ROX-33562: Migrate main image Dockerfiles to ubi9-micro

[janisz]

Description

This commit migrates the main container image from ubi-minimal (~92 MB) to ubi-micro (~28 MB) base image, reducing the final image size and improving security posture by minimizing the attack surface.

Changes

• Base image: ubi8-minimal (~92 MB) → ubi8-micro (~28 MB)
• Build strategy: Multi-stage build with ubi8 builder for dependencies
• Final image size: 188 MB → 122 MB

Build Architecture

1. Builder stage (ubi8): Install runtime dependencies using dnf/rpm
2. Final stage (ubi8-micro): Copy dependencies, no package managers

Related Work

This continues the image optimization efforts:

• ROX-9598: Use ubi-minimal image #1054 - Initial migration to ubi8-minimal
• chore(deps): remove unix utils from release image #14487 - Removed linux-utils package
• chore(deps): remove lz4 and bzip2 #14489 - Removed lz4 and bzip2 packages
• Use ubi8-micro image for operator #1220 - Operator migrated to ubi8-micro
• Earlier ubi-micro migration attempts
  • ROX-9598: Use ubi8-micro #839
  • ubi-micro #8769
  • WIP: migrate to ubi micro #14831

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

  export KUBECONFIG=/tmp/tests/kubeconfig
  kubectl -n stackrox set image deployment/central \
    central=quay.io/rhacs-eng/release-main:4.11.x-599-g2ece508791-fast
  kubectl -n stackrox set image deployment/scanner-v4-indexer \
    indexer=quay.io/rhacs-eng/release-scanner-v4:4.11.0-517-g99d643f394-fast

  kubectl -n stackrox set image deployment/scanner-v4-matcher \
    matcher=quay.io/rhacs-eng/release-scanner-v4:4.11.0-517-g99d643f394-fast

  kubectl -n stackrox rollout status deployment/central --timeout=5m
  kubectl -n stackrox rollout status deployment/scanner-v4-indexer --timeout=5m
  kubectl -n stackrox rollout status deployment/scanner-v4-matcher --timeout=5m

Then check in UI if everything is healthy and followed and check if scanner is working

# roxctl --insecure-skip-tls-verify -e https://tj0331aparttheeblank.demos.rox.systems:443 image scan --image=nginx:latest --output=table
Scan results for image: nginx:latest
(TOTAL-COMPONENTS: 57, TOTAL-VULNERABILITIES: 107, LOW: 87, MODERATE: 10, IMPORTANT: 9, CRITICAL: 1)

[rhacs-bot]

Images are ready for the commit at 90cc136.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-484-g90cc136570.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.56%. Comparing base (b54ecbf) to head (4a7a836).
⚠️ Report is 38 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #19653      +/-   ##
==========================================
- Coverage   49.58%   49.56%   -0.02%     
==========================================
  Files        2766     2764       -2     
  Lines      208523   208357     -166     
==========================================
- Hits       103387   103269     -118     
+ Misses      97460    97436      -24     
+ Partials     7676     7652      -24     

Flag	Coverage Δ
go-unit-tests	49.56% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[janisz]

/retest

[janisz]

/retest

[coderabbitai]

📝 Walkthrough

Walkthrough

Both RHEL Dockerfiles were updated to switch the final runtime base image from ubi9-minimal to ubi9-micro and reorganized multi-stage builds. Installation workflows were refactored to use dnf with chrooted installroot (/out/) instead of microdnf in the final stage, consolidating artifacts through staged filesystem preparation.

Changes

Cohort / File(s)

Summary

RHEL Dockerfile Updates image/rhel/Dockerfile, image/rhel/konflux.Dockerfile

Switched base image from ubi9-minimal/ubi9/ubi-minimal to ubi9-micro/ubi9/ubi-micro. Reorganized multi-stage builds with new package_installer stage. Replaced microdnf with dnf for package installation targeting a chrooted installroot. Moved /etc/pki, /var/lib/stackrox, /var/log/stackrox, /var/cache/stackrox, and /tmp creation to intermediate stage. Removed HEALTHCHECK instruction from standard Dockerfile.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: migrating main image Dockerfiles to ubi9-micro, which is the primary objective of the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	PR description provides detailed context with clear objectives, multi-stage build architecture explanation, related work references, and validation steps with example output.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ROX-30858/migrate_main_to_ubi_micro

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

image/rhel/konflux.Dockerfile (1)

96-154: ⚠️ Potential issue | 🟠 Major

Add missing ENTRYPOINT instruction for consistency with main Dockerfile.

The main image/rhel/Dockerfile includes ENTRYPOINT ["/stackrox/roxctl"] at line 106, but this Konflux variant omits it. Other Konflux Dockerfiles in the repository (roxctl, operator, postgres) all specify an ENTRYPOINT, indicating this is not an intentional pattern of omission. Add the ENTRYPOINT instruction to ensure consistent container behavior.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@image/rhel/konflux.Dockerfile` around lines 96 - 154, The Konflux Dockerfile
is missing the ENTRYPOINT used in the main Dockerfile; add an ENTRYPOINT that
points to the roxctl binary to match behavior and other Konflux images: add
ENTRYPOINT ["/stackrox/roxctl"] (same as main image) near the end of the
Dockerfile after USER 4000:4000 (or immediately before if USER must be applied
at runtime), ensuring the container launches /stackrox/roxctl by default.

🧹 Nitpick comments (2)

image/rhel/konflux.Dockerfile (1)

93-94: Redundant copy of static-bin/* files.

Line 93 copies static-bin/* into /out/stackrox/, and line 98 copies the entire /out/ to /. Then line 111 copies static-bin/* again to /stackrox/, overwriting the same files. This is redundant and slightly increases build time.

Remove redundant COPY

 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/roxagent /stackrox/bin/
-COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/static-bin/* /stackrox/
 RUN GOARCH=$(uname -m) ; \

Also applies to: 111-111

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@image/rhel/konflux.Dockerfile` around lines 93 - 94, The Dockerfile
duplicates copying static binaries: the COPY --from=go-builder
/go/src/github.com/stackrox/rox/app/image/rhel/static-bin/* /out/stackrox/ and a
later COPY that again places static-bin/* into /stackrox/ (overwriting the same
files); remove the redundant COPY (either the first one to /out/stackrox/ or the
later one to /stackrox/, depending on which target you need preserved) so the
static-bin files are only copied once, keep the chroot /out
/stackrox/save-dir-contents step intact and ensure the remaining COPY uses the
final target path (/stackrox/ or /out/stackrox/) expected by subsequent steps.

image/rhel/Dockerfile (1)

20-26: Consider adding dnf clean all to reduce intermediate layer size.

The dnf install -y zip command lacks cache cleanup. While this is an intermediate build stage and the cache won't reach the final image (only /stackrox-data is copied via line 82), adding cleanup would reduce CI cache/layer size.

Suggested fix

 FROM ubi-base AS stackrox_data

-RUN dnf install -y zip
+RUN dnf install -y zip && dnf clean all && rm -rf /var/cache/dnf /var/cache/yum

 WORKDIR /

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@image/rhel/Dockerfile` around lines 20 - 26, The RUN that installs zip in the
stackrox_data stage leaves DNF caches and should be cleaned in the same layer to
reduce intermediate size; update the RUN that contains "dnf install -y zip" (in
the stackrox_data stage) to perform DNF cache cleanup after install (e.g., run
dnf clean all and remove /var/cache/dnf) so caches are removed in the same layer
that installs zip, keeping the rest of the Dockerfile (COPY
fetch-stackrox-data.sh and creation of /stackrox-data) unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@image/rhel/konflux.Dockerfile`:
- Around line 96-154: The Konflux Dockerfile is missing the ENTRYPOINT used in
the main Dockerfile; add an ENTRYPOINT that points to the roxctl binary to match
behavior and other Konflux images: add ENTRYPOINT ["/stackrox/roxctl"] (same as
main image) near the end of the Dockerfile after USER 4000:4000 (or immediately
before if USER must be applied at runtime), ensuring the container launches
/stackrox/roxctl by default.

---

Nitpick comments:
In `@image/rhel/Dockerfile`:
- Around line 20-26: The RUN that installs zip in the stackrox_data stage leaves
DNF caches and should be cleaned in the same layer to reduce intermediate size;
update the RUN that contains "dnf install -y zip" (in the stackrox_data stage)
to perform DNF cache cleanup after install (e.g., run dnf clean all and remove
/var/cache/dnf) so caches are removed in the same layer that installs zip,
keeping the rest of the Dockerfile (COPY fetch-stackrox-data.sh and creation of
/stackrox-data) unchanged.

In `@image/rhel/konflux.Dockerfile`:
- Around line 93-94: The Dockerfile duplicates copying static binaries: the COPY
--from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/static-bin/*
/out/stackrox/ and a later COPY that again places static-bin/* into /stackrox/
(overwriting the same files); remove the redundant COPY (either the first one to
/out/stackrox/ or the later one to /stackrox/, depending on which target you
need preserved) so the static-bin files are only copied once, keep the chroot
/out /stackrox/save-dir-contents step intact and ensure the remaining COPY uses
the final target path (/stackrox/ or /out/stackrox/) expected by subsequent
steps.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 5da37e4c-1ef7-4dbf-9c59-e968fc17ecb7

📥 Commits

Reviewing files that changed from the base of the PR and between df8c4bc and 90cc136.

📒 Files selected for processing (2)

• image/rhel/Dockerfile
• image/rhel/konflux.Dockerfile

[msugakov]

I've some dejavu feeling that I already reviewed and even commented on the same things.

[github-actions]

🚀 Build Images Ready

Images are ready for commit 8d9c528. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.11.x-631-g8d9c528eae

[github-actions]

🚀 Build Images Ready

Images are ready for commit 660d694. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.11.x-597-g660d694bb4

[janisz]

/retest

[msugakov]

Looks good! Just a few last comments.

[msugakov]

Looks good!
Please make sure main-on-push build completes successfully. There's one still running https://github.com/stackrox/stackrox/pull/19653/checks?check_run_id=71050176657.

[github-actions]

/konflux-retest roxctl-on-push

[github-actions]

/konflux-retest operator-bundle-on-push

[github-actions]

/konflux-retest operator-bundle-on-push

[github-actions]

/konflux-retest roxctl-on-push

[github-actions]

/konflux-retest operator-bundle-on-push

[github-actions]

/konflux-retest roxctl-on-push

[janisz]

Manually tested quay.io/rhacs-eng/release-main:4.11.0-601-g4a7a836448-fast and it's working 🎉