Dockerfile improvements

[ddjain]

Suggestion:

• Kubevirt, oc : Instead of building from source inside container, can we install binary? so we will be pin to perticular version of kubevirt, oc to avoid breaking changes.

  # virtctl build
  WORKDIR /tmp
  RUN git clone https://github.com/kubevirt/kubevirt.git
  WORKDIR /tmp/kubevirt
  RUN go mod edit -go 1.24.9 &&\
      go work use &&\
      go build -o virtctl ./cmd/virtctl/

• [Size Optimization] Can we use multistage docker image for python, instead of installing python manually, can we use python3.9-slim image? this will reduce the size of image

  RUN rm -rf "$(pip cache dir)"
  RUN rm -rf /tmp/*
  RUN rm -rf /usr/local/lib/python3.9/ensurepip/_bundled
  RUN pip3.9 install -r requirements.txt
  RUN pip3.9 install jsonschema

• [minor] Remove Duplicate layers in dockerfile. we are doing dnf update twice, we can remove one of them

  RUN dnf update -y
  
  ENV KUBECONFIG /home/krkn/.kube/config
  
  
  # This overwrites any existing configuration in /etc/yum.repos.d/kubernetes.repo
  RUN dnf update && dnf install -y --setopt=install_weak_deps=False \
      git python39 jq yq gettext wget which ipmitool openssh-server &&\
      dnf clean all

[chaitanyaenr]

Hi @ddjain, thanks for suggesting the enhancement. I agree that it’s better to install oc and KubeVirt from release binaries. @tsebastiani identified and reported security vulnerabilities in the latest oc binary, which is the reason for installing it from source.

+1 for updating the Dockerfile to pin to a specific KubeVirt release to avoid breaking changes, as you suggested: https://github.com/kubevirt/kubevirt/releases/tag/v1.7.0

[ddjain]

As discussed:

• We can update KubeVirt using the release binary.
• @tsebastiani and @chaitanyaenr will coordinate with the OpenShift team to confirm whether the security vulnerability has been fixed.
• It would be helpful to link the vulnerability issue to this task for reference.

[Nesar976]

Hi @ddjain, I’ve started working on this.
I’ll follow the discussed approach (pinned release binaries, Dockerfile optimizations) and share a PR once it’s ready.