Adding support for production grade image in Dockerfile

.github/workflows/docker-release.yml

@@ -88,9 +88,10 @@ jobs:
             BIN=committer
             ARCHBIN_PATH=archbin
             PORTS=4001 2114 9001 2119 5001 2115 6001 2116 7001 2117
+            VERSION=${{ env.VERSION }}
           cache-from: type=registry,ref=docker.io/${{ env.IMAGE_PREFIX }}/fabric-x-committer:buildcache
           cache-to: type=registry,ref=docker.io/${{  env.IMAGE_PREFIX  }}/fabric-x-committer:buildcache,mode=max
-        
+
       - name: Build and Push Multi-Platform Docker Image for Loadgen
         uses: docker/build-push-action@v6
         with:
@@ -107,6 +108,7 @@ jobs:
             BIN=loadgen
             ARCHBIN_PATH=archbin
             PORTS=8001 2118
+            VERSION=${{ env.VERSION }}
           cache-from: type=registry,ref=docker.io/${{ env.IMAGE_PREFIX }}/fabric-x-loadgen:buildcache
           cache-to: type=registry,ref=docker.io/${{  env.IMAGE_PREFIX  }}/fabric-x-loadgen:buildcache,mode=max
 
@@ -124,5 +126,6 @@ jobs:
             ghcr.io/${{ env.GHCR_PREFIX }}/fabric-x-committer-test-node:latest
           build-args: |
             ARCHBIN_PATH=archbin
+            VERSION=${{ env.VERSION }}
           cache-from: type=registry,ref=docker.io/${{ env.IMAGE_PREFIX }}/fabric-x-committer-test-node:buildcache
           cache-to: type=registry,ref=docker.io/${{  env.IMAGE_PREFIX  }}/fabric-x-committer-test-node:buildcache,mode=max

Makefile

@@ -21,7 +21,7 @@
 #########################
 
 go_cmd          ?= go
-version         := 0.0.2
+version         := latest
 project_dir     := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
 output_dir      ?= $(project_dir)/bin
 arch_output_dir ?= $(project_dir)/archbin
@@ -43,7 +43,7 @@ cmd            ?=
 # An error will occur if neither container engine is installed.
 docker_cmd ?= $(shell command -v docker >/dev/null 2>&1 && echo docker || \
 							echo podman || { echo "Error: Neither Docker nor Podman is installed." >&2; exit 1; })
-image_namespace=icr.io/cbdc
+image_namespace=docker.io/hyperledger
 
 # Set these parameters to compile to a specific os/arch
 # E.g., make build-local os=linux arch=amd64

docker/images/release/Dockerfile

@@ -1,13 +1,48 @@
+#
 # Copyright IBM Corp. All Rights Reserved.
 #
 # SPDX-License-Identifier: Apache-2.0
 #
-FROM registry.access.redhat.com/ubi9/ubi-micro:9.4 AS prod
+
+###########################################
+# Stage 1: Production runtime image
+###########################################
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6 AS prod
+
 ARG BIN
 ARG ARCHBIN_PATH
-ARG PORTS
 ARG TARGETOS
 ARG TARGETARCH
+ARG PORTS
+ARG VERSION=1.0
+
+# Add non-root user (10001) using BIN argument
+RUN /usr/sbin/useradd -u 10001 -r -g root -s /sbin/nologin -c "Hyperledger Fabric-X ${BIN} user" ${BIN} && \
+    mkdir -p /home/${BIN} && \
+    chown -R 10001:0 /home/${BIN} && \
+    chmod 0755 /home/${BIN}
 
+# Copy binaries
 COPY ${ARCHBIN_PATH}/${TARGETOS}-${TARGETARCH}/${BIN} /bin/${BIN}
+
+# Create fixed entrypoint since args are not replaced
+# within ENTRYPOINT or CMD
+RUN ln -s /bin/${BIN} /bin/entrypoint
+
+# Expose ports
 EXPOSE ${PORTS}
+
+# OCI metadata labels
+LABEL name="${BIN}" \
+    maintainer="IBM Research ZRL Decentralized Trust Group" \
+    version="${VERSION}" \
+    description="Hyperledger Fabric-X ${BIN} packaged in a UBI image" \
+    license="Apache-2.0" \
+    vendor="IBM"
+
+# Use non-root user and set workdir using BIN argument
+USER 10001
+WORKDIR /home/${BIN}
+
+# Default Entrypoint
+ENTRYPOINT ["/bin/entrypoint"]

docker/images/test_node/Dockerfile

@@ -1,12 +1,18 @@
+#
 # Copyright IBM Corp. All Rights Reserved.
 #
 # SPDX-License-Identifier: Apache-2.0
 #
+
+###########################################
+# Stage 1: Production runtime image
+###########################################
 FROM postgres:16.9-alpine3.21 AS node
 
 ARG ARCHBIN_PATH
 ARG TARGETOS
 ARG TARGETARCH
+ARG VERSION
 
 ENV CONFIGS_PATH=/root/config
 ENV BINS_PATH=/root/bin
@@ -48,6 +54,16 @@ COPY ./cmd/config/samples $CONFIGS_PATH
 COPY ./bin/sc-genesis-block.proto.bin $CONFIGS_PATH/
 RUN chmod a+x ${BINS_PATH}/*
 
+# Expose ports
 EXPOSE 7050 4001 2114 7001 2117 2110
 
+# OCI metadata labels
+LABEL name="fabric-x-committer-test-node" \
+    maintainer="IBM Research Decentralized Trust Group" \
+    version="${VERSION}" \
+    description="Preconfigured Hyperledger Fabric-X Committer Node" \
+    license="Apache-2.0" \
+    vendor="IBM"
+
+# Default CMD
 CMD ["run"]

docker/test/common.go

@@ -32,7 +32,7 @@ type createAndStartContainerParameters struct {
 }
 
 const (
-	testNodeImage   = "icr.io/cbdc/committer-test-node:0.0.2"
+	testNodeImage   = "docker.io/hyperledger/committer-test-node:latest"
 	channelName     = "mychannel"
 	monitoredMetric = "loadgen_transaction_committed_total"
 )

docker/test/container_release_image_test.go

@@ -44,8 +44,8 @@ func (p *startNodeParameters) asNode(node string) startNodeParameters {
 }
 
 const (
-	committerReleaseImage = "icr.io/cbdc/committer:0.0.2"
-	loadgenReleaseImage   = "icr.io/cbdc/loadgen:0.0.2"
+	committerReleaseImage = "docker.io/hyperledger/fabric-x-committer:latest"
+	loadgenReleaseImage   = "docker.io/hyperledger/fabric-x-loadgen:latest"
 	containerPrefixName   = "sc_test"
 	networkPrefixName     = containerPrefixName + "_network"
 	genBlockFile          = "sc-genesis-block.proto.bin"

scripts/build-release-image.sh

@@ -18,13 +18,14 @@ function build_image() {
   local image_name=$1
   local bin=$2
   local service_ports=$3
-  local manifest_name=${namespace}/${image_name}:${version}
+  local manifest_name=${namespace}/fabric-x-${image_name}:${version}
   local cmd=(
     "${docker_cmd}" build
     -f "${dockerfile_release_dir}/Dockerfile"
     --build-arg BIN="${bin}"
     --build-arg PORTS="${service_ports}"
     --build-arg ARCHBIN_PATH="${arch_bin_dir}"
+    --build-arg VERSION="${version}"
   )
 
   if [ "${multiplatform}" = true ]; then