From c79a0e6bf84e1c3f9a7005e3093d59fab42ebe88 Mon Sep 17 00:00:00 2001 From: Guzman Date: Wed, 26 Aug 2026 08:27:28 +0000 Subject: [PATCH] CMP-4572: Switch runtime base image to ubi9-minimal-pqc for PQC support Switch the Dockerfile.openshift runtime stage base image from registry.redhat.io/rhel9-4-els/rhel-minimal to registry.redhat.io/ubi9/ubi-minimal-pqc to enable Post-Quantum Cryptography (PQC) support via the DEFAULT:PQ crypto policy in OpenSSL, as required by OCPSTRAT-3113. Also fix the runtime package install: libbpf-devel -> libbpf. The runtime only needs the shared library, not headers. This also fixes the root cause of the stale PR #109 (CMP-3943) CI failure, which dropped libbpf entirely while BPF_ENABLED=1 was set. The ubi-minimal-pqc image is identical to ubi-minimal except it ships with the DEFAULT:PQ crypto policy pre-configured, enabling ML-KEM (post-quantum key encapsulation) in OpenSSL on RHEL 9. Tested: built operator image, deployed to OCP 4.22 cluster, verified DEFAULT:PQ crypto policy is active, seccomp profiles propagate to all nodes and enforce at the kernel level, log-enricher and spoc CLI both function correctly. Fixes: CMP-4572 --- Dockerfile.openshift | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile.openshift b/Dockerfile.openshift index 198a393e03..68563c912e 100644 --- a/Dockerfile.openshift +++ b/Dockerfile.openshift @@ -18,9 +18,9 @@ ARG STATIC_LINK=no RUN make -FROM registry.redhat.io/rhel9-4-els/rhel-minimal:latest +FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest -RUN INSTALL_PKGS="tar libseccomp libbpf-devel" && \ +RUN INSTALL_PKGS="tar libseccomp libbpf" && \ if [ ! -e /usr/bin/dnf ]; then ln -s /usr/bin/microdnf /usr/bin/dnf; fi && \ dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \ dnf clean all && rm -rf /var/cache/*