Skip to content

Commit efbaa6e

Browse files
jiridanekjiridanek
authored
Merge pull request #1696 from jiridanek/jd_remove_ubi9repo
RHAIENG-948: remove UBI 9 repository injection across all Dockerfiles
2 parents 37d5146 + e5ee8cb commit efbaa6e

File tree

20 files changed

+29
-156
lines changed

20 files changed

+29
-156
lines changed

‎codeserver/ubi9-python-3.12/Dockerfile.cpu‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,10 @@ FROM ${BASE_IMAGE} AS cpu-base
7272

7373
WORKDIR /opt/app-root/bin
7474

75+
# RHAIENG-2189: this is AIPCC migration phase 1.5
76+
ENV PIP_EXTRA_INDEX_URL=https://pypi.org/simple
77+
ENV UV_EXTRA_INDEX_URL=https://pypi.org/simple
78+
7579
# OS Packages needs to be installed as root
7680
USER 0
7781

@@ -300,8 +304,8 @@ RUN --mount=type=cache,target=/root/.cache/uv /bin/bash <<'EOF'
300304
set -Eeuxo pipefail
301305
echo "Installing softwares and packages"
302306
# we can ensure wheels are consumed from the cache only by restricting internet access for uv install with '--offline' flag
303-
UV_NO_CACHE=false UV_LINK_MODE=copy uv pip install --offline --cache-dir /root/.cache/uv --requirements=./pylock.toml
304-
# Note: debugpy wheel availabe on pypi (in uv cache) is none-any but bundles amd64.so files
307+
UV_NO_CACHE=false UV_LINK_MODE=copy uv pip install --cache-dir /root/.cache/uv --requirements=./pylock.toml
308+
# Note: debugpy wheel available on pypi (in uv cache) is none-any but bundles amd64.so files
305309
# Build debugpy from source instead
306310
UV_LINK_MODE=copy uv pip install --no-cache git+https://github.com/microsoft/debugpy.git@v$(grep -A1 '\"debugpy\"' ./pylock.toml | grep -Eo '\b[0-9\.]+\b')
307311
# change ownership to default user (all packages were installed as root and has root:root ownership

‎codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu‎

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@
33
#########################
44
ARG BASE_IMAGE
55

6-
# External image alias for UBI repository configuration
7-
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
8-
96
####################
107
# rpm-base #
118
####################
@@ -18,11 +15,6 @@ WORKDIR /root
1815

1916
ENV HOME=/root
2017

21-
# Inject the official UBI 9 repository configuration into the AIPCC base image.
22-
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
23-
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
24-
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
25-
2618
ARG CODESERVER_SOURCE_CODE=codeserver/ubi9-python-3.12
2719

2820
ARG NODE_VERSION=22.18.0
@@ -31,6 +23,21 @@ ARG CODESERVER_VERSION=v4.104.0
3123

3224
COPY ${CODESERVER_SOURCE_CODE}/get_code_server_rpm.sh .
3325

26+
### BEGIN Subscribe with subscription manager
27+
RUN /bin/bash <<'EOF'
28+
# The devops activationkey is not powerful enough, use rhoai-ide-konflux key
29+
# https://redhat-internal.slack.com/archives/C07SBP17R7Z/p1764077596143619?thread_ts=1761667034.429529&cid=C07SBP17R7Z
30+
subscription-manager register --org 18631088 --activationkey thisisunsafe
31+
32+
# If we have a Red Hat subscription prepared, refresh it
33+
set -Eeuxo pipefail
34+
if command -v subscription-manager &> /dev/null; then
35+
subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
36+
fi
37+
EOF
38+
39+
### END Subscribe with subscription manager
40+
3441
# create dummy file to ensure this stage is awaited before installing rpm
3542
RUN ./get_code_server_rpm.sh && touch /tmp/control
3643

@@ -75,14 +82,13 @@ FROM ${BASE_IMAGE} AS cpu-base
7582

7683
WORKDIR /opt/app-root/bin
7784

85+
# RHAIENG-2189: this is AIPCC migration phase 1.5
86+
ENV PIP_EXTRA_INDEX_URL=https://pypi.org/simple
87+
ENV UV_EXTRA_INDEX_URL=https://pypi.org/simple
88+
7889
# OS Packages needs to be installed as root
7990
USER 0
8091

81-
# Inject the official UBI 9 repository configuration into the AIPCC base image.
82-
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
83-
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
84-
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
85-
8692
### BEGIN upgrade first to avoid fixable vulnerabilities
8793
RUN /bin/bash <<'EOF'
8894
# The devops activationkey is not powerful enough, use rhoai-ide-konflux key
@@ -311,8 +317,8 @@ RUN --mount=type=cache,target=/root/.cache/uv /bin/bash <<'EOF'
311317
set -Eeuxo pipefail
312318
echo "Installing softwares and packages"
313319
# we can ensure wheels are consumed from the cache only by restricting internet access for uv install with '--offline' flag
314-
UV_NO_CACHE=false UV_LINK_MODE=copy uv pip install --offline --cache-dir /root/.cache/uv --requirements=./pylock.toml
315-
# Note: debugpy wheel availabe on pypi (in uv cache) is none-any but bundles amd64.so files
320+
UV_NO_CACHE=false UV_LINK_MODE=copy uv pip install --cache-dir /root/.cache/uv --requirements=./pylock.toml
321+
# Note: debugpy wheel available on pypi (in uv cache) is none-any but bundles amd64.so files
316322
# Build debugpy from source instead
317323
UV_LINK_MODE=copy uv pip install --no-cache git+https://github.com/microsoft/debugpy.git@v$(grep -A1 '\"debugpy\"' ./pylock.toml | grep -Eo '\b[0-9\.]+\b')
318324
# change ownership to default user (all packages were installed as root and has root:root ownership

‎jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -378,7 +378,7 @@ EOF
378378

379379
RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked,id=notebooks-dnf /bin/bash <<'EOF'
380380
set -Eeuxo pipefail
381-
if [ "${TARGETARCH}" = "ppc64le" ]; then
381+
if [ "${TARGETARCH}" = "ppc64le" ] || [ "$TARGETARCH" = "s390x" ]; then
382382
packages=(
383383
# required to compile pillow
384384
zlib-devel libjpeg-turbo-devel

‎jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@
33
#########################
44
ARG BASE_IMAGE
55

6-
# External image alias for UBI repository configuration
7-
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
8-
96
######################################################
107
# mongocli-builder (build stage only, not published) #
118
######################################################
@@ -47,11 +44,6 @@ WORKDIR /opt/app-root/bin
4744
USER root
4845
ARG TARGETARCH
4946

50-
# Inject the official UBI 9 repository configuration into the AIPCC base image.
51-
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
52-
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
53-
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
54-
5547
### BEGIN upgrade first to avoid fixable vulnerabilities
5648
RUN /bin/bash <<'EOF'
5749
# The devops activationkey is not powerful enough, use rhoai-ide-konflux key
@@ -390,7 +382,7 @@ EOF
390382

391383
RUN /bin/bash <<'EOF'
392384
set -Eeuxo pipefail
393-
if [ "${TARGETARCH}" = "ppc64le" ]; then
385+
if [ "${TARGETARCH}" = "ppc64le" ] || [ "$TARGETARCH" = "s390x" ]; then
394386
packages=(
395387
# required to compile pillow
396388
zlib-devel libjpeg-turbo-devel

‎jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@
33
#########################
44
ARG BASE_IMAGE
55

6-
# External image alias for UBI repository configuration
7-
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
8-
96
############################
107
# Stage 1: PDF Tool Build #
118
############################
@@ -36,11 +33,6 @@ WORKDIR /opt/app-root/bin
3633
# OS Packages needs to be installed as root
3734
USER 0
3835

39-
# Inject the official UBI 9 repository configuration into the AIPCC base image.
40-
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
41-
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
42-
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
43-
4436
### BEGIN upgrade first to avoid fixable vulnerabilities
4537
RUN /bin/bash <<'EOF'
4638
# The devops activationkey is not powerful enough, use rhoai-ide-konflux key

‎jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ ARG TARGETARCH
55
#########################
66
ARG BASE_IMAGE
77

8-
# External image alias for UBI repository configuration
9-
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
10-
118
####################
129
# cuda-base #
1310
####################
@@ -18,11 +15,6 @@ WORKDIR /opt/app-root/bin
1815
# OS Packages needs to be installed as root
1916
USER 0
2017

21-
# Inject the official UBI 9 repository configuration into the AIPCC base image.
22-
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
23-
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
24-
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
25-
2618
### BEGIN upgrade first to avoid fixable vulnerabilities
2719
RUN /bin/bash <<'EOF'
2820
# The devops activationkey is not powerful enough, use rhoai-ide-konflux key

‎jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@
33
#########################
44
ARG BASE_IMAGE
55

6-
# External image alias for UBI repository configuration
7-
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
8-
96
####################
107
# rocm-base #
118
####################
@@ -16,11 +13,6 @@ WORKDIR /opt/app-root/bin
1613
# OS Packages needs to be installed as root
1714
USER 0
1815

19-
# Inject the official UBI 9 repository configuration into the AIPCC base image.
20-
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
21-
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
22-
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
23-
2416
### BEGIN upgrade first to avoid fixable vulnerabilities
2517
RUN /bin/bash <<'EOF'
2618
# The devops activationkey is not powerful enough, use rhoai-ide-konflux key

‎jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ ARG TARGETARCH
55
#########################
66
ARG BASE_IMAGE
77

8-
# External image alias for UBI repository configuration
9-
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
10-
118
######################################################
129
# mongocli-builder (build stage only, not published) #
1310
######################################################
@@ -34,11 +31,6 @@ WORKDIR /opt/app-root/bin
3431
# OS Packages needs to be installed as root
3532
USER 0
3633

37-
# Inject the official UBI 9 repository configuration into the AIPCC base image.
38-
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
39-
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
40-
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
41-
4234
### BEGIN upgrade first to avoid fixable vulnerabilities
4335
RUN /bin/bash <<'EOF'
4436
# The devops activationkey is not powerful enough, use rhoai-ide-konflux key

‎jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ ARG TARGETARCH
55
#########################
66
ARG BASE_IMAGE
77

8-
# External image alias for UBI repository configuration
9-
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
10-
118
######################################################
129
# mongocli-builder (build stage only, not published) #
1310
######################################################
@@ -34,11 +31,6 @@ WORKDIR /opt/app-root/bin
3431
# OS Packages needs to be installed as root
3532
USER 0
3633

37-
# Inject the official UBI 9 repository configuration into the AIPCC base image.
38-
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
39-
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
40-
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
41-
4234
### BEGIN upgrade first to avoid fixable vulnerabilities
4335
RUN /bin/bash <<'EOF'
4436
# The devops activationkey is not powerful enough, use rhoai-ide-konflux key

‎jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@
33
#########################
44
ARG BASE_IMAGE
55

6-
# External image alias for UBI repository configuration
7-
FROM registry.access.redhat.com/ubi9/ubi AS ubi-repos
8-
96
######################################################
107
# mongocli-builder (build stage only, not published) #
118
######################################################
@@ -32,11 +29,6 @@ WORKDIR /opt/app-root/bin
3229
# OS Packages needs to be installed as root
3330
USER 0
3431

35-
# Inject the official UBI 9 repository configuration into the AIPCC base image.
36-
# The Quay-based AIPCC image is "repo-less" by default (https://gitlab.com/redhat/rhel-ai/core/base-images/app#repositories), so dnf cannot upgrade or install packages.
37-
# By copying ubi.repo from the public UBI 9 image, we enable package management for upgrades and installations.
38-
COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
39-
4032
### BEGIN upgrade first to avoid fixable vulnerabilities
4133
RUN /bin/bash <<'EOF'
4234
# The devops activationkey is not powerful enough, use rhoai-ide-konflux key

0 commit comments

Comments
 (0)