Merge pull request #170 from mendix/DES-4896_upgrade-rootfs

Upgrade to Python 3.11

Author: zlogic

Dockerfile

@@ -2,7 +2,7 @@
 # Mendix Deployment Archive (aka mda file)
 #
 # Author: Mendix Digital Ecosystems, [email protected]
-# Version: 2.1.0
+# Version: 5.1.0
 ARG ROOTFS_IMAGE=mendix-rootfs:app
 ARG BUILDER_ROOTFS_IMAGE=mendix-rootfs:builder
 
@@ -12,10 +12,6 @@ FROM ${BUILDER_ROOTFS_IMAGE} AS builder
 # Build-time variables
 ARG BUILD_PATH=project
 ARG DD_API_KEY
-# CF buildpack version
-ARG CF_BUILDPACK=v4.30.17
-# CF buildpack download URL
-ARG CF_BUILDPACK_URL=https://github.com/mendix/cf-mendix-buildpack/releases/download/${CF_BUILDPACK}/cf-mendix-buildpack.zip
 
 # Exclude the logfilter binary by default
 ARG EXCLUDE_LOGFILTER=true
@@ -24,38 +20,9 @@ ARG EXCLUDE_LOGFILTER=true
 ARG BLOBSTORE
 ARG BUILDPACK_XTRACE
 
-# Set the user ID
-ARG USER_UID=1001
-
-# Each comment corresponds to the script line:
-# 1. Create all directories needed by scripts
-# 2. Download CF buildpack
-# 3. Extract CF buildpack
-# 4. Delete CF buildpack zip archive
-# 5. Update ownership of /opt/mendix so that the app can run as a non-root user
-# 6. Update permissions of /opt/mendix so that the app can run as a non-root user
-RUN mkdir -p /opt/mendix/buildpack /opt/mendix/build &&\
-    ln -s /root /home/vcap &&\
-    mkdir -p /home/vcap/.local/bin && ln -s /etc/alternatives/pip3 /home/vcap/.local/bin/pip && pip3 install --upgrade pip &&\
-    echo "Downloading CF Buildpack from ${CF_BUILDPACK_URL}" &&\
-    curl -fsSL ${CF_BUILDPACK_URL} -o /tmp/cf-mendix-buildpack.zip && \
-    python3 -m zipfile -e /tmp/cf-mendix-buildpack.zip /opt/mendix/buildpack/ &&\
-    rm /tmp/cf-mendix-buildpack.zip &&\
-    chown -R ${USER_UID}:0 /opt/mendix &&\
-    chmod -R g=u /opt/mendix
-
-# Copy python scripts which execute the buildpack (exporting the VCAP variables)
-COPY scripts/compilation.py scripts/git /opt/mendix/buildpack/
-
 # Copy project model/sources
 COPY $BUILD_PATH /opt/mendix/build
 
-# Install the buildpack Python dependencies
-RUN chmod +rx /opt/mendix/buildpack/bin/bootstrap-python && /opt/mendix/buildpack/bin/bootstrap-python /opt/mendix/buildpack /tmp/buildcache
-
-# Add the buildpack modules
-ENV PYTHONPATH "$PYTHONPATH:/opt/mendix/buildpack/lib/:/opt/mendix/buildpack/:/opt/mendix/buildpack/lib/python3.6/site-packages/"
-
 # Use nginx supplied by the base OS
 ENV NGINX_CUSTOM_BIN_PATH=/usr/sbin/nginx
 
@@ -91,7 +58,7 @@ RUN chmod g=u /etc/passwd &&\
     chown ${USER_UID}:0 /etc/passwd
 
 # Add the buildpack modules
-ENV PYTHONPATH "/opt/mendix/buildpack/lib/:/opt/mendix/buildpack/:/opt/mendix/buildpack/lib/python3.6/site-packages/"
+ENV PYTHONPATH "/opt/mendix/buildpack/lib/:/opt/mendix/buildpack/:/opt/mendix/buildpack/lib/python3.11/site-packages/"
 
 # Copy start scripts
 COPY scripts/startup.py scripts/vcap_application.json /opt/mendix/build/
@@ -113,12 +80,6 @@ RUN chmod +rx /opt/mendix/build/startup.py &&\
 
 USER ${USER_UID}
 
-# Copy jre from build container
-COPY --from=builder /var/mendix/build/.local/usr /opt/mendix/build/.local/usr
-
-# Copy Mendix Runtime from build container
-COPY --from=builder /var/mendix/build/runtimes /opt/mendix/build/runtimes
-
 # Copy build artifacts from build container
 COPY --from=builder /opt/mendix /opt/mendix
 

README.md

@@ -44,7 +44,7 @@ This project is a goto reference for the following scenarios :
     To use Docker versions below 20.10, download an earlier Mendix Docker Buildpack release, such as [v2.3.2](https://github.com/mendix/docker-mendix-buildpack/releases/tag/v2.3.2)
 * For preparing, a local installation of `curl`
 * For local testing, make sure you can run the [docker-compose command](https://docs.docker.com/compose/install/)
-* A Mendix app based on Mendix 7 or a later version
+* A Mendix app based on Mendix 8 or a later version
 
 ## Usage
 
@@ -80,6 +80,12 @@ docker push <builder-root-fs-image-tag>
 docker push <app-root-fs-image-tag>
 ```
 
+When building the the `rootfs-builder.dockerfile` file, you can provide the following additional arguments:
+
+- **CF_BUILDPACK** is a version of CloudFoundry buildpack. Defaults to `v5.0.0`. For stable pipelines, it's recommended to use a fixed **v5.0.0** version. Other Cloud Foundry buildpacks might not work with this version of Docker Buildpack.
+- **CF_BUILDPACK_URL** specifies the URL where the CF buildpack should be downloaded from (for example, a local mirror). Defaults to `https://github.com/mendix/cf-mendix-buildpack/releases/download/${CF_BUILDPACK}/cf-mendix-buildpack.zip`. Specifying **CF_BUILDPACK_URL** will override the version from **CF_BUILDPACK**.
+- **BUILDPACK_XTRACE** can be used to enable CF Buildpack [debug logging](https://github.com/mendix/cf-mendix-buildpack#logging-and-debugging). Set this variable to `true` to enable debug logging.
+
 ### Compile an app
 
 Before running the container, it is necessary to build the image with your application. This buildpack contains Dockerfile with a script that will compile your application using [cf-mendix-buildpack](https://github.com/mendix/cf-mendix-buildpack/).
@@ -95,9 +101,7 @@ For build you can provide next arguments:
 - **BUILD_PATH** indicates where the application model is located. It is a root directory of an unzipped .MDA or .MPK file. In the latter case, this is the directory where your .MPR file is located. Must be within [build context](https://docs.docker.com/engine/reference/commandline/build/#extended-description). Defaults to `./project`.
 - **ROOTFS_IMAGE** is a type of rootfs image. Defaults to `mendix-rootfs:app` (a locally prebuilt image).
 - **BUILDER_ROOTFS_IMAGE** is a type of rootfs image used for downloading the Mendix app dependencies and compiling the Mendix app from source. Defaults to `mendix-rootfs:builder` (a locally prebuilt image).
-- **CF_BUILDPACK** is a version of CloudFoundry buildpack. Defaults to `v4.30.17`. For stable pipelines, it's recommended to use a fixed version from **v4.30.17** and later. CloudFoundry buildpack versions below **v4.30.17** are not supported.
 - **EXCLUDE_LOGFILTER** will exclude the `mendix-logfilter` binary from the resulting Docker image if set to `true`. Defaults to `true`. Excluding `mendix-logfilter` will reduce the image size and remove a component that's not commonly used; the `LOG_RATELIMIT` environment variable option will be disabled.
-- **CF_BUILDPACK_URL** specifies the URL where the CF buildpack should be downloaded from (for example, a local mirror). Defaults to `https://github.com/mendix/cf-mendix-buildpack/releases/download/${CF_BUILDPACK}/cf-mendix-buildpack.zip`. Specifying **CF_BUILDPACK_URL** will override the version from **CF_BUILDPACK**.
 - **BLOBSTORE** can be used to specify an alternative buildpack resource server (instead of the default Mendix CDN). For more information, see the [CF Buildpack offline settings](https://github.com/mendix/cf-mendix-buildpack#offline-buildpack-settings).
 - **BUILDPACK_XTRACE** can be used to enable CF Buildpack [debug logging](https://github.com/mendix/cf-mendix-buildpack#logging-and-debugging). Set this variable to `true` to enable debug logging.
 

rootfs-app.dockerfile

@@ -12,7 +12,7 @@ ENV LC_ALL C.UTF-8
 # install dependencies & remove package lists
 RUN microdnf update -y && \
     microdnf module enable nginx:1.20 -y && \
-    microdnf install -y glibc-langpack-en python3 openssl nginx nginx-mod-stream fontconfig && \
+    microdnf install -y glibc-langpack-en python311 openssl nginx nginx-mod-stream java-11-openjdk-headless fontconfig && \
     microdnf clean all && rm -rf /var/cache/yum
 
 # Set nginx permissions

rootfs-builder.dockerfile

@@ -9,11 +9,31 @@ LABEL maintainer="[email protected]"
 ENV LANG C.UTF-8
 ENV LC_ALL C.UTF-8
 
+# CF buildpack version
+ARG CF_BUILDPACK=v5.0.0
+# CF buildpack download URL
+ARG CF_BUILDPACK_URL=https://github.com/mendix/cf-mendix-buildpack/releases/download/${CF_BUILDPACK}/cf-mendix-buildpack.zip
+
+# Set the user ID
+ARG USER_UID=1001
+ENV USER_UID=${USER_UID}
+
+# Allow specification of debugging options
+ARG BUILDPACK_XTRACE
+
+# Add mono repo
+COPY --chown=0:0 scripts/mono/xamarin.gpg /etc/pki/rpm-gpg/RPM-GPG-KEY-mono-centos8-stable
+COPY --chown=0:0 scripts/mono/mono-centos8-stable.repo /etc/yum.repos.d/mono-centos8-stable.repo
+
 # install dependencies & remove package lists
 RUN rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm &&\
     microdnf update -y && \
     microdnf module enable nginx:1.20 -y && \
-    microdnf install -y wget curl glibc-langpack-en python3 python3-setuptools openssl libgdiplus tar gzip unzip libpq nginx nginx-mod-stream binutils fontconfig libicu findutils && \
+    microdnf install -y wget curl glibc-langpack-en python311 openssl tar gzip unzip libpq nginx nginx-mod-stream binutils fontconfig findutils && \
+    microdnf clean all && rm -rf /var/cache/yum
+
+# Install RHEL alternatives to CF Buildpack dependencies
+RUN microdnf install -y java-11-openjdk-headless java-11-openjdk-devel mono-core-5.20.1.34 libgdiplus0 libicu && \
     microdnf clean all && rm -rf /var/cache/yum
 
 # Set nginx permissions
@@ -22,8 +42,41 @@ RUN touch /run/nginx.pid && \
     chmod -R g=u /var/log/nginx /var/lib/nginx /run/nginx.pid
 
 # Pretend to be Ubuntu to bypass CF Buildpack's check
-RUN rm /etc/*-release && echo 'Ubuntu release 18.04 (Bionic)' > /etc/debian-release
+RUN rm /etc/*-release && printf 'NAME="Ubuntu"\nID=ubuntu\nVersion="22.04 LTS (Jammy Jellyfish)"\nVERSION_CODENAME=jammy\n' > /etc/os-release
 
 # Set python alias to python3 (required for Datadog)
 RUN alternatives --set python /usr/bin/python3
 
+# Download and prepare CF Buildpack
+
+# Switch CF Buildpack to use Python 3.10+ compatibility
+ENV CF_STACK cflinuxfs4
+
+# Each comment corresponds to the script line:
+# 1. Create all directories needed by scripts
+# 2. Download CF buildpack
+# 3. Extract CF buildpack
+# 4. Delete CF buildpack zip archive
+# 5. Update ownership of /opt/mendix so that the app can run as a non-root user
+# 6. Update permissions of /opt/mendix so that the app can run as a non-root user
+RUN mkdir -p /opt/mendix/buildpack /opt/mendix/build &&\
+    ln -s /root /home/vcap &&\
+    echo "Downloading CF Buildpack from ${CF_BUILDPACK_URL}" &&\
+    curl -fsSL ${CF_BUILDPACK_URL} -o /tmp/cf-mendix-buildpack.zip && \
+    python3 -m zipfile -e /tmp/cf-mendix-buildpack.zip /opt/mendix/buildpack/ &&\
+    rm /tmp/cf-mendix-buildpack.zip &&\
+    chown -R ${USER_UID}:0 /opt/mendix &&\
+    chmod -R g=u /opt/mendix
+
+# Copy python scripts which execute the buildpack (exporting the VCAP variables)
+COPY scripts/compilation.py scripts/git /opt/mendix/buildpack/
+
+# Install the buildpack Python dependencies
+RUN PYTHON_BUILD_RPMS="python3.11-pip python3.11-devel libffi-devel gcc" && \
+    microdnf install -y $PYTHON_BUILD_RPMS && \
+    rm /opt/mendix/buildpack/vendor/wheels/* && \
+    chmod +rx /opt/mendix/buildpack/bin/bootstrap-python && /opt/mendix/buildpack/bin/bootstrap-python /opt/mendix/buildpack /tmp/buildcache && \
+    microdnf remove -y $PYTHON_BUILD_RPMS && microdnf clean all && rm -rf /var/cache/yum
+
+# Add the buildpack modules
+ENV PYTHONPATH "$PYTHONPATH:/opt/mendix/buildpack/lib/:/opt/mendix/buildpack/:/opt/mendix/buildpack/lib/python3.11/site-packages/"

scripts/compilation.py

@@ -5,9 +5,11 @@
 import runpy
 import sys
 import shutil
+import tarfile
 
 from buildpack import util
 from buildpack.core import java, runtime
+from buildpack.util import get_dependency
 
 logging.basicConfig(
     level=logging.INFO,
@@ -29,6 +31,50 @@ def export_vcap_services():
     os.environ['VCAP_SERVICES'] = vcap_services_str
     os.environ["PATH"] += os.pathsep + "/opt/mendix/buildpack"
 
+def replace_cf_dependencies():
+    logging.debug("Ensuring CF Buildpack dependencies are available")
+
+    # Only mono 5 is supported by Docker Buildpack
+    mono_dependency = get_dependency("mono.5-jammy", "/opt/mendix/buildpack")
+    logging.debug("Creating symlink for mono {0}".format(mono_dependency['artifact']))
+
+    util.mkdir_p("/tmp/buildcache/bust")
+    mono_cache_artifact = f"/tmp/buildcache/bust/mono-{mono_dependency['version']}-mx-ubuntu-jammy.tar.gz"
+    with tarfile.open(mono_cache_artifact, "w:gz") as tar:
+        # Symlinks to use mono from host OS
+        symlinks = {'mono/bin':'/usr/bin', 'mono/lib': '/usr/lib64', 'mono/etc': '/etc'}
+        for source, destination in symlinks.items():
+            symlink = tarfile.TarInfo(source)
+            symlink.type = tarfile.SYMTYPE
+            symlink.linkname = destination
+            tar.addfile(symlink)
+
+    # Only JDK 11 is supported by Docker Buildpack
+    jdk_dependency = get_dependency("java.11-jdk", "/opt/mendix/buildpack")
+    logging.debug("Creating symlink for jdk {0}".format(jdk_dependency['artifact']))
+    jdk_cache_artifact = f"/tmp/buildcache/bust/{jdk_dependency['artifact']}"
+    jdk_destination = '/etc/alternatives/java_sdk_11'
+    with tarfile.open(jdk_cache_artifact, "w:gz") as tar:
+        # Symlinks to use jdk from host OS
+        for jdk_dir in os.listdir(jdk_destination):
+            symlink = tarfile.TarInfo(f"jdk/{jdk_dir}")
+            symlink.type = tarfile.SYMTYPE
+            symlink.linkname = f"{jdk_destination}/{jdk_dir}"
+            tar.addfile(symlink)
+
+    # Only JRE 11 is supported by Docker Buildpack
+    jre_dependency = get_dependency("java.11-jre", "/opt/mendix/buildpack")
+    logging.debug("Creating symlink for jre {0}".format(jre_dependency['artifact']))
+    jre_cache_artifact = f"/tmp/buildcache/bust/{jre_dependency['artifact']}"
+    jre_destination = '/etc/alternatives/jre_11'
+    with tarfile.open(jre_cache_artifact, "w:gz") as tar:
+        # Symlinks to use jre from host OS
+        for jre_dir in os.listdir(jre_destination):
+            symlink = tarfile.TarInfo(f"jre/{jre_dir}")
+            symlink.type = tarfile.SYMTYPE
+            symlink.linkname = f"{jre_destination}/{jre_dir}"
+            tar.addfile(symlink)
+
 def call_buildpack_compilation():
     logging.debug("Executing call_buildpack_compilation...")
     return runpy.run_module("buildpack.stage", run_name="__main__")
@@ -41,25 +87,10 @@ def fix_logfilter():
     else:
         os.chmod("/opt/mendix/build/.local/mendix-logfilter/mendix-logfilter", 0o0755)
 
-def make_dependencies_reusable(compilation_globals):
-    logging.info("Making dependencies reusable...")
-    dot_local_location = compilation_globals["DOT_LOCAL_LOCATION"]
-    build_path = compilation_globals["BUILD_DIR"]
-    shutil.move("/opt/mendix/build/runtimes", "/var/mendix/build/")
-    shutil.move("/opt/mendix/build/.local/usr", "/var/mendix/build/.local/")
-    # separate cacerts from reusable jre components
-    jre = java._get_java_dependency(java.get_java_major_version(runtime.get_runtime_version(build_path)), 'jre')
-    jvm_location_reusable = os.path.join("/var/mendix/build/.local/", java._compose_jvm_target_dir(jre))
-    jvm_location_customized = os.path.join(dot_local_location, java._compose_jvm_target_dir(jre))
-    cacerts_file_source = os.path.join(jvm_location_reusable, "lib", "security", "cacerts")
-    cacerts_file_target = os.path.join(jvm_location_customized, "lib", "security", "cacerts")
-    util.mkdir_p(os.path.dirname(cacerts_file_target))
-    os.rename(cacerts_file_source, cacerts_file_target)
-
 if __name__ == '__main__':
     logging.info("Mendix project compilation phase...")
 
     export_vcap_services()
+    replace_cf_dependencies()
     compilation_globals = call_buildpack_compilation()
     fix_logfilter()
-    make_dependencies_reusable(compilation_globals)

scripts/mono/mono-centos8-stable.repo

@@ -0,0 +1,6 @@
+[mono-centos8-stable]
+name=mono-centos8-stable
+baseurl=https://download.mono-project.com/repo/centos8-stable/
+enabled=1
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-mono-centos8-stable

scripts/mono/xamarin.gpg

@@ -0,0 +1,37 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFPfqCcBCADctOzyTxfWvf40Nlb+AMkcJyb505WSbzhWU8yPmBNAJOnbwueM
+sTkNMHEOu8fGRNxRWj5o/Db1N7EoSQtK3OgFnBef8xquUyrzA1nJ2aPfUWX+bhTG
+1TwyrtLaOssFRz6z/h/ChUIFvt2VZCw+Yx4BiKi+tvgwrHTYB/Yf2J9+R/1O6949
+n6veFFRBfgPOL0djhvRqXzhvFjJkh4xhTaGVeOnRR3+YQkblmti2n6KYl0n2kNB4
+0ujSqpTloSfnR5tmJpz00WoOA9MJBdvHtxTTn8l6rVzXbm4mW9ZmB1kht/BgWaNL
+aIisW5AZSkQKer35wOWf0G7Gw+cWHq+I7W9pABEBAAG0OlhhbWFyaW4gUHVibGlj
+IEplbmtpbnMgKGF1dG8tc2lnbmluZykgPHJlbGVuZ0B4YW1hcmluLmNvbT6JATgE
+EwECACIFAlPfqCcCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEKahmzjT
+2DHvkOgH/2Hmny7VxRLLoynY+ONbf3wsllqpbBprZb+VwsQo3uhZMLlh/kES5Ww7
+3bvSlWWf0K/uGKpxsLyTLCT6xm9Gxg7e6hNHCyYiZz/u5orfzaF7LUDaG+Qfl9ge
+Zj/ln9nRub8DSTRyGEbbJyNaNldgtn3ojRVTdkFAEeiHepG2BarjJZOwIkFf4Uo8
+F2aQimBw9dDD6FqTSaPawguqNJxFlPU575Ymww0xotrx1J3D6k+bw0z9UYuY72JN
+MMCm4CxGLGkJgt0lj5OEY2sp7rEOzBCjyCveBsGQmLTAtEM/ZHOrusPRMLY/E5pY
+5nuGbLP4SGMtyNmEc0lNpr41XSTxgDCJARwEEAECAAYFAlQIhKQACgkQyQ+cuQ4f
+rQyc1wf+MCusJK4ANLWikbgiSSx1qMBveBlLKLEdCxYY+B9rc/pRDw448iBdd+nu
+SVdbRoqLgoN8gHbClboP+i22yw+mga0KASD7b1mpdYB0npR3H73zbYArn3qTV8s/
+yUXkIAEFUtj0yoEuv8KjO8P7nZJh8OuqqAupUVN0s3KjONqXqi6Ro3fvVEZWOUFZ
+l/FmY5KmXlpcw+YwE5CaNhJ2WunrjFTDqynRU/LeoPEKuwyYvfo937zJFCrpAUMT
+r/9QpEKmV61H7fEHA9oHq97FBwWfjOU0l2mrXt1zJ97xVd2DXxrZodlkiY6B76rh
+aT4ZhltY1E7WB2Z9WPfTe1Y6jz4fZ7kBDQRT36gnAQgArXOx7LAvUtz8SZtcqLrx
+n2C4ZviszDvoCKMu0d9lVyGTca5DGM2nnq6krDMMXYRI8jrHE/qyW0RmfvYjzhno
+eAKmZc8zrsUPy4OYftphlV3tAL2/gNswuepi0kAi91vDYwAVGXZJ53NWCH/Q89OX
+8uIzxLbTUsvkc7XtCEyx9R8vzyga5ReZ/htf/On9y+Z9WWV5ld74vq10/zshIfcU
+UuLrJkepFYeKNlxpSM1K1I4Wb2+Jcax31oMypVhaFEsnWmQ5O3opEyhevdkYkkqS
+2wy1trDTnc09nqr9gfAiURebC2w+gQd3QGx+yn6iogk98XAmYTRGcPjPhnETvxzW
+5wARAQABiQEfBBgBAgAJBQJT36gnAhsMAAoJEKahmzjT2DHvrDUIAMI5vTyeObez
+QTU159c2naEEGz6s/agJVoiCNJPs8yQk01aoMiFyWCOs3TYgfzodV2o7P0/c/bS+
+ePiy6oLWSmtJcwzpnMZ+iLo392tTBXWMSoGkLU9gA8QIprgaM92NaIcV4ALNvlSE
+lmKDwSPlFoWKoNdc6t7sKRSGEAUYJFcnQsXnwsWNfaJDafRTwuyiT6SZDjYAwCuv
+d2PZjmV0qvl3hoY8t0sXrJdD2CyH1d98/rwqXNqNXQwOcLsnIH6rqTUCE5EJuoDz
+h9Yy7vFbbZuH3RLVTHKpJ/HSRaJqNyVt6sSOyFsI21UYNdBvCxgLgWw+ggNHRkn/
+D5BxWL9l7HU=
+=RDbl
+-----END PGP PUBLIC KEY BLOCK-----

upgrading-from-v4.md

@@ -4,6 +4,8 @@ Docker Buildpack v5 contains some breaking changes and will require some changes
 
 * rootfs images are no longer published to Docker Hub.
 * rootfs images are now based on [Red Hat Universal Base Image 8 minimal](https://developers.redhat.com/articles/ubi-faq) image.
+* CF Buildpack is packaged directly into the build image.
+* Mendix 7 and older versions are no longer supported. To use Docker Buildpack v5, upgrade your app to Mendix 8 or a later version.
 
 ## Building rootfs images
 
@@ -15,7 +17,7 @@ In the past, Docker Buildpack offered two types of rootfs images: `bionic` and `
 With Docker Buildpack v5, all images are now based on ubi8-minimal:
 
 * `app` images contain only components that are required to run an app. Build-time components such as `tar`, compilers or Mono prerequisites are excluded - reducing the image size and excluding components that could increase the number of unpatched CVEs in the final image
-* `builder` images contain additional components that are only required when compiling a Mendix app.
+* `builder` images contain CF Buildpack and additional components that are only required when compiling a Mendix app.
 
 You will need to update your pipelines to build these prerequisite images and (optionally) push them to your private registry.
 
@@ -32,6 +34,7 @@ In this case, your build pipeline needs to be adjusted:
    docker build -t mendix-rootfs:builder -f rootfs-builder.dockerfile .
    ```
 2. When building the Mendix app itself, use the default values for `ROOTFS_IMAGE` and `BUILDER_ROOTFS_IMAGE` (remove any custom `--build-arg ROOTFS_IMAGE=...` and `--build-arg BUILDER_ROOTFS_IMAGE=...` arguments from the `docker build` command)
+3. If you need to use a specific version of CF Buildpack via `CF_BUILDPACK` or `CF_BUILDPACK_URL` arguments, these arguments should be specified when building the `rootfs-builder.dockerfile` image, **not** your app image.
 
 ### Option 2: build rootfs images centrally
 
@@ -55,6 +58,7 @@ In this case, you need to make the following changes in your CI/CD process:
    --build-arg BUILDER_ROOTFS_IMAGE={your-private-registry}/mendix-rootfs:builder \
    --tag {your-private-registry}/my-app:latest .
    ```
+3. If you need to use a specific version of CF Buildpack via `CF_BUILDPACK` or `CF_BUILDPACK_URL` arguments, these arguments should be specified when building the `rootfs-builder.dockerfile` image, **not** your app image.
 
 ## Migrating from Ubuntu to Red Hat UBI