Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature Request: Update container images to latest UBI baseimage #4227

Open
bencourliss opened this issue Jan 13, 2025 · 1 comment · May be fixed by #4228
Open

Feature Request: Update container images to latest UBI baseimage #4227

bencourliss opened this issue Jan 13, 2025 · 1 comment · May be fixed by #4228
Assignees
@omordyk
Labels
enhancement

Comments

@bencourliss
Copy link
Member

Is your feature request related to a problem? Please describe.

We should update all container images to UBI 9.5 to pull in security fixes and other updates.

Describe the solution you'd like.

Currently we are using UBI 9.2. There is a newer version, 9.5 available for all architectures (amd64, arm64, ppc64le, s390x). The Dockerfiles should change to FROM registry.access.redhat.com/ubi9/ubi-minimal:9.5

Additionally, some work should be done to see if we can support ubi-micro instead of ubi-minimal to reduce the threat surface attack area.

relates to #3852

Describe alternatives you've considered

No response

Additional context.

No response
@bencourliss bencourliss mentioned this issue Jan 13, 2025
Open
@naphelps
Copy link
Member

The Exchange uses registry.access.redhat.com/ubi9-minimal:latest as its base image. The packages are always up to date at the time of creating a container. The addition size shrinkage from going to the micro variant is moot presently for the mgmt hub, but this may be useful for storage constrained IoT devices in the field running an agent(Anax). Alternatively, project Ocre (https://lf-edge.atlassian.net/wiki/spaces/LE/pages/15832446/Project+Ocre) achieves this goal of space constrained devices better.

omordyk added a commit that referenced this issue Jan 15, 2025
@omordyk
#4227 Replace ubi9-minimal on ubi9-micro for docker build image
74001c0 
Use ubi-micro instead of ubi-minimal to reduce the threat surface attack area.

Signed-off-by: Oleksandr Mordyk <[email protected]>
@omordyk omordyk self-assigned this Jan 15, 2025
@omordyk omordyk linked a pull request Jan 15, 2025 that will close this issue
Open
12 tasks
@omordyk omordyk linked a pull request Jan 15, 2025 that will close this issue
Use ubi-micro instead of ubi-minimal to reduce the threat surface attack area. #4228
Open
12 tasks
omordyk added a commit that referenced this issue Jan 15, 2025
@omordyk
#4227 Replace ubi9-minimal on ubi9-micro for docker build image
f5084d0 
Use ubi-micro instead of ubi-minimal to reduce the threat surface attack area.

Signed-off-by: Oleksandr Mordyk <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@omordyk omordyk

Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Use ubi-micro instead of ubi-minimal to reduce the threat surface attack area. open-horizon/anax
3 participants
@bencourliss @naphelps @omordyk