add template konflux dockerfile#382
Conversation
Signed-off-by: Wesley Hayutin <weshayutin@gmail.com>
WalkthroughA new multi-stage Dockerfile (konflux.Dockerfile) introduced for building an OpenShift Velero plugin. The builder stage compiles the Go application with static linking, while the runtime stage packages it into a UBI-based image with non-root execution configured. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: weshayutin The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@konflux.Dockerfile`:
- Line 14: Replace the floating base image tag in the Dockerfile FROM
instruction (currently "registry.redhat.io/ubi9/ubi:latest") with a specific,
reproducible version tag (for example "registry.redhat.io/ubi9/ubi:9.3" or your
project's approved UBI9 patch version); update the FROM line accordingly and
ensure any CI/build docs or image scanning policy reflect the chosen fixed tag.
- Around line 2-5: The Dockerfile currently copies the whole context early (COPY
. .) which defeats layer caching and duplicates source copies; reorder and
simplify so you first COPY go.mod go.sum to the destination referenced in the
diff (the path used with COPY go.mod go.sum
$APP_ROOT/src/github.com/konveyor/openshift-velero-plugin/), run RUN go mod
download to populate module cache, then COPY the remaining source once (replace
the initial COPY . . and the later COPY . ...) so dependency layers are cached
and source is only copied once.
- Line 17: The COPY --from=builder line fails because $APP_ROOT and $BIN are
only defined in the builder stage; declare those build args or envs so they are
available in the runtime stage (or replace with a static path). Add ARG APP_ROOT
and ARG BIN (or ENV definitions) in a scope visible to both stages (e.g., before
the first FROM or re-declare them in the runtime stage) so the COPY
--from=builder $APP_ROOT/src/.../$BIN /plugins/ resolves correctly at build
time.
| COPY . . | ||
| COPY go.mod go.sum $APP_ROOT/src/github.com/konveyor/openshift-velero-plugin/ | ||
| RUN go mod download | ||
| COPY . $APP_ROOT/src/github.com/konveyor/openshift-velero-plugin |
There was a problem hiding this comment.
Dependency layer caching is currently defeated.
COPY . . before go mod download causes dependency downloads to rerun on any source change, and the full source is copied twice.
Proposed fix
-FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25 AS builder
-COPY . .
-COPY go.mod go.sum $APP_ROOT/src/github.com/konveyor/openshift-velero-plugin/
-RUN go mod download
-COPY . $APP_ROOT/src/github.com/konveyor/openshift-velero-plugin
-WORKDIR $APP_ROOT/src/github.com/konveyor/openshift-velero-plugin
+FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25 AS builder
+WORKDIR $APP_ROOT/src/github.com/konveyor/openshift-velero-plugin
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . ./As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@konflux.Dockerfile` around lines 2 - 5, The Dockerfile currently copies the
whole context early (COPY . .) which defeats layer caching and duplicates source
copies; reorder and simplify so you first COPY go.mod go.sum to the destination
referenced in the diff (the path used with COPY go.mod go.sum
$APP_ROOT/src/github.com/konveyor/openshift-velero-plugin/), run RUN go mod
download to populate module cache, then COPY the remaining source once (replace
the initial COPY . . and the later COPY . ...) so dependency layers are cached
and source is only copied once.
| RUN go build -installsuffix "static" -tags "$BUILDTAGS" -mod=mod -o _output/$BIN ./$BIN | ||
|
|
||
|
|
||
| FROM registry.redhat.io/ubi9/ubi:latest |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify whether floating base tags are present in Dockerfiles.
rg -n '^\s*FROM\s+\S+:latest(\s|$)' --glob '*Dockerfile*'Repository: openshift/openshift-velero-plugin
Length of output: 138
Use explicit version tags instead of latest for the base image.
Floating tags like ubi:latest prevent reproducible builds and can introduce unexpected base-image changes without review. Pin to a specific version (e.g., ubi9/ubi:9.3 or similar).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@konflux.Dockerfile` at line 14, Replace the floating base image tag in the
Dockerfile FROM instruction (currently "registry.redhat.io/ubi9/ubi:latest")
with a specific, reproducible version tag (for example
"registry.redhat.io/ubi9/ubi:9.3" or your project's approved UBI9 patch
version); update the FROM line accordingly and ensure any CI/build docs or image
scanning policy reflect the chosen fixed tag.
| FROM registry.redhat.io/ubi9/ubi:latest | ||
| RUN dnf -y install openssl && dnf -y reinstall tzdata && dnf clean all | ||
| RUN mkdir /plugins | ||
| COPY --from=builder $APP_ROOT/src/github.com/konveyor/openshift-velero-plugin/_output/$BIN /plugins/ |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show variable usage and stage-local declarations around runtime stage.
nl -ba konflux.Dockerfile | sed -n '1,26p'
echo
echo "Runtime-stage ENV/ARG declarations:"
awk '
BEGIN {stage=0}
/^\s*FROM\s+/ {stage++; next}
stage==2 && /^\s*(ENV|ARG)\s+/ {print NR ":" $0}
' konflux.Dockerfile
echo
echo "Variable references in COPY --from lines:"
rg -n '^\s*COPY\s+--from=.*\$(APP_ROOT|BIN)' konflux.DockerfileRepository: openshift/openshift-velero-plugin
Length of output: 119
🏁 Script executed:
#!/bin/bash
# Read the Dockerfile to understand its structure and variable usage
cat -n konflux.DockerfileRepository: openshift/openshift-velero-plugin
Length of output: 1581
COPY --from=builder references variables undefined in runtime stage.
$APP_ROOT and $BIN are only available in the builder stage. In the runtime stage (line 14 onwards), Dockerfile expands these variables in the current stage context where they're undefined, causing the COPY on line 17 to fail or copy from an incorrect path.
Add the following to the runtime stage:
FROM registry.redhat.io/ubi9/ubi:latest
+ENV APP_ROOT=/opt/app-root
+ENV BIN=velero-plugins
RUN dnf -y install openssl && dnf -y reinstall tzdata && dnf clean all🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@konflux.Dockerfile` at line 17, The COPY --from=builder line fails because
$APP_ROOT and $BIN are only defined in the builder stage; declare those build
args or envs so they are available in the runtime stage (or replace with a
static path). Add ARG APP_ROOT and ARG BIN (or ENV definitions) in a scope
visible to both stages (e.g., before the first FROM or re-declare them in the
runtime stage) so the COPY --from=builder $APP_ROOT/src/.../$BIN /plugins/
resolves correctly at build time.
|
@weshayutin: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
No description provided.