ROX-33559: Migrate collector images from UBI-minimal to UBI-micro by janisz · Pull Request #3021 · stackrox/collector

janisz · 2026-03-04T11:53:43Z

Description

Reduce container image size and improve security posture by migrating from UBI minimal base images to UBI micro base images.

31% smaller image (183 MB → 127 MB, saved 56 MB)
40% fewer packages (111 → 67, removed 44 packages)
41% fewer libraries (239 → 141 library files, removed 98)
17% fewer binaries (195 → 162 in /usr/bin, removed 33)

Removed Packages

GPG/Signing stack (7): gnupg2, gpgme, libgcrypt, libgpg-error, libassuan, libksba, npth
GNOME/GObject libs (8): glib2, gobject-introspection, json-glib, libpeas, systemd-libs, libxml2, libunistring, libidn2
Package management (8): libmodulemd, librepo, librhsm, lua-libs, lz4-libs, libreport-filesystem, python-unversioned-command, popt
Fonts/Localization (5): dejavu-sans-fonts, fonts-filesystem, langpacks-*
Storage/Mount (4): libblkid, libmount, libsmartcols, libusbx
Network/Security (4): curl-minimal, cyrus-sasl-lib, openldap, gnutls
System utilities (5): audit-libs, shadow-utils, libsemanage, libxcrypt-compat, rootfiles
Misc (3): file-libs, libevent, libtool-ltdl, nettle, json-c

Refs:

ROX-30858: Migrate main image to ubi8-micro stackrox#17406

Checklist

Investigated and inspected CI test results
Updated documentation accordingly

Automated testing

Added unit tests
Added integration tests
Added regression tests

If any of these don't apply, please comment below.

Testing Performed

CI

codecov-commenter · 2026-03-04T12:02:05Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.38%. Comparing base (dc3947e) to head (d04295d).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3021   +/-   ##
=======================================
  Coverage   27.38%   27.38%           
=======================================
  Files          95       95           
  Lines        5427     5427           
  Branches     2548     2548           
=======================================
  Hits         1486     1486           
  Misses       3214     3214           
  Partials      727      727

Flag	Coverage Δ
collector-unit-tests	`27.38% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

msugakov · 2026-03-04T16:31:37Z

Related https://redhat-internal.slack.com/archives/CFMQ5C2TT/p1772614563075869

msugakov

Most of what I commented on collector/container/Dockerfile applies to collector/container/konflux.Dockerfile also.

collector/container/Dockerfile

@msugakov

Changes: - Switch from ubi-minimal to ubi base image for package_installer stages - Remove dnf installation step (ubi already includes dnf) - UBI10: sha256:f573194e8e5231f1c9340c497e1f8d9aa9dbb42b2849e60341e34f50eec9477e - UBI9: sha256:cecb1cde7bda7c8165ae27841c2335667f8a3665a349c0d051329c61660a496c This improves build efficiency since we no longer need to install dnf on top of ubi-minimal, which essentially gives us ubi anyway. Addresses review comment from @msugakov on PR #3021. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

@msugakov

Changes: - Add ubi-micro-base stage to reference the ubi-micro image - Create package_installer_final stage that copies ubi-micro base to /out - Install packages on top of the existing ubi-micro base - Use ubi-micro-base as the final runtime image base This ensures that the rpmdb in the final image correctly tracks both: 1. Packages that come with the ubi-micro base image 2. Packages we install via dnf --installroot Without this change, we were creating a new rpmdb from scratch in /out, which would replace ubi-micro's existing rpmdb and lose track of packages already present in the base image. Addresses review comment from @msugakov on PR #3021. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

@msugakov

Add openssl to the package list in both Dockerfiles to enable FIPS support. This is a mandatory requirement for FIPS compliance. Addresses review comment from @msugakov on PR #3021. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

collector/container/Dockerfile

collector/container/konflux.Dockerfile

collector/container/Dockerfile

collector/container/rhel/install.sh

collector/container/.dockerignore

collector/container/konflux.Dockerfile

collector/container/Dockerfile

Add bash, coreutils, curl, grep, and gawk to the runtime package list in konflux.Dockerfile to match the regular Dockerfile and provide necessary shared libraries and utilities. These packages were missing from the konflux.Dockerfile package_installer stage, causing runtime errors: - curl provides libcurl.so.4 (required by collector binary) - bash, coreutils, grep, gawk provide shell utilities used by scripts The packages are already present in rpms.lock.yaml (included as dependencies from other packages or previous builds), so only rpms.in.yaml needs to be updated to document the explicit dependency. Fixes error: collector: error while loading shared libraries: libcurl.so.4: cannot open shared object file: No such file or directory Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

Replace the complex sed-based generation of Dockerfile.dev with a static single-stage Dockerfile for development builds. This simplifies the build process and makes the development Dockerfile easier to maintain. Changes: - Add static collector/container/Dockerfile.dev using full UBI base - Remove container-dockerfile-dev target from Makefile - Update image-dev target to use static Dockerfile.dev directly - Remove --build-arg BUILD_TYPE=devel (not needed for dedicated dev Dockerfile) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> chore: Add static Dockerfile.dev and update .gitignore Add the static Dockerfile.dev file that was previously ignored, and remove it from .gitignore since it's now a source file rather than a generated one. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

The collector binary requires libcap-ng.so.0 at runtime, but this library was missing from the final image after commit 4b7f0cc removed packages. While libcap-ng-devel is installed in the builder stage, the runtime library libcap-ng must also be present in the final image. This was causing CI test failures with: "collector: error while loading shared libraries: libcap-ng.so.0: cannot open shared object file: No such file or directory" Changes: - Added libcap-ng to rpms.in.yaml final stage packages - Added libcap-ng to konflux.Dockerfile runtime packages - Added libcap-ng (and missing c-ares, tbb) to Dockerfile runtime packages Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

Rename collector/container/Dockerfile.dev to dev.Dockerfile to follow a more consistent naming convention (matching konflux.Dockerfile pattern). This is now a static file (not generated), so removed it from the clean target in collector/Makefile. Changes: - Renamed collector/container/Dockerfile.dev to dev.Dockerfile - Updated Makefile to reference dev.Dockerfile - Removed dev.Dockerfile from clean target (no longer generated) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>

@msugakov

Change from removing all /var/cache/* to specifically removing only /var/cache/dnf and /var/cache/yum to prevent accidentally removing needed files like ldconfig/aux-cache. This prevents potential regressions if future RHEL releases add other important files to /var/cache. Addresses review comment from @msugakov on PR #3021. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

@Molter73

Switch from UBI to CentOS Stream 10 for development builds. CentOS Stream provides more debugging and testing tools which are useful for development. Addresses review comment from @Molter73 on PR #3021. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

@sha256

Remove digest pins (@sha256:...) from collector/container/Dockerfile and use floating :latest tags instead. Non-konflux images are not updated via MintMaker, so pinned digests would be set in stone forever. Only konflux.Dockerfile should use pinned digests for reproducibility. Addresses review comment from @Molter73 on PR #3021. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

@Molter73

Replace the install.sh script with inline commands directly in the Dockerfile. The install scripts were meant to avoid duplicate Dockerfiles, but since we now have a dedicated dev.Dockerfile, we can inline the commands for better clarity. Addresses review comment from @Molter73 on PR #3021. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Move file copies from package_installer stage back to final stage for semantic clarity. The package_installer stage should focus on installing packages, while the final stage assembles all files. This addresses reviewer ovalenti's preference on PR #3021. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

msugakov · 2026-03-16T18:28:37Z

🚢

janisz requested review from a team and rhacs-bot as code owners March 4, 2026 11:53

rhacs-bot requested a review from a team March 4, 2026 11:53

janisz changed the title ~~ROX-30858: Migrate collector images from UBI-minimal to UBI-micro~~ WIP: ROX-30858: Migrate collector images from UBI-minimal to UBI-micro Mar 4, 2026

janisz force-pushed the ubi-micro branch 4 times, most recently from a50fa44 to 417c31a Compare March 4, 2026 14:40

msugakov requested a review from ovalenti March 4, 2026 16:30

msugakov reviewed Mar 4, 2026

View reviewed changes

collector/container/Dockerfile Outdated Show resolved Hide resolved

collector/container/Dockerfile Show resolved Hide resolved

collector/container/Dockerfile Outdated Show resolved Hide resolved

collector/container/Dockerfile Outdated Show resolved Hide resolved

msugakov reviewed Mar 4, 2026

View reviewed changes

collector/container/Dockerfile Outdated Show resolved Hide resolved

collector/container/Dockerfile Outdated Show resolved Hide resolved

collector/container/konflux.Dockerfile Outdated Show resolved Hide resolved

janisz force-pushed the ubi-micro branch 2 times, most recently from 5f66aec to b7e45ba Compare March 5, 2026 17:54

janisz commented Mar 6, 2026

View reviewed changes

collector/container/Dockerfile Show resolved Hide resolved

janisz changed the title ~~WIP: ROX-30858: Migrate collector images from UBI-minimal to UBI-micro~~ ROX-30858: Migrate collector images from UBI-minimal to UBI-micro Mar 6, 2026

Molter73 reviewed Mar 6, 2026

View reviewed changes

collector/container/rhel/install.sh Outdated Show resolved Hide resolved

Molter73 reviewed Mar 6, 2026

View reviewed changes

collector/container/.dockerignore Outdated Show resolved Hide resolved

msugakov reviewed Mar 6, 2026

View reviewed changes

collector/container/konflux.Dockerfile Outdated Show resolved Hide resolved

collector/container/konflux.Dockerfile Outdated Show resolved Hide resolved

collector/container/konflux.Dockerfile Outdated Show resolved Hide resolved

janisz force-pushed the ubi-micro branch from 3922f48 to 7da3fdc Compare March 6, 2026 14:09

janisz requested review from a team and Molter73 March 9, 2026 16:07

ovalenti reviewed Mar 10, 2026

View reviewed changes

collector/container/Dockerfile Outdated Show resolved Hide resolved

collector/container/Dockerfile Show resolved Hide resolved

janisz changed the title ~~ROX-30858: Migrate collector images from UBI-minimal to UBI-micro~~ ROX-33559: Migrate collector images from UBI-minimal to UBI-micro Mar 11, 2026

janisz and others added 26 commits March 16, 2026 11:49

remove unnecessary pacakges

4f9dffe

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

fix

1627414

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

fix

36d1dc3

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

fix

97aedf4

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

Update rpms.in.yaml

589a43a

Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>

fix

f0118b4

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

fix

55362c7

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

fix

467032e

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

Remove --allowearsing

4aac0ca

Apply suggestion from @msugakov

3bb578c

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

Apply suggestion from @janisz

c0b5266

revert collector/.gitignore

33c7ae4

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

cleanup

b72bece

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

cleanup

99e49c9

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

comment gitignore

4e10e93

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

Update collector/container/konflux.Dockerfile

277834c

Co-authored-by: Misha Sugakov <537715+msugakov@users.noreply.github.com>

fixes

d04295d

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

janisz force-pushed the ubi-micro branch from a8faec2 to d04295d Compare March 16, 2026 11:01

janisz merged commit f17b7ac into master Mar 16, 2026
113 of 114 checks passed

janisz deleted the ubi-micro branch March 16, 2026 15:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ROX-33559: Migrate collector images from UBI-minimal to UBI-micro#3021

ROX-33559: Migrate collector images from UBI-minimal to UBI-micro#3021
janisz merged 35 commits intomasterfrom
ubi-micro

janisz commented Mar 4, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Mar 4, 2026 •

edited

Loading

Uh oh!

msugakov commented Mar 4, 2026

Uh oh!

msugakov left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

msugakov commented Mar 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

janisz commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Testing Performed

Uh oh!

codecov-commenter commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

msugakov commented Mar 4, 2026

Uh oh!

msugakov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

msugakov commented Mar 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

janisz commented Mar 4, 2026 •

edited

Loading

codecov-commenter commented Mar 4, 2026 •

edited

Loading