fix(tests): MiniIO image replacement

[mbevc1]

Upstream is deprecated and temporary switching to Chainguard image while we find a permanent replacement.

Checklist

• Docs are autogenerated from CLI help — make sure the help text reflects your changes
• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed

[claude]

Claude finished @mbevc1's task in 2m 1s —— View job

---

PR Review: MinIO image replacement

• Gather context (PR diff, docker-compose.yml, bin/reset-or-start-server.sh, CI workflows)
• Understand the request — code review
• Static analysis
• Review the change
• Post feedback

---

Verdict

The change looks correct and is a sensible temporary fix. One inline comment on image pinning; nothing blocking.

Static analysis

No Go files changed, so go build / go vet / go mod tidy are not meaningful signals for this PR. The relevant gate is make test_integration, which runs docker compose up and waits on localhost:9010/minio/health/live (bin/reset-or-start-server.sh:43) — CI exercises this container end to end via make test_integration_full (.github/workflows/test.yml:179). I could not verify the image at runtime — the sandbox blocks docker pull and outbound network, so I couldn't confirm the Chainguard image internals. A green CI run on this PR is the real check.

What's good

• Correctly dropped RUN chmod +x /usr/bin/mc. COPY --from preserves the source file mode, so the chmod is redundant — and it had to go, since Chainguard's non-dev builder stage has no shell for RUN to use. Easy detail to get wrong.
• Multi-stage copy is the right shape. quay.io/minio/minio bundled mc; Chainguard splits minio and minio-client into separate images, and a build-stage copy is the cleanest way to reassemble what docker-compose.yml:89 needs (mc mb ... && minio server ...) without a package manager.
• Kept /usr/bin/mc as the destination path, so docker-compose.yml needs no change. Nice minimal blast radius.
• Trailing newline added — the old file had none.

Points to confirm on the CI run

1. mc source path. If cgr.dev/chainguard/minio-client puts the binary somewhere other than /usr/bin/mc, the COPY fails at build time — loud, not silent, so low risk.
2. Runtime user. quay.io/minio/minio ran as root; Chainguard images commonly default to nonroot (UID 65532). The command writes to /data and mc wants a config dir under $HOME. Neither is backed by a named volume (docker compose down -v in the Makefile implies ephemeral state), so if permissions bite, it'll show up as the /minio/health/live wait timing out rather than anything subtle.

Note on scope

cgr.dev/chainguard/minio:latest-dev is a development variant — it carries a shell and package manager, so it's a larger surface than the non-dev image. That's fine here: this container only exists in docker-compose.yml for local and CI integration tests and is never shipped. Worth keeping in mind if the "temporary" replacement outlives its welcome, since the -dev dependency comes from the compose entrypoint rather than from MinIO itself.

Inline comment

• minio/Dockerfile:1-4 — unpinned :latest on both stages; suggested a digest pin plus a docker ecosystem entry in .github/dependabot.yml, and a comment recording why -dev is required.
  • Branch: 20260925_fix_mino