Repository navigation
CherryPicked: [v2.11] build: standardize container image - #375
Merged
Merged
Conversation
* Standardize container image - Base the image on UBI 10.1 - Make the container image able to run with user 1001 so special security context change. Standard /app directory structure - Lock the uv version for reproducible builds - Ignore python caches Signed-off-by: Roy Golan <rgolan@redhat.com> * fix: pin UBI base image by digest and use explicit pip invocation - Pin ubi-minimal:10.1 by sha256 digest for reproducible builds - Use python3 -m pip instead of bare pip for explicit interpreter binding - Remove redundant UV_CACHE_DIR (UV_NO_CACHE=1 already disables caching) - Remove unnecessary cache cleanup step * docs: add non-root container guidance for bind-mount permissions Document that the container runs as UID 1001 and provide guidance for writable bind mounts across podman rootless, rootful, and OpenShift. * fix: add --no-run-if-empty flag to xargs in Dockerfile Prevents build failure when no __pycache__ directories exist, which is more likely with PYTHONDONTWRITEBYTECODE=1 set. * fix: install uv via COPY --from instead of pip Use COPY --from=ghcr.io/astral-sh/uv:latest for cleaner uv installation. Drop python3-pip dependency since pip is no longer needed. --------- Signed-off-by: Roy Golan <rgolan@redhat.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan Review Summary by QodoStandardize container image to UBI 10.1 with non-root support
WalkthroughsDescription• Standardize container image to UBI 10.1 with reproducible builds • Enable non-root container execution as UID 1001 • Replace package manager with microdnf and optimize dependencies • Install uv via COPY --from for cleaner dependency management • Add documentation for non-root container bind-mount permissions Diagramflowchart LR
A["Fedora 41 Base Image"] -->|"Switch to"| B["UBI 10.1 by Digest"]
C["dnf Package Manager"] -->|"Replace with"| D["microdnf"]
E["pip Installation"] -->|"Replace with"| F["COPY --from uv"]
B -->|"Add"| G["Non-root UID 1001"]
H["Python Cache Files"] -->|"Disable with"| I["PYTHONDONTWRITEBYTECODE"]
G -->|"Document"| J["Bind-mount Guidance"]
File Changes1. Dockerfile
|
Code Review by Qodo
1. Permissions set too early
|
|
Report bugs in Issues Welcome! 🎉This pull request will be automatically processed with the following features: 🔄 Automatic Actions
📋 Available CommandsPR Status Management
Review & Approval
Testing & Validation
Container Operations
Cherry-pick Operations
Label Management
✅ Merge RequirementsThis PR will be automatically approved when the following conditions are met:
📊 Review ProcessApprovers and ReviewersApprovers:
Reviewers:
Available Labels
💡 Tips
For more information, please refer to the project documentation or contact the maintainers. |
Collaborator
Author
|
/lgtm |
|
New container for ghcr.io/redhatqe/mtv-api-tests:v2.11 published |
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+41
to
+50
| RUN mkdir -p ${APP_DIR}/output | ||
|
|
||
| ARG OPENSHIFT_PYTHON_WRAPPER_COMMIT='' | ||
| ARG OPENSHIFT_PYTHON_UTILITIES_COMMIT='' | ||
| RUN chgrp -R 0 ${APP_DIR} && chmod -R g=u ${APP_DIR} | ||
|
|
||
| USER 1001 | ||
|
|
||
| RUN uv sync --locked\ | ||
| && if [ -n "${OPENSHIFT_PYTHON_WRAPPER_COMMIT}" ]; then uv pip install git+https://github.com/RedHatQE/openshift-python-wrapper.git@$OPENSHIFT_PYTHON_WRAPPER_COMMIT; fi \ | ||
| && if [ -n "${OPENSHIFT_PYTHON_UTILITIES_COMMIT}" ]; then uv pip install git+https://github.com/RedHatQE/openshift-python-utilities.git@$OPENSHIFT_PYTHON_UTILITIES_COMMIT; fi \ | ||
| && find ${APP_DIR}/ -type d -name "__pycache__" -print0 | xargs -0 rm -rfv \ | ||
| && rm -rf ${APP_DIR}/.cache | ||
| && if [ -n "${OPENSHIFT_PYTHON_WRAPPER_COMMIT}" ]; then uv pip install "git+https://github.com/RedHatQE/openshift-python-wrapper.git@${OPENSHIFT_PYTHON_WRAPPER_COMMIT}"; fi \ | ||
| && if [ -n "${OPENSHIFT_PYTHON_UTILITIES_COMMIT}" ]; then uv pip install "git+https://github.com/RedHatQE/openshift-python-utilities.git@${OPENSHIFT_PYTHON_UTILITIES_COMMIT}"; fi \ | ||
| && find ${APP_DIR}/ -type d -name "__pycache__" -print0 | xargs -0 -r rm -rfv |
There was a problem hiding this comment.
1. Permissions set too early 🐞 Bug ⛯ Reliability
The Dockerfile applies the OpenShift group-permission pattern (chgrp -R 0 && chmod -R g=u) before running uv sync/git installs, so files created during dependency installation (e.g., venv/site-packages) won’t receive the intended group/permission normalization. This contradicts the README’s claim that this pattern “handles this automatically” on OpenShift and can lead to permission issues when running with OpenShift’s group-based access model.
Agent Prompt
### Issue description
The Dockerfile applies `chgrp -R 0 && chmod -R g=u` before `uv sync` and optional `uv pip install ...`. Files created during these install steps will not be permission-normalized, undermining the intended OpenShift group-access pattern described in the README.
### Issue Context
The README explicitly relies on the Dockerfile’s group-permission pattern for OpenShift. To make that statement true, permission normalization must occur after all filesystem-writing install steps.
### Fix Focus Areas
- Dockerfile[41-50]
- Run `uv sync` (and the two optional `uv pip install ...` lines) while still root **or** run them first under the target user, then apply `chgrp -R 0 && chmod -R g=u` afterwards.
- Ensure the final image still runs as non-root.
- README.md[674-677]
- If behavior changes (e.g., final ordering/user changes), adjust wording to match the actual permission model.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick from
mainbranch, original PR: #371, PR owner: rgolangh