-
Notifications
You must be signed in to change notification settings - Fork 510
MCO-2244: Update MCO dependencies to Kubernetes 1.36 #6321
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,19 @@ | ||
| # Use RHEL 9 as the primary builder base for the Machine Config Operator | ||
| FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS rhel9-builder | ||
| FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 AS rhel9-builder | ||
| ARG TAGS="" | ||
| WORKDIR /go/src/github.com/openshift/machine-config-operator | ||
| COPY . . | ||
| RUN make install DESTDIR=./instroot-rhel9 | ||
|
|
||
| # Add a RHEL 8 builder to compile the RHEL 8 compatible binaries | ||
| FROM registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.25-openshift-4.22 AS rhel8-builder | ||
| FROM registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.26-openshift-5.0 AS rhel8-builder | ||
| ARG TAGS="" | ||
| WORKDIR /go/src/github.com/openshift/machine-config-operator | ||
| # Copy the RHEL 8 machine-config-daemon binary and rename | ||
| COPY . . | ||
| RUN make install DESTDIR=./instroot-rhel8 | ||
|
|
||
| FROM registry.ci.openshift.org/ocp/4.22:base-rhel9 | ||
| FROM registry.ci.openshift.org/ocp/5.0:base-rhel9 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win Apply required container security practices to the final image. The final stage does not comply with the following container security path instructions:
🤖 Prompt for AI AgentsSource: Path instructions |
||
| ARG TAGS="" | ||
| COPY install /manifests | ||
| RUN if [ "${TAGS}" = "fcos" ]; then \ | ||
|
|
||
Large diffs are not rendered by default.
Large diffs are not rendered by default.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Avoid copying the entire build context.
Both builder stages copy the entire build context (
COPY . .), which violates the container security path instructions. This practice can unintentionally include sensitive files or unnecessary dependencies, and it degrades layer caching.Dockerfile#L5-L5: update toCOPYonly the specific source files needed formake install DESTDIR=./instroot-rhel9.Dockerfile#L13-L13: update toCOPYonly the specific source files needed formake install DESTDIR=./instroot-rhel8.📍 Affects 1 file
Dockerfile#L5-L5(this comment)Dockerfile#L13-L13🤖 Prompt for AI Agents
Source: Path instructions