ROX-33563: Migrate scanner image to ubi-micro by janisz · Pull Request #17430 · stackrox/stackrox

janisz · 2025-10-22T08:01:01Z

Migrate scanner images from ubi8-minimal to ubi8-micro following the same best practices used for collector migration.

Tested:

  export KUBECONFIG=/tmp/tests/kubeconfig
  kubectl -n stackrox set image deployment/central \
    central=quay.io/rhacs-eng/release-main:4.11.0-484-g90cc136570-fast
  kubectl -n stackrox set image deployment/scanner-v4-indexer \
    indexer=quay.io/rhacs-eng/release-scanner-v4:4.11.0-517-g99d643f394-fast

  kubectl -n stackrox set image deployment/scanner-v4-matcher \
    matcher=quay.io/rhacs-eng/release-scanner-v4:4.11.0-517-g99d643f394-fast

  kubectl -n stackrox rollout status deployment/central --timeout=5m
  kubectl -n stackrox rollout status deployment/scanner-v4-indexer --timeout=5m
  kubectl -n stackrox rollout status deployment/scanner-v4-matcher --timeout=5m

Then check in UI if everything is healthy and followed and check if scanner is working

# roxctl --insecure-skip-tls-verify -e https://tj0331aparttheeblank.demos.rox.systems:443 image scan --image=nginx:latest --output=table
Scan results for image: nginx:latest
(TOTAL-COMPONENTS: 57, TOTAL-VULNERABILITIES: 107, LOW: 87, MODERATE: 10, IMPORTANT: 9, CRITICAL: 1)

rhacs-bot · 2025-10-22T08:24:25Z

Images are ready for the commit at e5ba21f.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.10.x-80-ge5ba21f2af.

codecov · 2025-10-22T08:41:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.39%. Comparing base (df8c4bc) to head (99d643f).
⚠️ Report is 72 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #17430   +/-   ##
=======================================
  Coverage   49.39%   49.39%           
=======================================
  Files        2745     2745           
  Lines      207225   207225           
=======================================
  Hits       102368   102368           
- Misses      97265    97266    +1     
+ Partials     7592     7591    -1

Flag	Coverage Δ
go-unit-tests	`49.39% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

janisz · 2025-10-22T16:16:36Z

/retest

scanner/image/scanner/Dockerfile

The scanner-v4-indexer and scanner-v4-matcher containers were crashing immediately with exit code 1 because the migration to ubi8-micro removed essential shell utilities that the entrypoint scripts depend on. Root cause: - entrypoint.sh uses #!/usr/bin/env bash - ubi8-micro has no utilities pre-installed (unlike ubi8-minimal) - The container fails immediately when trying to execute the bash script This fix applies the same multi-stage build pattern used in: - PR #17406 for the main image - commit cc55af9 for scanner-v4-db Changes: 1. Added dependency_builder stage using ubi8 (full) 2. Install bash, coreutils, findutils, util-linux, ca-certificates to /out/ 3. Copy dependencies from builder to ubi8-micro final stage 4. Removed microdnf/rpm operations from final stage (not available in ubi8-micro) 5. Changed BASE_IMAGE from ubi8-minimal to ubi8-micro This enables the entrypoint scripts to execute successfully while maintaining the minimal footprint of ubi8-micro. Fixes: ROX-30858 Related: #17406, #17430 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

rhacs-bot · 2025-10-23T18:30:23Z

/retest

rhacs-bot · 2025-10-23T19:59:15Z

/retest

rhacs-bot · 2025-10-23T20:12:41Z

/retest

rhacs-bot · 2025-10-23T21:12:09Z

Images are ready for the commit at 39afde2.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-337-g39afde24e7.

dcaravel

IIUC this may break image scanners

scanner/image/scanner/Dockerfile

The scanner-v4-indexer and scanner-v4-matcher containers were crashing immediately with exit code 1 because the migration to ubi8-micro removed essential shell utilities that the entrypoint scripts depend on. Root cause: - entrypoint.sh uses #!/usr/bin/env bash - ubi8-micro has no utilities pre-installed (unlike ubi8-minimal) - The container fails immediately when trying to execute the bash script This fix applies the same multi-stage build pattern used in: - PR #17406 for the main image - commit cc55af9 for scanner-v4-db Changes: 1. Added dependency_builder stage using ubi8 (full) 2. Install bash, coreutils, findutils, util-linux, ca-certificates to /out/ 3. Copy dependencies from builder to ubi8-micro final stage 4. Removed microdnf/rpm operations from final stage (not available in ubi8-micro) 5. Changed BASE_IMAGE from ubi8-minimal to ubi8-micro This enables the entrypoint scripts to execute successfully while maintaining the minimal footprint of ubi8-micro. Fixes: ROX-30858 Related: #17406, #17430 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

gitguardian · 2026-03-23T17:29:02Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
28930366	Triggered	Generic High Entropy Secret	`557483a`	sensor/kubernetes/fake/secret.go	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

Complete scanner UBI 9 upgrade while preserving ubi-micro architecture. Resolved conflicts in scanner Dockerfiles: - Updated all ubi8 references to ubi9 - Updated releasever from 8 to 9 - Preserved package_installer pattern with ubi9/ubi-micro - Updated save-dir-contents path to /etc/pki/ca-trust/source - Kept direct FROM statements (not ARG-based) User request: merge master and resolve conflicts after UBI 9 upgrade. Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

rhacs-bot · 2026-03-24T19:10:51Z

Images are ready for the commit at 99d643f.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-470-g8656442835.

dcaravel

Few nits for consideration - also believe title of PR should read ubi9-micro (currently says ubi8)

Thanks for taking care of this!

scanner/image/scanner/konflux.Dockerfile

scanner/image/scanner/Dockerfile

Signed-off-by: Tomasz Janiszewski <[email protected]>

…eed them Signed-off-by: Tomasz Janiszewski <[email protected]>

scanner/image/scanner/Dockerfile

Signed-off-by: Tomasz Janiszewski <[email protected]>

janisz · 2026-03-26T14:44:46Z

/retest

Signed-off-by: Tomasz Janiszewski <[email protected]>

janisz · 2026-03-27T12:40:02Z

/retest

openshift-ci · 2026-03-27T17:34:17Z

@janisz: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp-4-20-scanner-v4-install-tests	`e78bb32`	link	false	`/test ocp-4-20-scanner-v4-install-tests`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

janisz · 2026-03-30T15:50:06Z

/retest

The mapping files were copied to /run/mappings/ instead of /out/run/mappings/, causing them to be excluded from the final image since only /out/ is copied in the final stage. This caused scanner-v4-indexer to crash on startup with "no such file or directory". Aligns with the correct path already used in konflux.Dockerfile. Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

These packages may not be needed for scanner operation, reducing image size and attack surface. Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Cleanup package list to match Dockerfile changes. Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Signed-off-by: Tomasz Janiszewski <[email protected]>

github-actions · 2026-03-30T16:10:49Z

/konflux-retest main-on-push

github-actions · 2026-03-30T17:15:20Z

/konflux-retest main-on-push

github-actions · 2026-03-30T17:16:10Z

/konflux-retest operator-bundle-on-push

janisz requested a review from a team as a code owner October 22, 2025 08:01

github-actions bot added the area/scanner label Oct 22, 2025

janisz changed the title ~~ROX-30858: Migrate scanner image from ubi8-minimal to ubi8-micro~~ WIP: ROX-30858: Migrate scanner image from ubi8-minimal to ubi8-micro Oct 22, 2025

openshift-ci bot added the do-not-merge/work-in-progress label Oct 22, 2025

janisz mentioned this pull request Oct 22, 2025

ROX-30858: Migrate scanner DB image from ubi8-minimal to ubi8-micro #17431

Open

janisz added the auto-retest PRs with this label will be automatically retested if prow checks fails label Oct 22, 2025

janisz commented Oct 22, 2025

View reviewed changes

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

janisz changed the title ~~WIP: ROX-30858: Migrate scanner image from ubi8-minimal to ubi8-micro~~ WIP: ROX-30858: Migrate scanner image to ubi8-micro Oct 24, 2025

janisz changed the title ~~WIP: ROX-30858: Migrate scanner image to ubi8-micro~~ ROX-30858: Migrate scanner image to ubi8-micro Oct 29, 2025

openshift-ci bot removed the do-not-merge/work-in-progress label Oct 29, 2025

dcaravel requested changes Nov 26, 2025

View reviewed changes

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

janisz changed the title ~~ROX-30858: Migrate scanner image to ubi8-micro~~ ROX-33563: Migrate scanner image to ubi8-micro Mar 11, 2026

janisz added the konflux-build Run Konflux in PR. Push commit to trigger it. label Mar 11, 2026

janisz force-pushed the ubi-mirco-scanner branch from 7ec8ef2 to 8761059 Compare March 11, 2026 13:16

janisz requested review from a team and rhacs-bot as code owners March 11, 2026 13:16

rhacs-bot requested a review from a team March 11, 2026 13:16

janisz force-pushed the ubi-mirco-scanner branch 2 times, most recently from 53adcac to 400c63d Compare March 16, 2026 14:47

openshift-ci bot removed the needs-rebase label Mar 23, 2026

dcaravel approved these changes Mar 25, 2026

View reviewed changes

scanner/image/scanner/konflux.Dockerfile Outdated Show resolved Hide resolved

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

janisz added 5 commits March 25, 2026 08:34

Merge branch 'master' into ubi-mirco-scanner

1a4eebe

Apply suggestion from @janisz

0ddcc29

Apply suggestion from @janisz

0614429

fix

1ef0139

Signed-off-by: Tomasz Janiszewski <[email protected]>

WIP: just for testing remove findutils and util-linx to check if we n…

c3162fe

…eed them Signed-off-by: Tomasz Janiszewski <[email protected]>

janisz commented Mar 25, 2026

View reviewed changes

scanner/image/scanner/Dockerfile Outdated Show resolved Hide resolved

janisz changed the title ~~ROX-33563: Migrate scanner image to ubi8-micro~~ ROX-33563: Migrate scanner image to ubi-micro Mar 25, 2026

janisz added 2 commits March 25, 2026 10:14

move comment to rpms.in.yaml

e78bb32

Signed-off-by: Tomasz Janiszewski <[email protected]>

remove findutils and util-linux

1ae3297

Signed-off-by: Tomasz Janiszewski <[email protected]>

add missing pacakges

48486bb

Signed-off-by: Tomasz Janiszewski <[email protected]>

stackrox deleted a comment from rhacs-bot Mar 27, 2026

stackrox deleted a comment from rhacs-bot Mar 30, 2026

janisz and others added 5 commits March 30, 2026 17:58

Remove unnecessary findutils and util-linux packages

bc0ed6e

These packages may not be needed for scanner operation, reducing image size and attack surface. Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Remove findutils and util-linux from rpms.in.yaml

0df4ddf

Cleanup package list to match Dockerfile changes. Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

revert rpms.lock.yaml

8656442

Signed-off-by: Tomasz Janiszewski <[email protected]>

Merge branch 'master' into ubi-mirco-scanner

99d643f

janisz requested a review from msugakov April 1, 2026 11:42

Conversation

janisz commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rhacs-bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

janisz commented Oct 22, 2025

Uh oh!

Uh oh!

rhacs-bot commented Oct 23, 2025

Uh oh!

rhacs-bot commented Oct 23, 2025

Uh oh!

rhacs-bot commented Oct 23, 2025

Uh oh!

rhacs-bot commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dcaravel left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gitguardian bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

rhacs-bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dcaravel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

janisz commented Mar 26, 2026

Uh oh!

janisz commented Mar 27, 2026

Uh oh!

openshift-ci bot commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

janisz commented Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

janisz commented Oct 22, 2025 •

edited

Loading

rhacs-bot commented Oct 22, 2025 •

edited

Loading

codecov bot commented Oct 22, 2025 •

edited

Loading

rhacs-bot commented Oct 23, 2025 •

edited

Loading

dcaravel left a comment •

edited

Loading

gitguardian bot commented Mar 23, 2026 •

edited

Loading

rhacs-bot commented Mar 24, 2026 •

edited

Loading

openshift-ci bot commented Mar 27, 2026 •

edited

Loading