Repository navigation
CherryPicked: [v2.10] build: standardize container image - #376
Merged
Merged
Conversation
* Standardize container image - Base the image on UBI 10.1 - Make the container image able to run with user 1001 so special security context change. Standard /app directory structure - Lock the uv version for reproducible builds - Ignore python caches Signed-off-by: Roy Golan <rgolan@redhat.com> * fix: pin UBI base image by digest and use explicit pip invocation - Pin ubi-minimal:10.1 by sha256 digest for reproducible builds - Use python3 -m pip instead of bare pip for explicit interpreter binding - Remove redundant UV_CACHE_DIR (UV_NO_CACHE=1 already disables caching) - Remove unnecessary cache cleanup step * docs: add non-root container guidance for bind-mount permissions Document that the container runs as UID 1001 and provide guidance for writable bind mounts across podman rootless, rootful, and OpenShift. * fix: add --no-run-if-empty flag to xargs in Dockerfile Prevents build failure when no __pycache__ directories exist, which is more likely with PYTHONDONTWRITEBYTECODE=1 set. * fix: install uv via COPY --from instead of pip Use COPY --from=ghcr.io/astral-sh/uv:latest for cleaner uv installation. Drop python3-pip dependency since pip is no longer needed. --------- Signed-off-by: Roy Golan <rgolan@redhat.com>
ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan Review Summary by QodoStandardize container image with UBI base and non-root execution
WalkthroughsDescription• Migrate base image from Fedora 41 to UBI 10.1 with digest pinning • Enable non-root container execution with UID 1001 and group permissions • Optimize Python caching and build reproducibility with uv and environment variables • Install uv via COPY --from instead of pip for cleaner dependency management • Add comprehensive documentation for bind-mount permissions across platforms Diagramflowchart LR
A["Fedora 41 Base Image"] -->|"Replace with"| B["UBI 10.1 by Digest"]
C["Root User"] -->|"Switch to"| D["UID 1001 Non-root"]
E["dnf Package Manager"] -->|"Replace with"| F["microdnf"]
G["pip uv Installation"] -->|"Replace with"| H["COPY --from uv"]
I["Python Cache Enabled"] -->|"Disable with"| J["PYTHONDONTWRITEBYTECODE"]
K["Manual Cache Cleanup"] -->|"Simplify with"| L["UV_NO_CACHE=1"]
File Changes1. Dockerfile
|
Code Review by Qodo
1. Missing bash in image
|
|
Report bugs in Issues Welcome! 🎉This pull request will be automatically processed with the following features: 🔄 Automatic Actions
📋 Available CommandsPR Status Management
Review & Approval
Testing & Validation
Container Operations
Cherry-pick Operations
Label Management
✅ Merge RequirementsThis PR will be automatically approved when the following conditions are met:
📊 Review ProcessApprovers and ReviewersApprovers:
Reviewers:
Available Labels
💡 Tips
For more information, please refer to the project documentation or contact the maintainers. |
Collaborator
Author
|
/lgtm |
|
New container for ghcr.io/redhatqe/mtv-api-tests:v2.10 published |
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+18
to
+27
| RUN microdnf -y install \ | ||
| libxml2-devel \ | ||
| libcurl-devel \ | ||
| openssl \ | ||
| openssl-devel \ | ||
| libcurl-devel \ | ||
| gcc \ | ||
| clang \ | ||
| git \ | ||
| python3-devel \ | ||
| && dnf clean all \ | ||
| && rm -rf /var/cache/dnf \ | ||
| && rm -rf /var/lib/dnf \ | ||
| && truncate -s0 /var/log/*.log && rm -rf /var/cache/yum | ||
| && microdnf clean all |
There was a problem hiding this comment.
1. Missing bash in image 🐞 Bug ✓ Correctness
The container is now based on UBI minimal and does not install bash, but the README and copyoffload docs run the image with /bin/bash -c, which will fail at runtime with “/bin/bash: no such file or directory”. This breaks the primary documented OpenShift Job execution path.
Agent Prompt
## Issue description
The container image no longer guarantees `/bin/bash` exists (UBI minimal), but docs/Job templates run `/bin/bash -c ...`, causing runtime failures.
## Issue Context
The Dockerfile installs dependencies via `microdnf` but omits `bash`. Multiple documented OpenShift Job templates use `/bin/bash` as the entry command.
## Fix Focus Areas
- Dockerfile[18-27]
- README.md[357-360]
- docs/copyoffload/how-to-run-copyoffload-tests.md[315-318]
## Recommended fix
Choose one:
1) Add `bash` to the `microdnf install` list (preferred if you want to keep Job templates unchanged).
2) Update docs/templates to use `/bin/sh -c` instead of `/bin/bash -c` (only if UBI minimal guarantees `/bin/sh`), and ensure any bash-specific syntax is not used.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick from
mainbranch, original PR: #371, PR owner: rgolangh