OHSS-55168: Fix Dockerfile USER to numeric UID, update boilerplate#286
OHSS-55168: Fix Dockerfile USER to numeric UID, update boilerplate#286nephomaniac wants to merge 2 commits into
Conversation
WalkthroughThree maintenance changes: the CI operator build root image tag is bumped from ChangesMaintenance Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 13 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (13 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: nephomaniac The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/label tide/merge-method-squash |
openshift-ci
Bot
added
the
tide/merge-method-squash
nephomaniac
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@nephomaniac: This pull request references OHSS-55168 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the incident to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e/Dockerfile`:
- Line 2: In the Dockerfile at the FROM instruction, replace the fixed Red Hat
builder tag from `rhel_9_1.26` to `rhel_9_1`. This changes the image reference
from `brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26` to
`brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1`, which
allows Red Hat's automated security patch updates to be applied automatically
rather than being pinned to a specific patch version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2fa99dec-8df9-49ab-9bc2-5a720165d48b
⛔ Files ignored due to path filters (10)
boilerplate/_data/backing-image-tagis excluded by!boilerplate/**boilerplate/_data/last-boilerplate-commitis excluded by!boilerplate/**boilerplate/_lib/container-makeis excluded by!boilerplate/**boilerplate/_lib/subscriber-propose-updateis excluded by!boilerplate/**boilerplate/openshift/golang-osd-e2e/updateis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/OWNERS_ALIASESis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/dependabot.ymlis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/docs/pre-commit.mdis excluded by!boilerplate/**build/Dockerfileis excluded by!build/**build/Dockerfile.olm-registryis excluded by!build/**
📒 Files selected for processing (3)
.ci-operator.yamlOWNERS_ALIASEStest/e2e/Dockerfile
💤 Files with no reviewable changes (1)
- OWNERS_ALIASES
| @@ -1,5 +1,5 @@ | |||
| # THIS FILE IS GENERATED BY BOILERPLATE. DO NOT EDIT. | |||
| FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.25 as builder | |||
| FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 as builder | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify current Dockerfile base-image tag patterns for RH builder images
# and check whether floating tags are used elsewhere in the repo.
rg -n --iglob '*Dockerfile*' 'brew\.registry\.redhat\.io/.+openshift-golang-builder:.+'Repository: openshift/managed-node-metadata-operator
Length of output: 191
🏁 Script executed:
#!/bin/bash
# Find all Dockerfile* files in the repository
fd -t f 'Dockerfile' --type f
# Then show their content to check base image tag patterns
for file in $(fd -t f 'Dockerfile' --type f); do
echo "=== $file ==="
head -20 "$file" | grep -E '^FROM|^ARG'
doneRepository: openshift/managed-node-metadata-operator
Length of output: 1270
Use a floating Red Hat builder tag instead of a fixed patch tag.
Change rhel_9_1.26 to rhel_9_1 to allow Red Hat's automated patch updates. Per the Dockerfile security guidelines, Red Hat images must use floating tags.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/e2e/Dockerfile` at line 2, In the Dockerfile at the FROM instruction,
replace the fixed Red Hat builder tag from `rhel_9_1.26` to `rhel_9_1`. This
changes the image reference from
`brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26` to
`brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1`, which
allows Red Hat's automated security patch updates to be applied automatically
rather than being pinned to a specific patch version.
Source: Coding guidelines
|
@nephomaniac: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #286 +/- ##
=======================================
Coverage 58.60% 58.60%
=======================================
Files 5 5
Lines 244 244
=======================================
Hits 143 143
Misses 87 87
Partials 14 14 🚀 New features to boost your workflow:
|
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
3 participants
Summary
USER nonroot:nonrootwithUSER 65534:65534inbuild/Dockerfile(OHSS-55168)Problem
The Dockerfile uses
USER nonroot:nonroot(a string username from Google's distroless convention), but the base image is UBI minimal which does not have anonrootuser. When the deployment setsrunAsNonRoot: true, Kubernetes cannot verify the non-numeric user is non-root, resulting inCreateContainerConfigError. Currently affecting ~63 clusters (50 ROSA, 13 OSD) per OHSS-55168.Fix
Use numeric UID
65534(nobody, which exists on UBI minimal) instead of the stringnonroot.References
🤖 Generated with Claude Code
Summary by CodeRabbit