch }} + run: docker pull registry.access.redhat.com/ubi9/ubi-micro:latest --platform=linux/${{ matrix.arch }} - name: images run: | IMAGE_TAG=${{ needs.env.outputs.RELEASE_VERSION }}-${{ matrix.arch }} \ diff --git a/build/Dockerfile.addon b/build/Dockerfile.addon index ec52c3815..38fb739e6 100644 --- a/build/Dockerfile.addon +++ b/build/Dockerfile.addon @@ -10,7 +10,7 @@ RUN GOOS=${OS} \ GO_BUILD_PACKAGES=./cmd/addon \ make build --warn-undefined-variables -FROM registry.access.redhat.com/ubi9/ubi-minimal:latest +FROM registry.access.redhat.com/ubi9/ubi-micro:latest ENV USER_UID=10001 COPY --from=builder /go/src/open-cluster-management.io/ocm/addon / diff --git a/build/Dockerfile.placement b/build/Dockerfile.placement index 7f1fe23c2..429a3b264 100644 --- a/build/Dockerfile.placement +++ b/build/Dockerfile.placement @@ -10,7 +10,7 @@ RUN GOOS=${OS} \ GO_BUILD_PACKAGES=./cmd/placement \ make build --warn-undefined-variables -FROM registry.access.redhat.com/ubi9/ubi-minimal:latest +FROM registry.access.redhat.com/ubi9/ubi-micro:latest ENV USER_UID=10001 COPY --from=builder /go/src/open-cluster-management.io/ocm/placement / diff --git a/build/Dockerfile.registration b/build/Dockerfile.registration index 4e9bc3165..f821bf48f 100644 --- a/build/Dockerfile.registration +++ b/build/Dockerfile.registration @@ -15,7 +15,7 @@ RUN GOOS=${OS} \ GO_BUILD_PACKAGES=./cmd/server \ make build --warn-undefined-variables -FROM registry.access.redhat.com/ubi9/ubi-minimal:latest +FROM registry.access.redhat.com/ubi9/ubi-micro:latest ENV USER_UID=10001 COPY --from=builder /go/src/open-cluster-management.io/ocm/registration / diff --git a/build/Dockerfile.registration-operator b/build/Dockerfile.registration-operator index 6ebdb2f25..4615a80eb 100644 --- a/build/Dockerfile.registration-operator +++ b/build/Dockerfile.registration-operator @@ -10,7 +10,7 @@ RUN GOOS=${OS} \ GO_BUILD_PACKAGES=./cmd/registration-operator \ make build --warn-undefined-variables -FROM registry.access.redhat.com/ubi9/ubi-minimal:latest +FROM registry.access.redhat.com/ubi9/ubi-micro:latest ENV USER_UID=10001 COPY --from=builder /go/src/open-cluster-management.io/ocm/registration-operator / diff --git a/build/Dockerfile.work b/build/Dockerfile.work index b6fd8d527..7efbcb626 100644 --- a/build/Dockerfile.work +++ b/build/Dockerfile.work @@ -10,7 +10,7 @@ RUN GOOS=${OS} \ GO_BUILD_PACKAGES=./cmd/work \ make build --warn-undefined-variables -FROM registry.access.redhat.com/ubi9/ubi-minimal:latest +FROM registry.access.redhat.com/ubi9/ubi-micro:latest ENV USER_UID=10001 COPY --from=builder /go/src/open-cluster-management.io/ocm/work / diff --git a/test/e2e-test.mk b/test/e2e-test.mk index 6b9045bf0..25ba36397 100644 --- a/test/e2e-test.mk +++ b/test/e2e-test.mk @@ -64,6 +64,7 @@ apply-hub-cr: # E2E test target # Set SKIP_IMAGE_BUILD=true to skip image building and loading (useful when only test code changes) +SKIP_IMAGE_BUILD?=false ifeq ($(SKIP_IMAGE_BUILD),true) test-e2e: deploy-hub deploy-spoke-operator-helm run-e2e else