image/rhel/konflux.Dockerfile (1)

93-94: Redundant copy of static-bin/* files.

Line 93 copies static-bin/* into /out/stackrox/, and line 98 copies the entire /out/ to /. Then line 111 copies static-bin/* again to /stackrox/, overwriting the same files. This is redundant and slightly increases build time.

Remove redundant COPY

 COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/bin/roxagent /stackrox/bin/
-COPY --from=go-builder /go/src/github.com/stackrox/rox/app/image/rhel/static-bin/* /stackrox/
 RUN GOARCH=$(uname -m) ; \

Also applies to: 111-111

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@image/rhel/konflux.Dockerfile` around lines 93 - 94, The Dockerfile
duplicates copying static binaries: the COPY --from=go-builder
/go/src/github.com/stackrox/rox/app/image/rhel/static-bin/* /out/stackrox/ and a
later COPY that again places static-bin/* into /stackrox/ (overwriting the same
files); remove the redundant COPY (either the first one to /out/stackrox/ or the
later one to /stackrox/, depending on which target you need preserved) so the
static-bin files are only copied once, keep the chroot /out
/stackrox/save-dir-contents step intact and ensure the remaining COPY uses the
final target path (/stackrox/ or /out/stackrox/) expected by subsequent steps.

image/rhel/Dockerfile (1)

20-26: Consider adding dnf clean all to reduce intermediate layer size.

The dnf install -y zip command lacks cache cleanup. While this is an intermediate build stage and the cache won't reach the final image (only /stackrox-data is copied via line 82), adding cleanup would reduce CI cache/layer size.

Suggested fix

 FROM ubi-base AS stackrox_data

-RUN dnf install -y zip
+RUN dnf install -y zip && dnf clean all && rm -rf /var/cache/dnf /var/cache/yum

 WORKDIR /

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@image/rhel/Dockerfile` around lines 20 - 26, The RUN that installs zip in the
stackrox_data stage leaves DNF caches and should be cleaned in the same layer to
reduce intermediate size; update the RUN that contains "dnf install -y zip" (in
the stackrox_data stage) to perform DNF cache cleanup after install (e.g., run
dnf clean all and remove /var/cache/dnf) so caches are removed in the same layer
that installs zip, keeping the rest of the Dockerfile (COPY
fetch-stackrox-data.sh and creation of /stackrox-data) unchanged.