✨ Upgrade to UBI 10 - #102
Conversation
Signed-off-by: Dylan <dymurray@redhat.com>
📝 WalkthroughWalkthroughDocker base image versions are updated across two Dockerfile configurations. The Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile`:
- Line 14: Update the Dockerfile base image FROM line to use Red Hat UBI 9
instead of UBI 10 and pin a specific minor version for reproducible builds;
replace the current FROM registry.access.redhat.com/ubi10/ubi-minimal with a UBI
9 image such as registry.access.redhat.com/ubi9/ubi-minimal:9.4 so the build
targets a supported base for .NET SDK 9.0 and avoids implicit :latest.
- Line 1: The Dockerfile currently uses an implicit latest tag in the FROM
instruction ("FROM registry.access.redhat.com/ubi10/ubi as builder"), which
harms reproducibility; update this to a specific UBI 10 patch tag (e.g.,
registry.access.redhat.com/ubi10/ubi:10.x) and likewise pin any other UBI images
used (for example any "ubi10/ubi-minimal" runtime stages) and ensure package
installs (rust-toolset, dotnet-sdk-9.0, dotnet-runtime-9.0) are tested with that
pinned tag so builds are deterministic.
In `@Dockerfile.test`:
- Around line 1-3: Change the lowercase Dockerfile keyword "from" to uppercase
"FROM" for consistency; update both occurrences in the file (the stage alias
line "from fullstorydev/grpcurl:latest as grpcurl" and the base image line "from
registry.access.redhat.com/ubi10/ubi") to use "FROM" so the file matches the
project's Dockerfile style.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: cc40a578-b238-4a3f-adb5-6c96823f5f13
📒 Files selected for processing (2)
DockerfileDockerfile.test
| @@ -1,4 +1,4 @@ | |||
| FROM registry.access.redhat.com/ubi9/ubi as builder | |||
| FROM registry.access.redhat.com/ubi10/ubi as builder | |||
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify UBI 10 image tags and check for major version differences
# Check available UBI 10 tags
echo "=== Available UBI 10 tags ==="
curl -s https://catalog.redhat.com/api/containers/v1/repositories/registry/registry.access.redhat.com/repository/ubi10/ubi/images | jq -r '.data[].brew.build' | head -20
echo -e "\n=== Checking for UBI 9 to UBI 10 migration guides ==="
# Note: User should verify Red Hat documentation for UBI 10 release notes and migration guidanceRepository: konveyor/c-sharp-analyzer-provider
Length of output: 262
🌐 Web query:
Red Hat UBI 10 release notes migration guide from UBI 9
💡 Result:
Red Hat Universal Base Image (UBI) 10 is available as of 2026, based on RHEL 10. Official release notes or a dedicated migration guide specifically for migrating container images from UBI 9 (RHEL 9-based) to UBI 10 do not appear in current sources. Instead, migration involves rebuilding container images using the new UBI 10 base images, similar to RHEL upgrades. Key findings: - UBI 10 images (e.g., ubi10/ubi, ubi10/ubi-init, ubi10/ubi-minimal) are listed in the Red Hat Ecosystem Catalog, freely redistributable, maintained by Red Hat. - Repositories: ubi-10-for-$basearch-baseos-rpms (and likely appstream-rpms) for updates. - For RHEL hosts, use Leapp for in-place upgrade from RHEL 9 to RHEL 10, which applies to running UBI images on upgraded hosts (UBI 9 compatible with RHEL 10 hosts per prior patterns). - Example from .NET 10.0 containers (still on UBI 9): Switch to microdnf if using dnf; update tags to RHEL version-based. - To migrate: Pull new images like registry.access.redhat.com/ubi10/ubi:latest, rebuild Dockerfiles/Containerfiles changing base from ubi9 to ubi10, test for package/dependency changes due to RHEL 10 updates. No specific incompatibilities or step-by-step migration guide found; treat as standard base image version upgrade by rebuild. Refer to RHEL 9 to 10 upgrade planning for potential app impacts (e.g., SHA-1 deprecation).
Citations:
- 1: https://catalog.redhat.com/en/software/containers/ubi10/ubi/66f2b46b122803e4937d11ae
- 2: https://catalog.redhat.com/en/software/container-stacks/detail/6627a309f4a8a5b747184cd0
- 3: https://catalog.redhat.com/en/software/containers/ubi10/ubi-init/66f2b3428a972331bb915d51
- 4: https://docs.redhat.com/en/documentation/net/10.0/html-single/release_notes_for_.net_10.0_containers/index
- 5: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html-single/upgrading_from_rhel_9_to_rhel_10/index
- 6: https://access.redhat.com/articles/4238681
🏁 Script executed:
find . -name "Dockerfile" -type fRepository: konveyor/c-sharp-analyzer-provider
Length of output: 90
🌐 Web query:
rust-toolset availability UBI 10 RHEL 10
💡 Result:
Yes, the rust-toolset package is available in UBI 10 (corresponding to RHEL 10). Official Red Hat documentation confirms that Rust Toolset is provided as packages for RHEL 10 and can be installed in UBI 10 containers. To install in a UBI 10 container: FROM registry.access.redhat.com/ubi10/ubi:latest RUN dnf install -y rust-toolset On RHEL 10 host systems: dnf install rust-toolset Rust Toolset version 1.84.1 (or newer, e.g., up to 1.88.0 or 1.91.0 in related sources) includes rustc, cargo, rustfmt, and dependencies. It is part of the AppStream repository accessible in UBI images.
Citations:
- 1: https://docs.redhat.com/en/documentation/red_hat_developer_tools/1/html-single/using_rust_1.84.1_toolset/index
- 2: https://docs.redhat.com/en/documentation/red_hat_developer_tools/1/html/using_rust_1.88.0_toolset/rust-toolset
- 3: https://docs.redhat.com/en/documentation/red_hat_developer_tools/1/html/using_rust_1.84.1_toolset/rust-toolset
- 4: https://docs.redhat.com/en/documentation/red_hat_developer_tools/1/html/using_rust_1.84.1_toolset/container-images-with-rust-toolset
🌐 Web query:
dotnet-sdk-9.0 dotnet-runtime-9.0 UBI 10 compatibility
💡 Result:
dotnet-sdk-9.0 and dotnet-runtime-9.0 are compatible with Red Hat Universal Base Image (UBI) 10. UBI 10 is based on RHEL 10, and official Microsoft documentation confirms .NET 9 support on RHEL 10 via standard package managers like dnf (e.g., sudo dnf install dotnet-sdk-9.0). While Red Hat provides official .NET 9 container images for UBI 8 and UBI 9, the support extends to RHEL 10 / UBI 10 as listed in .NET's supported distributions. No official UBI 10-specific containers were found in the Red Hat catalog (which emphasizes UBI 9 for .NET 10), but installation on RHEL 10 / UBI 10 is fully supported per Microsoft .NET docs.
Citations:
- 1: https://github.com/dotnet/core/blob/main/release-notes/9.0/supported-os.md
- 2: https://learn.microsoft.com/en-us/dotnet/core/install/linux-rhel
- 3: https://catalog.redhat.com/en/software/containers/ubi8/dotnet-90/672bc9015e6e9c0c6f7d2ff7
- 4: https://catalog.redhat.com/en/software/containers/ubi8/dotnet-90-runtime/672bc8de5e6e9c0c6f7d2f65
🏁 Script executed:
cat -n ./DockerfileRepository: konveyor/c-sharp-analyzer-provider
Length of output: 1568
Consider pinning base image versions for reproducibility.
Using implicit :latest tags reduces build reproducibility. Consider pinning to specific UBI 10 versions (e.g., ubi10/ubi:10.x and ubi10/ubi-minimal:10.x). All packages (rust-toolset, dotnet-sdk-9.0, dotnet-runtime-9.0) are compatible with UBI 10.
🧰 Tools
🪛 Checkov (3.2.510)
[low] 1-1: Ensure the base image uses a non latest version tag
(CKV_DOCKER_7)
[low] 1-35: Ensure that HEALTHCHECK instructions have been added to container images
(CKV_DOCKER_2)
🪛 Hadolint (2.14.0)
[warning] 1-1: Always tag the version of an image explicitly
(DL3006)
🪛 Trivy (0.69.3)
[warning] 1-1: ':latest' tag used
Specify a tag in the 'FROM' statement for image 'registry.access.redhat.com/ubi10/ubi'
Rule: DS-0001
(IaC/Dockerfile)
[info] 1-1: No HEALTHCHECK defined
Add HEALTHCHECK instruction in your Dockerfile
Rule: DS-0026
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` at line 1, The Dockerfile currently uses an implicit latest tag
in the FROM instruction ("FROM registry.access.redhat.com/ubi10/ubi as
builder"), which harms reproducibility; update this to a specific UBI 10 patch
tag (e.g., registry.access.redhat.com/ubi10/ubi:10.x) and likewise pin any other
UBI images used (for example any "ubi10/ubi-minimal" runtime stages) and ensure
package installs (rust-toolset, dotnet-sdk-9.0, dotnet-runtime-9.0) are tested
with that pinned tag so builds are deterministic.
| RUN --mount=type=cache,id=cagohome,uid=1001,gid=0,mode=0777,target=/root/.cargo cargo build --release | ||
|
|
||
| FROM registry.access.redhat.com/ubi9/ubi-minimal | ||
| FROM registry.access.redhat.com/ubi10/ubi-minimal |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check if .NET SDK 9.0 is available on UBI 10
# Pull UBI 10 minimal and check for dotnet packages
docker pull registry.access.redhat.com/ubi10/ubi-minimal:latest 2>&1 | head -5
echo -e "\n=== Checking .NET package availability ==="
docker run --rm registry.access.redhat.com/ubi10/ubi-minimal:latest microdnf search dotnet-sdk 2>&1 || echo "Failed to search packages"Repository: konveyor/c-sharp-analyzer-provider
Length of output: 237
🌐 Web query:
.NET SDK 9.0 support Red Hat UBI 10 compatibility
💡 Result:
No, .NET SDK 9.0 does not support Red Hat UBI 10. Red Hat UBI 10 is not yet released or available as of 2026-03-27. Current official support is for UBI 9 and RHEL 10 with .NET 9 via RPM packages in AppStream repositories (e.g., dotnet-sdk-9.0 on RHEL 10). .NET 9 container images from Red Hat are based on UBI 8 or UBI 9 (e.g., ubi8/dotnet-90-runtime, ubi9/dotnet-100 for .NET 10). Microsoft confirms .NET 9 support on RHEL 10 host OS, but no UBI 10 container base exists in sources.
Citations:
- 1: https://docs.redhat.com/en/documentation/net/10.0/html-single/release_notes_for_.net_10.0_containers/index
- 2: https://learn.microsoft.com/en-us/dotnet/core/install/linux-rhel
- 3: https://docs.redhat.com/en/documentation/net/9.0/html-single/getting_started_with_.net_9.0_on_rhel_9/index
- 4: https://github.com/dotnet/core/blob/main/release-notes/9.0/supported-os.md
- 5: https://catalog.redhat.com/en/software/containers/ubi9/dotnet-100/68c12c6b1359271d5a1b0461
- 6: https://catalog.redhat.com/en/software/containers/ubi9/dotnet-100-runtime/68c12d7464c1f89e50bc34db
Use UBI 9 instead of UBI 10; Red Hat UBI 10 is not yet available. .NET SDK 9.0 is only supported on UBI 8 and UBI 9 base images. Additionally, replace the implicit :latest tag with a specific minor version (e.g., ubi9/ubi-minimal:9.4) for build reproducibility.
Recommended change:
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.4
🧰 Tools
🪛 Hadolint (2.14.0)
[warning] 14-14: Always tag the version of an image explicitly
(DL3006)
🪛 Trivy (0.69.3)
[warning] 14-14: ':latest' tag used
Specify a tag in the 'FROM' statement for image 'registry.access.redhat.com/ubi10/ubi-minimal'
Rule: DS-0001
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` at line 14, Update the Dockerfile base image FROM line to use Red
Hat UBI 9 instead of UBI 10 and pin a specific minor version for reproducible
builds; replace the current FROM registry.access.redhat.com/ubi10/ubi-minimal
with a UBI 9 image such as registry.access.redhat.com/ubi9/ubi-minimal:9.4 so
the build targets a supported base for .NET SDK 9.0 and avoids implicit :latest.
| from fullstorydev/grpcurl:latest as grpcurl | ||
|
|
||
| from registry.access.redhat.com/ubi9/ubi | ||
| from registry.access.redhat.com/ubi10/ubi |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
Consider using uppercase FROM for Dockerfile keyword consistency.
Docker keywords are case-insensitive, but the conventional style is to use uppercase FROM. This improves consistency with the main Dockerfile and follows common best practices.
📝 Proposed style fix
-from fullstorydev/grpcurl:latest as grpcurl
+FROM fullstorydev/grpcurl:latest as grpcurl
-from registry.access.redhat.com/ubi10/ubi
+FROM registry.access.redhat.com/ubi10/ubi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| from fullstorydev/grpcurl:latest as grpcurl | |
| from registry.access.redhat.com/ubi9/ubi | |
| from registry.access.redhat.com/ubi10/ubi | |
| FROM fullstorydev/grpcurl:latest as grpcurl | |
| FROM registry.access.redhat.com/ubi10/ubi |
🧰 Tools
🪛 Checkov (3.2.510)
[low] 1-1: Ensure the base image uses a non latest version tag
(CKV_DOCKER_7)
[low] 1-24: Ensure that HEALTHCHECK instructions have been added to container images
(CKV_DOCKER_2)
[low] 1-24: Ensure that a user for the container has been created
(CKV_DOCKER_3)
🪛 Hadolint (2.14.0)
[warning] 1-1: Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag
(DL3007)
[warning] 3-3: Always tag the version of an image explicitly
(DL3006)
🪛 Trivy (0.69.3)
[warning] 1-1: ':latest' tag used
Specify a tag in the 'FROM' statement for image 'fullstorydev/grpcurl'
Rule: DS-0001
(IaC/Dockerfile)
[warning] 3-3: ':latest' tag used
Specify a tag in the 'FROM' statement for image 'registry.access.redhat.com/ubi10/ubi'
Rule: DS-0001
(IaC/Dockerfile)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
[info] 1-1: No HEALTHCHECK defined
Add HEALTHCHECK instruction in your Dockerfile
Rule: DS-0026
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile.test` around lines 1 - 3, Change the lowercase Dockerfile keyword
"from" to uppercase "FROM" for consistency; update both occurrences in the file
(the stage alias line "from fullstorydev/grpcurl:latest as grpcurl" and the base
image line "from registry.access.redhat.com/ubi10/ubi") to use "FROM" so the
file matches the project's Dockerfile style.
|
This pull request has been automatically marked as stale because it has not had any activity for 60 days. |
1 participant
No description provided.