Skip to content

Switch to UBI9 minimal multi-stage image #146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sheltoncyril merged 7 commits into from
May 20, 2026
Merged

Switch to UBI9 minimal multi-stage image #146

Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
2fe0fff
build: switch to UBI9 minimal multi-stage image
SudipSinha May 7, 2026
8b4a481
fix: address Containerfile review findings
SudipSinha May 7, 2026
9c0c714
fix(ci): keep FIPS doc label last for CI expiry injection
SudipSinha May 8, 2026
ba896ff
fix(ci): update sed pattern to handle leading spaces in FIPS document…
SudipSinha May 18, 2026
b3c0988
fix(build): resolve UBI9 repository configuration issues
SudipSinha May 18, 2026
208f1a8
fix(ci): improve label injection verification precision
SudipSinha May 18, 2026
704fd5f
fix(ci): update expiry label injection to use base.name instead of re…
SudipSinha May 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
130 changes: 67 additions & 63 deletions Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,95 +1,98 @@
FROM registry.access.redhat.com/ubi9/python-312:latest
# UBI9 Python 3.12 Minimal — reduced Trivy surface with FIPS support.
# Uses the full UBI9 Python image as builder, minimal as runtime.

ARG EXTRAS=""
ARG VERSION="1.0.0rc0"
ARG BUILD_DATE
ARG VCS_REF
ARG ENABLE_FIPS_POLICY="true"

# Use UBI standard directory instead of /app
WORKDIR /opt/app-root
# =============================================================================
# Stage 1: Builder — full UBI9 image with compilers and dev headers
# =============================================================================
FROM registry.access.redhat.com/ubi9/python-312:latest AS builder

ARG EXTRAS

# Install MariaDB dev libraries if needed
RUN if [[ "$EXTRAS" == *"mariadb"* ]]; then \
curl --fail -LsSO https://r.mariadb.com/downloads/mariadb_repo_setup && \
grep -q "mariadb_repo_setup" mariadb_repo_setup || { echo "ERROR: Downloaded script appears invalid"; exit 1; } && \
[ -s mariadb_repo_setup ] || { echo "ERROR: Downloaded script is empty"; exit 1; } && \
chmod +x mariadb_repo_setup && \
./mariadb_repo_setup --mariadb-server-version="mariadb-11.4" --skip-check-installed && \
Comment thread
SudipSinha marked this conversation as resolved.
Outdated
dnf install -y --disablerepo=rhel-9-for-aarch64-appstream-rpms \
--disablerepo=rhel-9-for-aarch64-baseos-rpms \
--disablerepo=rhel-9-for-x86_64-appstream-rpms \
--disablerepo=rhel-9-for-x86_64-baseos-rpms \
MariaDB-shared-11.4* MariaDB-devel-11.4* && \
dnf clean all && \
rm -rf /var/cache/dnf /var/cache/yum /root/.cache mariadb_repo_setup; \
fi

COPY pyproject.toml README.md ./

RUN pip install --no-cache-dir --upgrade pip==26.1.1 uv==0.11.1 && \
uv pip install --no-cache ".[$EXTRAS]" && \
pip uninstall -y uv && \
Comment thread
SudipSinha marked this conversation as resolved.
rm -rf /root/.cache /tmp/*

# =============================================================================
# Stage 2: Runtime — minimal UBI9 image (no compilers, no dev headers)
# =============================================================================
FROM registry.access.redhat.com/ubi9/python-312-minimal:latest

ARG EXTRAS
ARG VERSION
ARG BUILD_DATE
ARG VCS_REF
ARG ENABLE_FIPS_POLICY

USER root

# ===========================================================================================
# FIPS COMPLIANCE CONFIGURATION
# ===========================================================================================
# Set system crypto policy to FIPS for maximum compatibility with FIPS environments.
#
# IMPORTANT: This enables FIPS crypto policy but NOT full FIPS mode (requires kernel fips=1).
# - On NON-FIPS hosts: Uses FIPS-approved algorithms where possible
# - On FIPS-enabled hosts: Container automatically inherits full FIPS mode from kernel
#
# Application code is FIPS-compatible (verified in Phase 3 security review).
# For details, see: docs/FIPS_compliance.md
# ===========================================================================================
# FIPS crypto policy
RUN if [ "$ENABLE_FIPS_POLICY" = "true" ]; then \
echo "Configuring FIPS crypto policy..." && \
microdnf --disablerepo='rhel-*' install -y crypto-policies-scripts && \
update-crypto-policies --set FIPS && \
microdnf clean all && \
rm -rf /var/cache/yum && \
echo "FIPS crypto policy enabled (full FIPS mode requires FIPS-enabled host)"; \
else \
echo "FIPS crypto policy not enabled (set ENABLE_FIPS_POLICY=true to enable)"; \
fi

# Verify and display FIPS configuration
RUN echo "========================================" && \
echo "FIPS Configuration Status:" && \
echo "========================================" && \
echo "Crypto Policy: $(update-crypto-policies --show 2>/dev/null || echo 'Unknown')" && \
echo "FIPS Modules: $(ls -1 /usr/lib64/ossl-modules/fips.so 2>/dev/null && echo 'Installed' || echo 'Not found')" && \
echo "OpenSSL Version: $(openssl version 2>/dev/null || echo 'Unknown')" && \
fips-mode-setup --check 2>&1 | grep -E "(enabled|disabled|Inconsistent)" || echo "FIPS status check unavailable" && \
echo "========================================" && \
echo "Note: Full FIPS mode activation requires:" && \
echo " 1. FIPS-enabled host (kernel fips=1)" && \
echo " 2. Container inherits FIPS mode from host" && \
echo " 3. See docs/FIPS_compliance.md for details" && \
echo "========================================"

# Install MariaDB connector if needed (requires version >= 3.3.1, UBI has 3.2.6)
# Pin to 11.4.x for stability (allows patch updates)
RUN if [[ "$EXTRAS" == *"mariadb"* ]]; then \
curl --fail -LsSO https://r.mariadb.com/downloads/mariadb_repo_setup && \
# Verify script integrity (basic sanity check - script should contain mariadb_repo_setup signature)
grep -q "mariadb_repo_setup" mariadb_repo_setup || { echo "ERROR: Downloaded script appears invalid"; exit 1; } && \
[ -s mariadb_repo_setup ] || { echo "ERROR: Downloaded script is empty"; exit 1; } && \
chmod +x mariadb_repo_setup && \
./mariadb_repo_setup --mariadb-server-version="mariadb-11.4" --skip-check-installed && \
dnf install -y --disablerepo=rhel-9-for-aarch64-appstream-rpms \
--disablerepo=rhel-9-for-aarch64-baseos-rpms \
--disablerepo=rhel-9-for-x86_64-appstream-rpms \
--disablerepo=rhel-9-for-x86_64-baseos-rpms \
MariaDB-shared-11.4* MariaDB-devel-11.4* && \
dnf clean all && \
rm -rf /var/cache/dnf /var/cache/yum /root/.cache mariadb_repo_setup; \
# Install MariaDB shared libraries if needed
RUN if echo "$EXTRAS" | grep -q "mariadb"; then \
curl --fail -LsSO https://r.mariadb.com/downloads/mariadb_repo_setup && \
grep -q "mariadb_repo_setup" mariadb_repo_setup || { echo "ERROR: Downloaded script appears invalid"; exit 1; } && \
[ -s mariadb_repo_setup ] || { echo "ERROR: Downloaded script is empty"; exit 1; } && \
chmod +x mariadb_repo_setup && \
./mariadb_repo_setup --mariadb-server-version="mariadb-11.4" --skip-check-installed && \
microdnf install -y MariaDB-shared-11.4* && \
microdnf clean all && \
rm -rf /var/cache/yum mariadb_repo_setup; \
fi

# Copy only dependency files first for better layer caching
COPY pyproject.toml README.md ./
# Upgrade system pip to eliminate base image CVEs
RUN pip install --no-cache-dir --upgrade pip==26.1.1 && rm -rf /root/.cache

# Install dependencies with pinned uv version and cleanup
RUN pip install --no-cache-dir --upgrade pip==26.0.1 && \
pip install --no-cache-dir uv==0.11.1 && \
uv pip install --no-cache ".[$EXTRAS]" && \
rm -rf /root/.cache /tmp/*
WORKDIR /opt/app-root

# Copy installed packages from builder
COPY --from=builder /opt/app-root/lib/python3.12/site-packages /opt/app-root/lib/python3.12/site-packages
COPY --from=builder /opt/app-root/lib64/python3.12/site-packages /opt/app-root/lib64/python3.12/site-packages
COPY --from=builder /opt/app-root/bin /opt/app-root/bin

# Copy source code last to maximize cache hits
COPY src src
COPY pyproject.toml README.md ./

# Python optimizations and security settings
ENV PYTHONUNBUFFERED=1 \
PYTHONDONTWRITEBYTECODE=1 \
PYTHONHASHSEED=random

# Set FIPS env var to match build-time configuration
ENV FIPS_POLICY_ENABLED=${ENABLE_FIPS_POLICY}

# Base image /opt/app-root is already owned by 1001:0 with group write permissions
# No need to chown - just ensure our copied files inherit the correct ownership
USER 1001
EXPOSE 8080 4443

# OCI image metadata
LABEL org.opencontainers.image.title="TrustyAI Service" \
org.opencontainers.image.description="Python implementation of TrustyAI Service for AI explainability and fairness" \
org.opencontainers.image.version="${VERSION}" \
Expand All @@ -101,6 +104,7 @@ LABEL org.opencontainers.image.title="TrustyAI Service" \
io.trustyai.fips.policy="${ENABLE_FIPS_POLICY}" \
io.trustyai.fips.mode="host-dependent" \
io.trustyai.fips.compatible="true" \
io.trustyai.fips.documentation="https://github.com/trustyai-explainability/trustyai-service/blob/main/docs/FIPS_compliance.md"
io.trustyai.fips.documentation="https://github.com/trustyai-explainability/trustyai-service/blob/main/docs/FIPS_compliance.md" \
org.opencontainers.image.base.name="registry.access.redhat.com/ubi9/python-312-minimal"

CMD ["python", "-m", "src.main"]
Loading