Skip to content

Issue open-horizon#4389 - Upgrade docker image to ubi10 for anax service #4390

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Issue open-horizon#4389 - Upgrade docker image to ubi10 for anax service #4390

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions anax-in-container/Dockerfile.ubi.amd64
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9-minimal:latest
FROM registry.access.redhat.com/ubi10-minimal:latest

LABEL vendor="IBM"
LABEL summary="The agent in a general purpose container."
Expand All @@ -11,7 +11,7 @@ ARG DOCKER_VER=27.5.1
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
# Install docker cli, which requires tar / gunzip to unpack, then remove tar / gzip packages
# Create required directories
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip"
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar gzip"
RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
&& microdnf upgrade -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager krb5-libs \
Expand All @@ -22,7 +22,12 @@ RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disablepl
&& microdnf clean all --disableplugin=subscription-manager \
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
&& mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust \
&& printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \
&& printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \
&& chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore

# add license file
COPY LICENSE.txt /licenses
Expand All @@ -38,5 +43,7 @@ ADD hzn /usr/bin/
WORKDIR /root
COPY script/anax.service /root/

# This is for testing locally. Will remove later.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD curl -sf http://localhost:8510/status > /dev/null || exit 1
# You can add a 2nd arg to this on the docker run cmd or the CMD statement in another dockerfile, to configure a specific environment
ENTRYPOINT ["/root/anax.service", "start"]
15 changes: 11 additions & 4 deletions anax-in-container/Dockerfile.ubi.arm64
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9-minimal:latest
FROM registry.access.redhat.com/ubi10-minimal:latest

LABEL vendor="IBM"
LABEL summary="The agent in a general purpose container."
Expand All @@ -11,7 +11,7 @@ ARG DOCKER_VER=27.5.1
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
# Install docker cli, which requires tar / gunzip to unpack, then remove tar / gzip packages
# Create required directories
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip"
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar gzip curl"
RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
&& curl -4fsSLO https://download.docker.com/linux/static/stable/aarch64/docker-${DOCKER_VER}.tgz \
Expand All @@ -21,8 +21,12 @@ RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disable
&& microdnf clean all --disableplugin=subscription-manager \
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
&& mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust

&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust \
&& printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \
&& printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \
&& chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore
# add license file
COPY LICENSE.txt /licenses

Expand All @@ -37,5 +41,8 @@ ADD hzn /usr/bin/
WORKDIR /root
COPY script/anax.service /root/


# This is for testing locally. Will remove later.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD curl -sf http://localhost:8510/status > /dev/null || exit 1
# You can add a 2nd arg to this on the docker run cmd or the CMD statement in another dockerfile, to configure a specific environment
ENTRYPOINT ["/root/anax.service", "start"]
13 changes: 10 additions & 3 deletions anax-in-container/Dockerfile.ubi.ppc64el
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9-minimal:latest
FROM registry.access.redhat.com/ubi10-minimal:latest

LABEL vendor="IBM"
LABEL summary="The agent in a general purpose container."
Expand All @@ -14,7 +14,7 @@ COPY EPEL.repo /etc/yum.repos.d
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
# Install docker cli, which requires tar / gunzip to unpack, then remove tar / gzip packages
# Create required directories
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip"
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar gzip"
RUN microdnf clean all \
&& rm -rf /var/cache/dnf /var/cache/PackageKit \
&& microdnf update -y libxml2 --nodocs --nobest --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
Expand All @@ -26,7 +26,12 @@ RUN microdnf clean all \
&& microdnf clean all --disableplugin=subscription-manager \
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
&& mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust \
&& printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \
&& printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \
&& chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore

# add license file
COPY LICENSE.txt /licenses
Expand All @@ -42,5 +47,7 @@ ADD hzn /usr/bin/
WORKDIR /root
COPY script/anax.service /root/

# This is for testing locally. Will remove later.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD curl -sf http://localhost:8510/status > /dev/null || exit 1
# You can add a 2nd arg to this on the docker run cmd or the CMD statement in another dockerfile, to configure a specific environment
ENTRYPOINT ["/root/anax.service", "start"]
13 changes: 10 additions & 3 deletions anax-in-container/Dockerfile.ubi.s390x
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9-minimal:latest
FROM registry.access.redhat.com/ubi10-minimal:latest

LABEL vendor="IBM"
LABEL summary="The agent in a general purpose container."
Expand All @@ -11,7 +11,7 @@ ARG DOCKER_VER=18.06.3-ce
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
# Install docker cli, which requires tar / gunzip to unpack, then remove tar / gzip packages
# Create required directories
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip"
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar gzip"
RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
&& curl -4fsSLO https://download.docker.com/linux/static/stable/s390x/docker-${DOCKER_VER}.tgz \
Expand All @@ -21,7 +21,12 @@ RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disable
&& microdnf clean all --disableplugin=subscription-manager \
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
&& mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust \
&& printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \
&& printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \
&& chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore

# add license file
COPY LICENSE.txt /licenses
Expand All @@ -37,5 +42,7 @@ ADD hzn /usr/bin/
WORKDIR /root
COPY script/anax.service /root/

# This is for testing locally. Will remove later.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD curl -sf http://localhost:8510/status > /dev/null || exit 1
# You can add a 2nd arg to this on the docker run cmd or the CMD statement in another dockerfile, to configure a specific environment
ENTRYPOINT ["/root/anax.service", "start"]
9 changes: 7 additions & 2 deletions anax-in-k8s/Dockerfile.ubi.amd64
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9-minimal:latest
FROM registry.access.redhat.com/ubi10-minimal:latest

LABEL vendor="IBM"
LABEL summary="The agent for edge clusters."
Expand All @@ -8,13 +8,18 @@ LABEL description="The agent in a container that is used solely for the purpose
# The anax.service calls jq (from jq) and killall (from psmisc)
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
# Create required directories
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar"
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar"
RUN microdnf update libxml2 -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
&& microdnf clean all --disableplugin=subscription-manager \
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
&& mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/trust /etc/docker/certs.d \
&& printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \
&& printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \
&& chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore \
&& adduser agentuser -u 1000 -U -f -1 -c "agent user,1,2,3"

# add license file
Expand Down
9 changes: 7 additions & 2 deletions anax-in-k8s/Dockerfile.ubi.arm64
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9-minimal:latest
FROM registry.access.redhat.com/ubi10-minimal:latest

LABEL vendor="IBM"
LABEL summary="The agent for edge clusters."
Expand All @@ -8,13 +8,18 @@ LABEL description="The agent in a container that is used solely for the purpose
# The anax.service calls jq (from jq) and killall (from psmisc)
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
# Create required directories
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar"
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar"
RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
&& microdnf clean all --disableplugin=subscription-manager \
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
&& mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust /etc/docker/certs.d \
&& printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \
&& printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \
&& chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore \
&& adduser agentuser -u 1000 -U -f -1 -c "agent user,1,2,3"

# add license file
Expand Down
9 changes: 7 additions & 2 deletions anax-in-k8s/Dockerfile.ubi.ppc64el
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9-minimal:latest
FROM registry.access.redhat.com/ubi10-minimal:latest

LABEL vendor="IBM"
LABEL summary="The agent for edge clusters."
Expand All @@ -11,7 +11,7 @@ COPY EPEL.repo /etc/yum.repos.d
# The anax.service calls jq (from jq) and killall (from psmisc)
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
# Create required directories
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng"
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng"
RUN microdnf clean all \
&& rm -rf /var/cache/dnf /var/cache/PackageKit \
&& microdnf update -y libxml2 --nodocs --nobest --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
Expand All @@ -20,6 +20,11 @@ RUN microdnf clean all \
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
&& mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust /etc/docker/certs.d \
&& printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \
&& printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \
&& chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore \
&& adduser agentuser -u 1000 -U -f -1 -c "agent user,1,2,3"

# add license file
Expand Down
9 changes: 7 additions & 2 deletions anax-in-k8s/Dockerfile.ubi.s390x
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9-minimal:latest
FROM registry.access.redhat.com/ubi10-minimal:latest

LABEL vendor="IBM"
LABEL summary="The agent for edge clusters."
Expand All @@ -11,13 +11,18 @@ COPY EPEL.repo /etc/yum.repos.d
# The anax.service calls jq (from jq) and killall (from psmisc)
# anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
# Create required directories
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng"
ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng"
RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
&& microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
&& microdnf clean all --disableplugin=subscription-manager \
&& rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
&& mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \
&& mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust /etc/docker/certs.d \
&& printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \
&& printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \
&& printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \
&& chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore \
&& adduser agentuser -u 1000 -U -f -1 -c "agent user,1,2,3"

# add license file
Expand Down
Loading