From 295a3fb0031b224ec920491d1bc1e759e6738de6 Mon Sep 17 00:00:00 2001 From: Emilien Macchi Date: Tue, 1 Sep 2026 14:08:58 -0400 Subject: [PATCH 1/2] CARRY: Migrate Konflux base images to RHEL 9.8 Update all Konflux gateway, supervisor, and CLI builder and runtime base images to pinned UBI 9.8 manifests. Signed-off-by: Emilien Macchi --- deploy/docker/Dockerfile.konflux.cli | 4 ++-- deploy/docker/Dockerfile.konflux.gateway | 4 ++-- deploy/docker/Dockerfile.konflux.supervisor | 4 ++-- deploy/konflux/cli/rpms.in.yaml | 2 +- deploy/konflux/gateway/rpms.in.yaml | 2 +- deploy/konflux/supervisor/rpms.in.yaml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/deploy/docker/Dockerfile.konflux.cli b/deploy/docker/Dockerfile.konflux.cli index 135f7eee1f..f2b9d892ae 100644 --- a/deploy/docker/Dockerfile.konflux.cli +++ b/deploy/docker/Dockerfile.konflux.cli @@ -20,7 +20,7 @@ ARG RUST_VERSION=1.92.0 # --------------------------------------------------------------------------- # Build stage: compile CLI (fully-static glibc binary) # --------------------------------------------------------------------------- -FROM registry.access.redhat.com/ubi9/ubi:9.6@sha256:dec374e05cc13ebbc0975c9f521f3db6942d27f8ccdf06b180160490eef8bdbc AS builder +FROM registry.access.redhat.com/ubi9/ubi:9.8@sha256:25a147defd01e19674714f55d17538c8dbe55d8c305fa157ecc3f9c8977b05b6 AS builder ARG RUST_VERSION ARG TARGETARCH @@ -73,7 +73,7 @@ RUN . /tmp/build-env && \ # --------------------------------------------------------------------------- # Runtime # --------------------------------------------------------------------------- -FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7 +FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93 RUN microdnf install -y --nodocs ca-certificates \ && microdnf clean all diff --git a/deploy/docker/Dockerfile.konflux.gateway b/deploy/docker/Dockerfile.konflux.gateway index 1ffe9a27e8..8e146bb3d5 100644 --- a/deploy/docker/Dockerfile.konflux.gateway +++ b/deploy/docker/Dockerfile.konflux.gateway @@ -14,7 +14,7 @@ # --------------------------------------------------------------------------- # Build # --------------------------------------------------------------------------- -FROM registry.access.redhat.com/ubi9/ubi:9.6@sha256:dec374e05cc13ebbc0975c9f521f3db6942d27f8ccdf06b180160490eef8bdbc AS builder +FROM registry.access.redhat.com/ubi9/ubi:9.8@sha256:25a147defd01e19674714f55d17538c8dbe55d8c305fa157ecc3f9c8977b05b6 AS builder RUN dnf install -y --nodocs --setopt=install_weak_deps=0 \ rust cargo \ @@ -54,7 +54,7 @@ RUN mkdir -p /tmp/z3-src \ # --------------------------------------------------------------------------- # Runtime # --------------------------------------------------------------------------- -FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7 +FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93 RUN microdnf install -y --nodocs --setopt=install_weak_deps=0 ca-certificates \ && microdnf clean all diff --git a/deploy/docker/Dockerfile.konflux.supervisor b/deploy/docker/Dockerfile.konflux.supervisor index b6f7b953c2..b771041dcf 100644 --- a/deploy/docker/Dockerfile.konflux.supervisor +++ b/deploy/docker/Dockerfile.konflux.supervisor @@ -21,7 +21,7 @@ ARG RUST_VERSION=1.92.0 # --------------------------------------------------------------------------- # Build stage: compile supervisor (fully-static glibc binary) # --------------------------------------------------------------------------- -FROM registry.access.redhat.com/ubi9/ubi:9.6@sha256:dec374e05cc13ebbc0975c9f521f3db6942d27f8ccdf06b180160490eef8bdbc AS builder +FROM registry.access.redhat.com/ubi9/ubi:9.8@sha256:25a147defd01e19674714f55d17538c8dbe55d8c305fa157ecc3f9c8977b05b6 AS builder ARG RUST_VERSION ARG TARGETARCH @@ -69,7 +69,7 @@ RUN . /tmp/build-env && \ # --------------------------------------------------------------------------- # Runtime # --------------------------------------------------------------------------- -FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:34880b64c07f28f64d95737f82f891516de9a3b43583f39970f7bf8e4cfa48b7 +FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93 ARG TARGETARCH diff --git a/deploy/konflux/cli/rpms.in.yaml b/deploy/konflux/cli/rpms.in.yaml index 69e1024f5b..38f70f6a84 100644 --- a/deploy/konflux/cli/rpms.in.yaml +++ b/deploy/konflux/cli/rpms.in.yaml @@ -5,7 +5,7 @@ # Build + runtime stages combined. # # Resolved with `context.bare: true` so the lockfile pins the full dependency -# closure. The image installs RPMs into two different bases (the ubi:9.6 build +# closure. The image installs RPMs into two different bases (the ubi:9.8 build # stage and the ubi-minimal runtime stage); bare guarantees every package is # pinned and prefetched regardless of which base already provides it. # diff --git a/deploy/konflux/gateway/rpms.in.yaml b/deploy/konflux/gateway/rpms.in.yaml index 06eb993039..880dee734b 100644 --- a/deploy/konflux/gateway/rpms.in.yaml +++ b/deploy/konflux/gateway/rpms.in.yaml @@ -2,7 +2,7 @@ # Build + runtime stages combined. # # Resolved with `context.bare: true` so the lockfile pins the full dependency -# closure. The image installs RPMs into two different bases (the ubi:9.6 build +# closure. The image installs RPMs into two different bases (the ubi:9.8 build # stage and the ubi-minimal runtime stage); bare guarantees every package is # pinned and prefetched regardless of which base already provides it. # diff --git a/deploy/konflux/supervisor/rpms.in.yaml b/deploy/konflux/supervisor/rpms.in.yaml index 837aea5063..e21a62fc0e 100644 --- a/deploy/konflux/supervisor/rpms.in.yaml +++ b/deploy/konflux/supervisor/rpms.in.yaml @@ -2,7 +2,7 @@ # Build + runtime stages combined. # # Resolved with `context.bare: true` so the lockfile pins the full dependency -# closure. The image installs RPMs into two different bases (the ubi:9.6 build +# closure. The image installs RPMs into two different bases (the ubi:9.8 build # stage and the ubi-minimal runtime stage); bare guarantees every package is # pinned and prefetched regardless of which base already provides it. # From 0ccd5fd1aac0cca720fdc9c74fe377f666294d4e Mon Sep 17 00:00:00 2001 From: Emilien Macchi Date: Wed, 2 Sep 2026 14:25:00 -0400 Subject: [PATCH 2/2] fix(konflux): build gateway package Build the openshell-gateway package after gateway binary composition moved out of openshell-server. This ensures the runtime image contains the binary. Signed-off-by: Emilien Macchi --- deploy/docker/Dockerfile.konflux.gateway | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/docker/Dockerfile.konflux.gateway b/deploy/docker/Dockerfile.konflux.gateway index 8e146bb3d5..0f1a8916ee 100644 --- a/deploy/docker/Dockerfile.konflux.gateway +++ b/deploy/docker/Dockerfile.konflux.gateway @@ -48,7 +48,7 @@ RUN mkdir -p /tmp/z3-src \ && if [ -n "$VER" ]; then export OPENSHELL_GIT_VERSION="$VER"; fi \ && Z3_SYS_BUNDLED_DIR_OVERRIDE=/tmp/z3-src \ cargo build --release \ - --package openshell-server \ + --package openshell-gateway \ --features bundled-z3 # ---------------------------------------------------------------------------