Skip to content

NO-JIRA: Dockerfile.art: package oc-mirror binaries as tar.gz archives #1475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aguidirh wants to merge 1 commit into
base: main
Choose a base branch
from
+4 −0
Open

NO-JIRA: Dockerfile.art: package oc-mirror binaries as tar.gz archives #1475

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions images/cli/Dockerfile.art
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ COPY --from=builder_rhel9 /go/src/github.com/openshift/oc-mirror/bin/oc-mirror /
COPY --from=builder_rhel9 /go/src/github.com/openshift/oc-mirror/bin/oc-mirror /usr/bin/oc-mirror.rhel9
COPY --from=test-extension-builder /go/src/github.com/openshift/oc-mirror/tests/e2e/bin/oc-mirror-tests-ext.gz /usr/bin/oc-mirror-tests-ext.gz

RUN mkdir -p /releases/
RUN tar czf /releases/oc-mirror-rhel9-linux-amd64.tar.gz -C /usr/bin oc-mirror
RUN tar czf /releases/oc-mirror-rhel8-linux-amd64.tar.gz -C /usr/bin oc-mirror.rhel8
Comment on lines +46 to +48

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Run the final image as a non-root user.

The final stage has no USER directive, so the image—including the new release artifacts—runs as root by default. Add an appropriate non-root USER after the archive-generation steps and before ENTRYPOINT.

As per path instructions: “USER non-root; never run as root.”

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@images/cli/Dockerfile.art` around lines 46 - 48, Add an appropriate non-root
USER directive in the final image stage after the archive-generation RUN
commands and before ENTRYPOINT. Ensure the resulting image, including its
release artifacts, runs as a non-root user and never defaults to root.

Source: Path instructions

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files images/cli/Dockerfile.art
printf '\n---\n'
cat -n images/cli/Dockerfile.art | sed -n '1,140p'

Repository: openshift/oc-mirror

Length of output: 3644

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "Dockerfile\.art|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64|linux-amd64" .github . -g '!**/vendor/**' -g '!**/bin/**'

Repository: openshift/oc-mirror

Length of output: 964

🏁 Script executed:

#!/bin/bash
set -euo pipefail

ast-grep outline Makefile --view expanded
printf '\n---\n'
sed -n '1,180p' Makefile | cat -n
printf '\n=== workflows ===\n'
rg -n "images/cli/Dockerfile\.art|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64|cross-build-linux-amd64|GOARCH=amd64|platform" .github

Repository: openshift/oc-mirror

Length of output: 4912

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files | rg '(^|/)(.*images.*|.*image.*|.*\.yaml$|.*\.yml$)'
printf '\n=== Dockerfile.art refs ===\n'
rg -n "Dockerfile\.art|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64|cross-build-linux-amd64|platforms?|arch|amd64" . \
  -g '!**/vendor/**' -g '!**/bin/**' -g '!**/dist/**'

Repository: openshift/oc-mirror

Length of output: 50376

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files images/cli
printf '\n---\n'
rg -n "Dockerfile\.art|cross-build-linux-amd64|linux-amd64|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64" images/cli .github Makefile --max-count 20

Repository: openshift/oc-mirror

Length of output: 815

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "images/cli/Dockerfile\.art|Dockerfile\.art|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64" .github images Makefile --glob '*.yml' --glob '*.yaml' --glob 'Dockerfile*' --max-count 50

Repository: openshift/oc-mirror

Length of output: 379

Align the release archive names with the build arch.
In images/cli/Dockerfile.art:46-48, make build doesn’t pin GOARCH, so these tarballs can be mislabeled if the image is built on anything other than amd64. Either use the amd64 cross-build target here or derive the suffix from the build platform.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@images/cli/Dockerfile.art` around lines 46 - 48, Update the release packaging
commands in the Dockerfile so the archive architecture suffix matches the
binaries produced by the build: either invoke the amd64-pinned build target
before creating the archives or derive the names from the actual build platform.
Ensure both oc-mirror release tarballs cannot be labeled amd64 when the build
output uses another architecture.


LABEL io.k8s.display-name="oc-mirror" \
io.k8s.description="OpenShift is a platform for developing, building, and deploying containerized applications." \
io.openshift.tags="openshift,cli,mirror" \
Expand Down