Skip to content

Commit d9cdc31

Browse files
davdhacsclaude
davdhacs
and
claude
committed
chore: Remove ARM workaround and restore in-container bundle extraction
Remove the temporary workaround that extracted bundles on the host to avoid QEMU tar issues. Restore the standard in-container bundle extraction approach in non-Konflux Dockerfiles while keeping UBI9. Changes: - Remove "Extract bundles on host" step from CI workflow - Restore extracted_bundle Docker stage in all non-Konflux Dockerfiles - Keep UBI9 base images (ubi9-minimal, ubi9) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent da7c385 commit d9cdc31

5 files changed

Lines changed: 34 additions & 32 deletions

File tree

‎.github/workflows/ci.yaml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -396,16 +396,6 @@ jobs:
396396
name: scanner-db-bundle
397397
path: image/db/rhel
398398

399-
# Extract bundles on the host to avoid tar issues under QEMU emulation for arm64
400-
- name: Extract bundles on host
401-
run: |
402-
# Extract scanner bundle
403-
mkdir -p image/scanner/rhel/bundle
404-
tar -xzf image/scanner/rhel/bundle.tar.gz -C image/scanner/rhel/bundle
405-
# Extract scanner-db bundle
406-
mkdir -p image/db/rhel/bundle
407-
tar -xzf image/db/rhel/bundle.tar.gz -C image/db/rhel/bundle
408-
409399
- name: Build scanner image
410400
run: |
411401
docker buildx build --platform "${{ matrix.goos }}/${{ matrix.goarch }}" --load -t stackrox/scanner:"$(make --no-print-directory --quiet tag)" $(make GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} image-build-args) -f image/scanner/rhel/Dockerfile image/scanner/rhel

‎image/db/rhel/Dockerfile‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,11 @@ ARG BASE_REGISTRY=registry.access.redhat.com
66
ARG BASE_IMAGE=ubi9-minimal
77
ARG BASE_TAG=latest
88

9-
# Bundle is pre-extracted on the host to avoid tar issues under QEMU emulation.
10-
# The bundle/ directory should contain: etc/, docker-entrypoint-initdb.d/
9+
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
10+
COPY bundle.tar.gz /
11+
12+
WORKDIR /bundle
13+
RUN microdnf install -y tar gzip && tar -zxf /bundle.tar.gz
1114

1215
FROM ${RPMS_REGISTRY}/${RPMS_BASE_IMAGE}:${RPMS_BASE_TAG} AS postgres_rpms
1316

@@ -35,7 +38,7 @@ ENV PATH="$PATH:/usr/pgsql-$PG_MAJOR/bin/" \
3538

3639
COPY signatures/PGDG-RPM-GPG-KEY-RHEL /
3740
COPY scripts/docker-entrypoint.sh /usr/local/bin/
38-
COPY bundle/etc/postgresql.conf bundle/etc/pg_hba.conf /etc/
41+
COPY --from=extracted_bundle /bundle/etc/postgresql.conf /bundle/etc/pg_hba.conf /etc/
3942
COPY --from=postgres_rpms /rpms/postgres.rpm /rpms/postgres-libs.rpm /rpms/postgres-server.rpm /rpms/postgres-contrib.rpm /tmp/
4043

4144
RUN microdnf upgrade -y --nobest && \
@@ -75,7 +78,7 @@ RUN microdnf upgrade -y --nobest && \
7578
# This is equivalent to postgres:postgres.
7679
USER 70:70
7780

78-
COPY bundle/docker-entrypoint-initdb.d/definitions.sql.gz /docker-entrypoint-initdb.d/
81+
COPY --from=extracted_bundle /bundle/docker-entrypoint-initdb.d/definitions.sql.gz /docker-entrypoint-initdb.d/
7982

8083
ENTRYPOINT ["docker-entrypoint.sh"]
8184

‎image/db/rhel/Dockerfile.slim‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,11 @@ ARG BASE_REGISTRY=registry.access.redhat.com
66
ARG BASE_IMAGE=ubi9-minimal
77
ARG BASE_TAG=latest
88

9-
# Bundle is pre-extracted on the host to avoid tar issues under QEMU emulation.
10-
# The bundle/ directory should contain: etc/
9+
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
10+
COPY bundle.tar.gz /
11+
12+
WORKDIR /bundle
13+
RUN microdnf install -y tar gzip && tar -zxf /bundle.tar.gz
1114

1215
FROM ${RPMS_REGISTRY}/${RPMS_BASE_IMAGE}:${RPMS_BASE_TAG} AS postgres_rpms
1316

@@ -35,7 +38,7 @@ ENV PATH="$PATH:/usr/pgsql-$PG_MAJOR/bin/" \
3538

3639
COPY signatures/PGDG-RPM-GPG-KEY-RHEL /
3740
COPY scripts/docker-entrypoint.sh /usr/local/bin/
38-
COPY bundle/etc/postgresql.conf bundle/etc/pg_hba.conf /etc/
41+
COPY --from=extracted_bundle /bundle/etc/postgresql.conf /bundle/etc/pg_hba.conf /etc/
3942
COPY --from=postgres_rpms /rpms/postgres.rpm /rpms/postgres-libs.rpm /rpms/postgres-server.rpm /rpms/postgres-contrib.rpm /tmp/
4043

4144
RUN microdnf upgrade -y --nobest && \

‎image/scanner/rhel/Dockerfile‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,11 @@ ARG BASE_REGISTRY=registry.access.redhat.com
22
ARG BASE_IMAGE=ubi9-minimal
33
ARG BASE_TAG=latest
44

5-
# Bundle is pre-extracted on the host to avoid tar issues under QEMU emulation.
6-
# The bundle/ directory should contain: scanner, THIRD_PARTY_NOTICES/, nvd_definitions/, etc.
5+
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
6+
7+
COPY bundle.tar.gz /
8+
WORKDIR /bundle
9+
RUN microdnf install -y tar gzip && tar -zxf /bundle.tar.gz
710

811
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS base
912

@@ -24,9 +27,9 @@ SHELL ["/bin/sh", "-o", "pipefail", "-c"]
2427

2528
COPY scripts /
2629

27-
COPY bundle/scanner ./
30+
COPY --from=extracted_bundle /bundle/scanner ./
2831

29-
COPY bundle/THIRD_PARTY_NOTICES/ /THIRD_PARTY_NOTICES/
32+
COPY --from=extracted_bundle /bundle/THIRD_PARTY_NOTICES/ /THIRD_PARTY_NOTICES/
3033

3134
RUN microdnf upgrade -y --nobest && \
3235
microdnf install -y xz && \
@@ -48,11 +51,11 @@ ENV K8S_DEFINITIONS_DIR="/k8s_definitions"
4851
ENV ISTIO_DEFINITIONS_DIR="/istio_definitions"
4952
ENV REPO_TO_CPE_DIR="/repo2cpe"
5053

51-
COPY --chown=65534:65534 "bundle${NVD_DEFINITIONS_DIR}/" ".${NVD_DEFINITIONS_DIR}/"
52-
COPY --chown=65534:65534 "bundle${K8S_DEFINITIONS_DIR}/" ".${K8S_DEFINITIONS_DIR}/"
53-
COPY --chown=65534:65534 "bundle${ISTIO_DEFINITIONS_DIR}/" ".${ISTIO_DEFINITIONS_DIR}/"
54-
COPY --chown=65534:65534 "bundle${REPO_TO_CPE_DIR}/" ".${REPO_TO_CPE_DIR}/"
55-
COPY --chown=65534:65534 bundle/genesis_manifests.json ./
54+
COPY --chown=65534:65534 --from=extracted_bundle "/bundle${NVD_DEFINITIONS_DIR}/" ".${NVD_DEFINITIONS_DIR}/"
55+
COPY --chown=65534:65534 --from=extracted_bundle "/bundle${K8S_DEFINITIONS_DIR}/" ".${K8S_DEFINITIONS_DIR}/"
56+
COPY --chown=65534:65534 --from=extracted_bundle "/bundle${ISTIO_DEFINITIONS_DIR}/" ".${ISTIO_DEFINITIONS_DIR}/"
57+
COPY --chown=65534:65534 --from=extracted_bundle "/bundle${REPO_TO_CPE_DIR}/" ".${REPO_TO_CPE_DIR}/"
58+
COPY --chown=65534:65534 --from=extracted_bundle /bundle/genesis_manifests.json ./
5659

5760
# This is equivalent to nobody:nobody.
5861
USER 65534:65534

‎image/scanner/rhel/Dockerfile.slim‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,11 @@ ARG BASE_REGISTRY=registry.access.redhat.com
22
ARG BASE_IMAGE=ubi9-minimal
33
ARG BASE_TAG=latest
44

5-
# Bundle is pre-extracted on the host to avoid tar issues under QEMU emulation.
6-
# The bundle/ directory should contain: scanner, THIRD_PARTY_NOTICES/, repo2cpe/
5+
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
6+
7+
COPY bundle.tar.gz /
8+
WORKDIR /bundle
9+
RUN microdnf install -y tar gzip && tar -zxf /bundle.tar.gz
710

811
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS base
912

@@ -24,9 +27,9 @@ SHELL ["/bin/sh", "-o", "pipefail", "-c"]
2427

2528
COPY scripts /
2629

27-
COPY bundle/scanner ./
30+
COPY --from=extracted_bundle /bundle/scanner ./
2831
29-
COPY bundle/THIRD_PARTY_NOTICES/ /THIRD_PARTY_NOTICES/
32+
COPY --from=extracted_bundle /bundle/THIRD_PARTY_NOTICES/ /THIRD_PARTY_NOTICES/
3033

3134
RUN microdnf upgrade -y --nobest && \
3235
microdnf install -y xz && \
@@ -45,8 +48,8 @@ RUN microdnf upgrade -y --nobest && \
4548

4649
ENV REPO_TO_CPE_DIR="/repo2cpe"
4750

48-
COPY --chown=65534:65534 "bundle${REPO_TO_CPE_DIR}/" ".${REPO_TO_CPE_DIR}/"
49-
COPY --chown=65534:65534 bundle/genesis_manifests.json ./
51+
COPY --chown=65534:65534 --from=extracted_bundle "/bundle${REPO_TO_CPE_DIR}/" ".${REPO_TO_CPE_DIR}/"
52+
COPY --chown=65534:65534 --from=extracted_bundle /bundle/genesis_manifests.json ./
5053
5154
# This is equivalent to nobody:nobody.
5255
USER 65534:65534

0 commit comments

Comments
 (0)