ROX-34148: Migrate Dockerfiles to ubi9-micro base images

image/scanner/rhel/Dockerfile

@@ -1,14 +1,33 @@
-ARG BASE_REGISTRY=registry.access.redhat.com
-ARG BASE_IMAGE=ubi9-minimal
-ARG BASE_TAG=latest
+FROM registry.access.redhat.com/ubi9-micro:latest AS ubi-micro-base
 
-FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
+FROM registry.access.redhat.com/ubi9-minimal:latest AS extracted_bundle
 
 COPY bundle.tar.gz /
 WORKDIR /bundle
 RUN microdnf install -y tar gzip && tar -zxf /bundle.tar.gz
 
-FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS base
+FROM registry.access.redhat.com/ubi9:latest AS package_installer
+
+COPY --from=ubi-micro-base / /out/
+
+RUN dnf install -y \
+    --installroot=/out/ \
+    --releasever=9 \
+    --setopt=install_weak_deps=0 \
+    --nodocs \
+    findutils \
+    ca-certificates \
+    rpm \
+    xz \
+    gzip \
+    less \
+    tar && \
+    # curl is a transitive dependency of rpm but not needed in the scanner image
+    rpm --root=/out -e --nodeps curl && \
+    dnf clean all --installroot=/out/ && \
+    rm -rf /out/var/cache/dnf /out/var/cache/yum
+
+FROM ubi-micro-base AS base
 
 ARG LABEL_VERSION
 ARG LABEL_RELEASE
@@ -25,20 +44,15 @@ LABEL name="scanner" \
 
 SHELL ["/bin/sh", "-o", "pipefail", "-c"]
 
+COPY --from=package_installer /out/ /
+
 COPY scripts /
 
 COPY --from=extracted_bundle /bundle/scanner ./
 
 COPY --from=extracted_bundle /bundle/THIRD_PARTY_NOTICES/ /THIRD_PARTY_NOTICES/
 
-RUN microdnf upgrade -y --nobest && \
-    microdnf install -y xz && \
-    microdnf clean -y all && \
-    # (Optional) Remove line below to keep package management utilities
-    # We don't uninstall rpm because scanner uses it to get packages installed in scanned images.
-    rpm -e --nodeps $(rpm -qa curl '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \
-    rm -rf /var/cache/dnf /var/cache/yum && \
-    chown -R 65534:65534 /tmp && \
+RUN chown -R 65534:65534 /tmp && \
     # The contents of paths mounted as emptyDir volumes in Kubernetes are saved
     # by the script `save-dir-contents` during the image build. The directory
     # contents are then restored by the script `restore-all-dir-contents`

image/scanner/rhel/Dockerfile.slim

@@ -1,14 +1,33 @@
-ARG BASE_REGISTRY=registry.access.redhat.com
-ARG BASE_IMAGE=ubi9-minimal
-ARG BASE_TAG=latest
+FROM registry.access.redhat.com/ubi9-micro:latest AS ubi-micro-base
 
-FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
+FROM registry.access.redhat.com/ubi9-minimal:latest AS extracted_bundle
 
 COPY bundle.tar.gz /
 WORKDIR /bundle
 RUN microdnf install -y tar gzip && tar -zxf /bundle.tar.gz
 
-FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS base
+FROM registry.access.redhat.com/ubi9:latest AS package_installer
+
+COPY --from=ubi-micro-base / /out/
+
+RUN dnf install -y \
+    --installroot=/out/ \
+    --releasever=9 \
+    --setopt=install_weak_deps=0 \
+    --nodocs \
+    findutils \
+    ca-certificates \
+    rpm \
+    xz \
+    gzip \
+    less \
+    tar && \
+    # curl is a transitive dependency of rpm but not needed in the scanner image
+    rpm --root=/out -e --nodeps curl && \
+    dnf clean all --installroot=/out/ && \
+    rm -rf /out/var/cache/dnf /out/var/cache/yum
+
+FROM ubi-micro-base AS base
 
 ARG LABEL_VERSION
 ARG LABEL_RELEASE
@@ -25,20 +44,15 @@ LABEL name="scanner-slim" \
 
 SHELL ["/bin/sh", "-o", "pipefail", "-c"]
 
+COPY --from=package_installer /out/ /
+
 COPY scripts /
 
 COPY --from=extracted_bundle /bundle/scanner ./
 
 COPY --from=extracted_bundle /bundle/THIRD_PARTY_NOTICES/ /THIRD_PARTY_NOTICES/
 
-RUN microdnf upgrade -y --nobest && \
-    microdnf install -y xz && \
-    microdnf clean -y all && \
-    # (Optional) Remove line below to keep package management utilities
-    # We don't uninstall rpm because scanner uses it to get packages installed in scanned images.
-    rpm -e --nodeps $(rpm -qa curl '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \
-    rm -rf /var/cache/dnf /var/cache/yum && \
-    chown -R 65534:65534 /tmp && \
+RUN chown -R 65534:65534 /tmp && \
     # The contents of paths mounted as emptyDir volumes in Kubernetes are saved
     # by the script `save-dir-contents` during the image build. The directory
     # contents are then restored by the script `restore-all-dir-contents`

image/scanner/rhel/konflux.Dockerfile

@@ -27,8 +27,33 @@ RUN echo -n "version: " && make --quiet --no-print-directory tag && \
 COPY .konflux/scanner-data/blob-genesis_manifests.json image/scanner/dump/genesis_manifests.json
 
 
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:093a704be0eaef9bb52d9bc0219c67ee9db13c2e797da400ddb5d5ae6849fa10 AS ubi-micro-base
+
+FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:6ed9f6f637fe731d93ec60c065dbced79273f1e0b5f512951f2c0b0baedb16ad AS package_installer
+
+COPY --from=ubi-micro-base / /out/
+
+RUN dnf install -y \
+    --installroot=/out/ \
+    --releasever=9 \
+    --setopt=install_weak_deps=0 \
+    --setopt=reposdir=/etc/yum.repos.d \
+    --nodocs \
+    findutils \
+    ca-certificates \
+    rpm \
+    xz \
+    gzip \
+    less \
+    tar \
+    openssl && \
+    # curl is a transitive dependency of rpm but not needed in the scanner image
+    rpm --root=/out -e --nodeps curl && \
+    dnf clean all --installroot=/out/ && \
+    rm -rf /out/var/cache/dnf /out/var/cache/yum
+
 # Common base for scanner slim and full
-FROM registry.access.redhat.com/ubi9-minimal:latest@sha256:ae09ecc3d754bc1726cbda3e2599cc7839e09fe1cc547ce173cf669b645be3cc AS scanner-common
+FROM ubi-micro-base AS scanner-common
 
 ARG SCANNER_TAG
 
@@ -52,20 +77,16 @@ SHELL ["/bin/sh", "-o", "pipefail", "-c"]
 
 ENV REPO_TO_CPE_DIR="/repo2cpe"
 
+COPY --from=package_installer /out/ /
+
 COPY --from=builder /src/image/scanner/scripts /
 COPY --from=builder /src/image/scanner/bin/scanner ./
 COPY --chown=65534:65534 --from=builder "/src/image/scanner/dump${REPO_TO_CPE_DIR}/" ".${REPO_TO_CPE_DIR}/"
 COPY --chown=65534:65534 --from=builder /src/image/scanner/dump/genesis_manifests.json ./
 
 COPY LICENSE /licenses/LICENSE
 
-RUN microdnf install -y xz && \
-    microdnf clean all && \
-    # (Optional) Remove line below to keep package management utilities
-    # We don't uninstall rpm because scanner uses it to get packages installed in scanned images.
-    rpm -e --nodeps $(rpm -qa curl '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \
-    rm -rf /var/cache/dnf /var/cache/yum && \
-    chown -R 65534:65534 /tmp && \
+RUN chown -R 65534:65534 /tmp && \
     # The contents of paths mounted as emptyDir volumes in Kubernetes are saved
     # by the script `save-dir-contents` during the image build. The directory
     # contents are then restored by the script `restore-all-dir-contents`

image/scanner/scripts/entrypoint.sh

@@ -5,4 +5,4 @@ set -euo pipefail
 /restore-all-dir-contents
 /import-additional-cas
 
-exec /scanner
+exec /scanner "$@"

image/vulnerabilities/Dockerfile

@@ -1,8 +1,4 @@
-ARG BASE_REGISTRY=registry.access.redhat.com
-ARG BASE_IMAGE=ubi9-minimal
-ARG BASE_TAG=latest
-
-FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
+FROM registry.access.redhat.com/ubi9-micro:latest
 
 ARG LABEL_VERSION
 ARG LABEL_RELEASE

rpms.in.yaml

@@ -2,13 +2,24 @@
 # See our docs here: https://spaces.redhat.com/display/StackRox/How+to+prefetch+RPMs+for+ACS+Konflux+builds
 
 packages:
+# Scanner packages (for konflux.Dockerfile stage: package_installer)
+# These packages are installed on top of ubi9-micro base image
+# Note: rpm is required by scanner binary to query packages in scanned images
+- findutils
+- ca-certificates
+- rpm
 - xz
+- gzip
+- less
+- tar
+- openssl
+
 contentOrigin:
   repofiles: [ "rpms.rhel.repo" ]
+
 context:
-  containerfile:
-    file: image/scanner/rhel/konflux.Dockerfile
-    stageName: scanner-common
+  bare: true
+
 arches:
 - aarch64
 - ppc64le