Skip to content

Commit 69bc5f7

Browse files
omordykomordyk
authored
Merge pull request #4228 from open-horizon/feat_ubi9_micro
Use ubi-micro instead of ubi-minimal to reduce the threat surface attack area.
2 parents 6cef591 + b34bbf6 commit 69bc5f7

19 files changed

+307
-18
lines changed

‎anax-in-container/Dockerfile.alpine.amd64‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ ARG DOCKER_VER=19.03.8
1111
# install docker cli
1212
# make required directories
1313
RUN microdnf update -y --nodocs && microdnf clean all && microdnf install --nodocs -y shadow-utils \
14+
&& microdnf install -y curl \
1415
&& microdnf install --nodocs -y openssl ca-certificates \
1516
&& microdnf install -y wget iptables vim-minimal procps tar \
1617
&& wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 \

‎anax-in-container/Dockerfile.ubi.amd64‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,24 @@
1-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
1+
# Building microdnf from ubi9-minimal base
2+
FROM registry.access.redhat.com/ubi9-minimal:latest AS base
3+
4+
#---------------------------------------------------------------
5+
FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
26

37
LABEL vendor="IBM"
48
LABEL summary="The agent in a general purpose container."
59
LABEL description="A container which holds the edge node agent, to be used in environments where there is no operating system package that can install the agent natively."
610

11+
# Copy microdnf necessary files from the base stage
12+
COPY --from=base /usr/bin/microdnf /usr/bin/
13+
COPY --from=base /usr/bin/gpg /usr/bin/
14+
COPY --from=base /usr/bin/gpg2 /usr/bin/
15+
COPY --from=base /lib64 /lib64/
16+
COPY --from=base /usr/lib64 /usr/lib64/
17+
COPY --from=base /usr/lib/rpm /usr/lib/rpm/
18+
COPY --from=base /etc/dnf /etc/dnf/
19+
COPY --from=base /etc/rpm /etc/rpm/
20+
COPY --from=base /etc/pki /etc/pki/
21+
722
ARG DOCKER_VER=26.1.4
823

924
# The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
@@ -15,6 +30,7 @@ ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal
1530
RUN microdnf update -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
1631
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
1732
&& microdnf upgrade -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager krb5-libs \
33+
&& microdnf install -y curl \
1834
&& curl -4fsSLO https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VER}.tgz \
1935
&& tar xzvf docker-${DOCKER_VER}.tgz --strip 1 -C /usr/bin docker/docker \
2036
&& rm docker-${DOCKER_VER}.tgz \

‎anax-in-container/Dockerfile.ubi.arm64‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,24 @@
1-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
1+
# Building microdnf from ubi9-minimal base
2+
FROM registry.access.redhat.com/ubi9-minimal:latest AS base
3+
4+
#---------------------------------------------------------------
5+
FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
26

37
LABEL vendor="IBM"
48
LABEL summary="The agent in a general purpose container."
59
LABEL description="A container which holds the edge node agent, to be used in environments where there is no operating system package that can install the agent natively."
610

11+
# Copy microdnf necessary files from the base stage
12+
COPY --from=base /usr/bin/microdnf /usr/bin/
13+
COPY --from=base /usr/bin/gpg /usr/bin/
14+
COPY --from=base /usr/bin/gpg2 /usr/bin/
15+
COPY --from=base /lib64 /lib64/
16+
COPY --from=base /usr/lib64 /usr/lib64/
17+
COPY --from=base /usr/lib/rpm /usr/lib/rpm/
18+
COPY --from=base /etc/dnf /etc/dnf/
19+
COPY --from=base /etc/rpm /etc/rpm/
20+
COPY --from=base /etc/pki /etc/pki/
21+
722
ARG DOCKER_VER=24.0.9
823

924
# The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
@@ -14,6 +29,7 @@ ARG DOCKER_VER=24.0.9
1429
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip"
1530
RUN microdnf update -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
1631
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
32+
&& microdnf install -y curl \
1733
&& curl -4fsSLO https://download.docker.com/linux/static/stable/aarch64/docker-${DOCKER_VER}.tgz \
1834
&& tar xzvf docker-${DOCKER_VER}.tgz --strip 1 -C /usr/bin docker/docker \
1935
&& rm docker-${DOCKER_VER}.tgz \

‎anax-in-container/Dockerfile.ubi.ppc64el‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,24 @@
1-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
1+
# Building microdnf from ubi9-minimal base
2+
FROM registry.access.redhat.com/ubi9-minimal:latest AS base
3+
4+
#---------------------------------------------------------------
5+
FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
26

37
LABEL vendor="IBM"
48
LABEL summary="The agent in a general purpose container."
59
LABEL description="A container which holds the edge node agent, to be used in environments where there is no operating system package that can install the agent natively."
610

11+
# Copy microdnf necessary files from the base stage
12+
COPY --from=base /usr/bin/microdnf /usr/bin/
13+
COPY --from=base /usr/bin/gpg /usr/bin/
14+
COPY --from=base /usr/bin/gpg2 /usr/bin/
15+
COPY --from=base /lib64 /lib64/
16+
COPY --from=base /usr/lib64 /usr/lib64/
17+
COPY --from=base /usr/lib/rpm /usr/lib/rpm/
18+
COPY --from=base /etc/dnf /etc/dnf/
19+
COPY --from=base /etc/rpm /etc/rpm/
20+
COPY --from=base /etc/pki /etc/pki/
21+
722
ARG DOCKER_VER=18.06.3-ce
823

924
# add EPEL repo with jq pkg and all deps
@@ -19,6 +34,7 @@ RUN microdnf clean all \
1934
&& rm -rf /var/cache/dnf /var/cache/PackageKit \
2035
&& microdnf update -y --nodocs --nobest --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
2136
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
37+
&& microdnf install -y curl \
2238
&& curl -4fsSLO https://download.docker.com/linux/static/stable/ppc64le/docker-${DOCKER_VER}.tgz \
2339
&& tar xzvf docker-${DOCKER_VER}.tgz --strip 1 -C /usr/bin docker/docker \
2440
&& rm docker-${DOCKER_VER}.tgz \

‎anax-in-container/Dockerfile.ubi.s390x‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,24 @@
1-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
1+
# Building microdnf from ubi9-minimal base
2+
FROM registry.access.redhat.com/ubi9-minimal:latest AS base
3+
4+
#---------------------------------------------------------------
5+
FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
26

37
LABEL vendor="IBM"
48
LABEL summary="The agent in a general purpose container."
59
LABEL description="A container which holds the edge node agent, to be used in environments where there is no operating system package that can install the agent natively."
610

11+
# Copy microdnf necessary files from the base stage
12+
COPY --from=base /usr/bin/microdnf /usr/bin/
13+
COPY --from=base /usr/bin/gpg /usr/bin/
14+
COPY --from=base /usr/bin/gpg2 /usr/bin/
15+
COPY --from=base /lib64 /lib64/
16+
COPY --from=base /usr/lib64 /usr/lib64/
17+
COPY --from=base /usr/lib/rpm /usr/lib/rpm/
18+
COPY --from=base /etc/dnf /etc/dnf/
19+
COPY --from=base /etc/rpm /etc/rpm/
20+
COPY --from=base /etc/pki /etc/pki/
21+
722
ARG DOCKER_VER=18.06.3-ce
823

924
# The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
@@ -14,6 +29,7 @@ ARG DOCKER_VER=18.06.3-ce
1429
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip"
1530
RUN microdnf update -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
1631
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
32+
&& microdnf install -y curl \
1733
&& curl -4fsSLO https://download.docker.com/linux/static/stable/s390x/docker-${DOCKER_VER}.tgz \
1834
&& tar xzvf docker-${DOCKER_VER}.tgz --strip 1 -C /usr/bin docker/docker \
1935
&& rm docker-${DOCKER_VER}.tgz \

‎anax-in-container/Dockerfile_agbot.ubi‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,24 @@
1-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
1+
# Building microdnf from ubi9-minimal base
2+
FROM registry.access.redhat.com/ubi9-minimal:latest AS base
3+
4+
#---------------------------------------------------------------
5+
FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
26

37
LABEL vendor="IBM"
48
LABEL summary="The deployment engine."
59
LABEL description="The Agbot scans all the edge nodes in the system initiating deployment of services and model to all eligible nodes."
610

11+
# Copy microdnf necessary files from the base stage
12+
COPY --from=base /usr/bin/microdnf /usr/bin/
13+
COPY --from=base /usr/bin/gpg /usr/bin/
14+
COPY --from=base /usr/bin/gpg2 /usr/bin/
15+
COPY --from=base /lib64 /lib64/
16+
COPY --from=base /usr/lib64 /usr/lib64/
17+
COPY --from=base /usr/lib/rpm /usr/lib/rpm/
18+
COPY --from=base /etc/dnf /etc/dnf/
19+
COPY --from=base /etc/rpm /etc/rpm/
20+
COPY --from=base /etc/pki /etc/pki/
21+
722
# The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
823
# The anax.service calls jq (from jq) and killall (from psmisc)
924
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
@@ -12,6 +27,7 @@ LABEL description="The Agbot scans all the edge nodes in the system initiating d
1227
# Create required directories
1328
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng gettext"
1429
RUN microdnf update -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
30+
&& microdnf install -y curl \
1531
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
1632
&& microdnf upgrade -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager krb5-libs \
1733
&& microdnf clean all --disableplugin=subscription-manager \

‎anax-in-k8s/Dockerfile.ubi.amd64‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,31 @@
1-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
1+
# Building microdnf from ubi9-minimal base
2+
FROM registry.access.redhat.com/ubi9-minimal:latest AS base
3+
4+
#---------------------------------------------------------------
5+
FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
26

37
LABEL vendor="IBM"
48
LABEL summary="The agent for edge clusters."
59
LABEL description="The agent in a container that is used solely for the purpose of running the agent in a kubernetes edge cluster."
610

11+
# Copy microdnf necessary files from the base stage
12+
COPY --from=base /usr/bin/microdnf /usr/bin/
13+
COPY --from=base /usr/bin/gpg /usr/bin/
14+
COPY --from=base /usr/bin/gpg2 /usr/bin/
15+
COPY --from=base /lib64 /lib64/
16+
COPY --from=base /usr/lib64 /usr/lib64/
17+
COPY --from=base /usr/lib/rpm /usr/lib/rpm/
18+
COPY --from=base /etc/dnf /etc/dnf/
19+
COPY --from=base /etc/rpm /etc/rpm/
20+
COPY --from=base /etc/pki /etc/pki/
21+
722
# The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
823
# The anax.service calls jq (from jq) and killall (from psmisc)
924
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
1025
# Create required directories
1126
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar"
1227
RUN microdnf update -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
28+
&& microdnf install -y curl \
1329
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
1430
&& microdnf clean all --disableplugin=subscription-manager \
1531
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \

‎anax-in-k8s/Dockerfile.ubi.arm64‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,31 @@
1-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
1+
# Building microdnf from ubi9-minimal base
2+
FROM registry.access.redhat.com/ubi9-minimal:latest AS base
3+
4+
#---------------------------------------------------------------
5+
FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
26

37
LABEL vendor="IBM"
48
LABEL summary="The agent for edge clusters."
59
LABEL description="The agent in a container that is used solely for the purpose of running the agent in a kubernetes edge cluster."
610

11+
# Copy microdnf necessary files from the base stage
12+
COPY --from=base /usr/bin/microdnf /usr/bin/
13+
COPY --from=base /usr/bin/gpg /usr/bin/
14+
COPY --from=base /usr/bin/gpg2 /usr/bin/
15+
COPY --from=base /lib64 /lib64/
16+
COPY --from=base /usr/lib64 /usr/lib64/
17+
COPY --from=base /usr/lib/rpm /usr/lib/rpm/
18+
COPY --from=base /etc/dnf /etc/dnf/
19+
COPY --from=base /etc/rpm /etc/rpm/
20+
COPY --from=base /etc/pki /etc/pki/
21+
722
# The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
823
# The anax.service calls jq (from jq) and killall (from psmisc)
924
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
1025
# Create required directories
1126
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar"
1227
RUN microdnf update -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
28+
&& microdnf install -y curl \
1329
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
1430
&& microdnf clean all --disableplugin=subscription-manager \
1531
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \

‎anax-in-k8s/Dockerfile.ubi.auto-upgrade-cron.amd64‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,24 @@
1-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
1+
# Building microdnf from ubi9-minimal base
2+
FROM registry.access.redhat.com/ubi9-minimal:latest AS base
3+
4+
#---------------------------------------------------------------
5+
FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
26

37
LABEL vendor="IBM"
48
LABEL summary="The agent auto upgrade cron job for edge clusters."
59
LABEL description=""
610

11+
# Copy microdnf necessary files from the base stage
12+
COPY --from=base /usr/bin/microdnf /usr/bin/
13+
COPY --from=base /usr/bin/gpg /usr/bin/
14+
COPY --from=base /usr/bin/gpg2 /usr/bin/
15+
COPY --from=base /lib64 /lib64/
16+
COPY --from=base /usr/lib64 /usr/lib64/
17+
COPY --from=base /usr/lib/rpm /usr/lib/rpm/
18+
COPY --from=base /etc/dnf /etc/dnf/
19+
COPY --from=base /etc/rpm /etc/rpm/
20+
COPY --from=base /etc/pki /etc/pki/
21+
722
# The build calls adduser (from shadow-utils)
823
# The auto-upgrade-cronjob.sh calls jq (from jq)
924
# Download kubectl
@@ -13,6 +28,7 @@ ARG REQUIRED_RPMS="shadow-utils jq"
1328
RUN microdnf update -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
1429
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
1530
&& microdnf clean all --disableplugin=subscription-manager \
31+
&& microdnf install -y curl \
1632
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
1733
&& curl -4LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl \
1834
&& chmod +x ./kubectl \

‎anax-in-k8s/Dockerfile.ubi.auto-upgrade-cron.arm64‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,24 @@
1-
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
1+
# Building microdnf from ubi9-minimal base
2+
FROM registry.access.redhat.com/ubi9-minimal:latest AS base
3+
4+
#---------------------------------------------------------------
5+
FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
26

37
LABEL vendor="IBM"
48
LABEL summary="The agent auto upgrade cron job for edge clusters."
59
LABEL description=""
610

11+
# Copy microdnf necessary files from the base stage
12+
COPY --from=base /usr/bin/microdnf /usr/bin/
13+
COPY --from=base /usr/bin/gpg /usr/bin/
14+
COPY --from=base /usr/bin/gpg2 /usr/bin/
15+
COPY --from=base /lib64 /lib64/
16+
COPY --from=base /usr/lib64 /usr/lib64/
17+
COPY --from=base /usr/lib/rpm /usr/lib/rpm/
18+
COPY --from=base /etc/dnf /etc/dnf/
19+
COPY --from=base /etc/rpm /etc/rpm/
20+
COPY --from=base /etc/pki /etc/pki/
21+
722
# The build calls adduser (from shadow-utils)
823
# The auto-upgrade-cronjob.sh calls jq (from jq)
924
# Download kubectl
@@ -13,6 +28,7 @@ ARG REQUIRED_RPMS="shadow-utils jq"
1328
RUN microdnf update -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
1429
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
1530
&& microdnf clean all --disableplugin=subscription-manager \
31+
&& microdnf install -y curl \
1632
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
1733
&& curl -4LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/arm64/kubectl \
1834
&& chmod +x ./kubectl \

0 commit comments

Comments
 (0)