Conversation
📝 WalkthroughWalkthroughThis pull request modifies five Dockerfiles to make build stage user contexts explicit. Four files add Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Security & Code Quality ReviewBase image substitution (llmisvc-controller.Dockerfile): The shift from distroless to UBI-minimal expands the runtime attack surface significantly. Distroless images contain only application runtime dependencies; UBI-minimal includes a package manager and additional utilities. Verify this change is intentional and driven by licensing, supply-chain requirements, or operational necessity rather than convenience. If the original distroless image was selected for security hardening, document the tradeoff rationale. User context directives: Adding explicit 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (1)
localmodel-agent.Dockerfile (1)
42-42: Remove:latesttag for clarity and policy compliance.Line 42 includes
:latestbefore the digest. While the digest (@sha256:...) ensures immutability and overrides any tag reference per OCI spec, retaining:latestis semantically confusing and violates best practice. Use a specific version tag or digest alone, matching line 2's pattern (e.g.,:9.4@sha256:...).Remediation code
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 +FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@localmodel-agent.Dockerfile` at line 42, The FROM instruction currently includes an explicit :latest tag before the digest (FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00); remove the :latest portion so the line uses either a specific version tag plus digest (e.g., :9.4@sha256:...) or the digest alone to match the pattern used elsewhere, ensuring the image reference is unambiguous and policy-compliant.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@agent.Dockerfile`:
- Line 42: The FROM instruction uses a mutable tag "latest" alongside a digest;
remove the mutable tag so the base image is referenced by digest-only or a
pinned version tag instead (update the FROM line that currently references
registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00
to a digest-only form or a specific version tag), ensuring the base image
reference is immutable.
In `@Dockerfile`:
- Line 42: The Dockerfile's FROM instruction currently references the runtime
base image with the mutable :latest tag alongside a SHA256 digest
(registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:...), remove the
`:latest` tag so the FROM line uses only the immutable digest (e.g.,
registry.access.redhat.com/ubi9/ubi-minimal@sha256:...) to ensure reproducible
builds; update the FROM instruction accordingly (look for the FROM line
referencing ubi-minimal).
In `@llmisvc-controller.Dockerfile`:
- Line 42: The FROM instruction currently pins both a tag and a digest
("registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28..."),
which is redundant and risky; update the Dockerfile's FROM line used in the
llmisvc controller to remove the ":latest" tag so the base image is referenced
only by digest (e.g., change the FROM instruction that mentions
"ubi-minimal:latest@sha256:7d4e47500f28..." to use
"ubi-minimal@sha256:7d4e47500f28..."), ensuring the image is digest-pinned and
CI will not inadvertently resolve an unreviewed tag.
In `@localmodel.Dockerfile`:
- Line 41: The FROM instruction uses a mutable tag with a digest
("registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00");
update the Dockerfile's FROM line to use digest-only image reference by removing
the ":latest" tag so it becomes
"registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00"
to ensure immutability across builds and deployments.
In `@python/storage-initializer.Dockerfile`:
- Line 4: Remove the mutable :latest tag from the FROM image specifications and
rely solely on the digest; update the FROM lines that currently read
"registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:..." (and the second
identical occurrence later in the file) to use the digest-only form
"registry.access.redhat.com/ubi9/ubi-minimal@sha256:..." so the build is pinned
to the immutable digest.
In `@router.Dockerfile`:
- Line 41: The FROM image reference currently includes a mutable tag and a
digest ("FROM
registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00");
remove the ":latest" tag so the runtime image is referenced only by its
immutable digest (e.g., change the FROM line to use
"registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00")
to avoid semantic ambiguity in tooling while keeping the digest intact.
---
Nitpick comments:
In `@localmodel-agent.Dockerfile`:
- Line 42: The FROM instruction currently includes an explicit :latest tag
before the digest (FROM
registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00);
remove the :latest portion so the line uses either a specific version tag plus
digest (e.g., :9.4@sha256:...) or the digest alone to match the pattern used
elsewhere, ensuring the image reference is unambiguous and policy-compliant.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 8cbf8418-e4f6-41f5-ba25-b637d652f739
📒 Files selected for processing (7)
Dockerfileagent.Dockerfilellmisvc-controller.Dockerfilelocalmodel-agent.Dockerfilelocalmodel.Dockerfilepython/storage-initializer.Dockerfilerouter.Dockerfile
|
|
||
| # Copy the inference-agent into a thin image | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find and verify agent.Dockerfile
fd agent.Dockerfile --type fRepository: opendatahub-io/kserve
Length of output: 109
🏁 Script executed:
# Read agent.Dockerfile to verify line 42
wc -l agent.DockerfileRepository: opendatahub-io/kserve
Length of output: 84
🏁 Script executed:
# Check the relevant section around line 42
cat -n agent.Dockerfile | sed -n '35,50p'Repository: opendatahub-io/kserve
Length of output: 852
Remove mutable :latest tag from base image reference (CWE-829).
Line 42 specifies :latest@sha256:.... While the digest provides integrity verification, the mutable tag should be removed—use digest-only reference or a pinned version tag. Mutable tags can be reassigned in registries, bypassing validation.
Remediation
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 | |
| FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@agent.Dockerfile` at line 42, The FROM instruction uses a mutable tag
"latest" alongside a digest; remove the mutable tag so the base image is
referenced by digest-only or a pinned version tag instead (update the FROM line
that currently references
registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00
to a digest-only form or a specific version tag), ensuring the base image
reference is immutable.
|
|
||
| # Runtime image - Copy the controller-manager into a thin image | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -type f -name "Dockerfile*" | head -20Repository: opendatahub-io/kserve
Length of output: 564
🏁 Script executed:
cat -n ./Dockerfile | sed -n '35,50p'Repository: opendatahub-io/kserve
Length of output: 940
Remove :latest tag from runtime base image (CWE-829).
Line 42 includes :latest tag alongside the SHA256 digest. Per coding guidelines, use specific image tags (not :latest). The mutable :latest tag should be removed, retaining only the SHA256 digest for reproducibility.
Remediation
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 | |
| FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` at line 42, The Dockerfile's FROM instruction currently
references the runtime base image with the mutable :latest tag alongside a
SHA256 digest (registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:...),
remove the `:latest` tag so the FROM line uses only the immutable digest (e.g.,
registry.access.redhat.com/ubi9/ubi-minimal@sha256:...) to ensure reproducible
builds; update the FROM instruction accordingly (look for the FROM line
referencing ubi-minimal).
|
|
||
| # Copy the controller-manager into a thin image | ||
| FROM gcr.io/distroless/static:nonroot | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name "*llmisvc-controller.Dockerfile*" -o -name "*Dockerfile*" -path "*llmisvc*" | head -20Repository: opendatahub-io/kserve
Length of output: 96
🏁 Script executed:
cat -n ./llmisvc-controller.Dockerfile | sed -n '40,45p'Repository: opendatahub-io/kserve
Length of output: 446
Remove :latest tag from runtime base image (CWE-829).
Severity: Low. Line 42 uses :latest@sha256:... which is redundant and creates supply chain risk. CI systems may drop the digest or resolve latest tag independently, pulling an unreviewed base image version.
Remediation code
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 | |
| FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@llmisvc-controller.Dockerfile` at line 42, The FROM instruction currently
pins both a tag and a digest
("registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28..."),
which is redundant and risky; update the Dockerfile's FROM line used in the
llmisvc controller to remove the ":latest" tag so the base image is referenced
only by digest (e.g., change the FROM instruction that mentions
"ubi-minimal:latest@sha256:7d4e47500f28..." to use
"ubi-minimal@sha256:7d4e47500f28..."), ensuring the image is digest-pinned and
CI will not inadvertently resolve an unreviewed tag.
|
|
||
| # Copy the controller-manager into a thin image | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
fd -t f -name "localmodel.Dockerfile" | head -20Repository: opendatahub-io/kserve
Length of output: 295
🏁 Script executed:
fd localmodel.DockerfileRepository: opendatahub-io/kserve
Length of output: 86
🏁 Script executed:
cat -n localmodel.Dockerfile | head -50Repository: opendatahub-io/kserve
Length of output: 2282
🌐 Web query:
Docker image tag digest best practices :latest@sha256 security
💡 Result:
Best practices for Docker image tags, digests (SHA256), and security, especially regarding the :latest tag: 1. Avoid using :latest in production Dockerfiles, deployments (Kubernetes manifests, docker-compose), or pulls. The :latest tag is mutable and can be updated to point to different image content over time, leading to non-deterministic builds, unexpected breaking changes, or supply chain attacks where malicious content is pushed under the same tag. 2. Pin images using specific semantic version tags first (e.g., nginx:1.25.3-alpine) for readability and to get security patches when maintainers rebuild tags. Then, enhance security by appending the SHA256 digest: nginx:1.25.3-alpine@sha256:abc123.... This combines human-readable versioning with cryptographic immutability—the digest ensures the exact same image content is pulled every time, preventing tag hijacking or tampering. 3. Use digests in Dockerfiles for base images and COPY --from= references: FROM ubuntu:22.04@sha256:def456... or COPY --from=builder@sha256:ghi789... /app /app. This guarantees reproducible builds. 4. To obtain a digest: - docker pull image:tag - docker inspect --format='{{index .RepoDigests 0}}' - Or docker manifest inspect image:tag | jq -r '.[0].Digest' (for manifest list digest, suitable for multi-platform). 5. For production deployments, resolve and pin digests during CI/CD pipelines. Tools like Renovate or Dependabot can automate digest updates via PRs when new image versions are available. 6. Additional security layers: - Enforce digest-only policies using Docker Build policies (e.g., require input.image.isCanonical). - Use image signing (Cosign, Docker Content Trust) and verify signatures. - Scan images with tools like Trivy, Grype, or Snyk, and monitor for new vulnerabilities. - For multi-platform images, the tag@sha256: points to the manifest list digest; platform-specific digests are available via manifest inspect. Benefits: Immutability prevents supply chain attacks; consistency across environments; easier debugging (same image everywhere); verifiable integrity via SHA256 hash. Trade-offs: Manual maintenance for updates (automate with bots); some scanners may have issues with digests (rare now).
Citations:
- 1: https://docs.docker.com/dhi/core-concepts/digests/
- 2: https://interrupt.sh/blog/dockerfile-tags/
- 3: https://docs.docker.com/build/policies/validate-images/
- 4: https://nickjanetakis.com/blog/docker-tip-100-should-you-use-image-digests-in-your-dockerfile
- 5: https://edu.chainguard.dev/chainguard/chainguard-images/how-to-use/container-image-digests/
- 6: https://sourcery.ai/vulnerabilities/docker-unpinned-image-tags
Remove mutable :latest tag to ensure digest immutability (CWE-829).
Line 41 uses :latest@sha256, which creates a supply chain vulnerability. While the SHA256 digest pins the current image content at build time, the :latest tag remains mutable; future pushes to :latest could point to different, potentially compromised content. Use digest-only format to guarantee immutability across all builds and deployments.
Remediation
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 | |
| FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@localmodel.Dockerfile` at line 41, The FROM instruction uses a mutable tag
with a digest
("registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00");
update the Dockerfile's FROM line to use digest-only image reference by removing
the ":latest" tag so it becomes
"registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00"
to ensure immutability across builds and deployments.
|
|
||
| ## Builder | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest AS builder | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 AS builder |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
fd -type f -name "*storage-initializer*Dockerfile*"Repository: opendatahub-io/kserve
Length of output: 235
🏁 Script executed:
# Once we find the file, read its content to verify lines 4 and 53
cat -n python/storage-initializer.Dockerfile | head -80Repository: opendatahub-io/kserve
Length of output: 3461
Remove :latest tag from both base image specifications—only digest pinning should be used (CWE-829).
Lines 4 and 53 redundantly specify :latest alongside digest hashes. Mutable tags defeat digest pinning; rely on digest alone.
Remediation
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 AS builder
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 AS builder
...
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 AS prod
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 AS prod📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 AS builder | |
| FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 AS builder |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@python/storage-initializer.Dockerfile` at line 4, Remove the mutable :latest
tag from the FROM image specifications and rely solely on the digest; update the
FROM lines that currently read
"registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:..." (and the second
identical occurrence later in the file) to use the digest-only form
"registry.access.redhat.com/ubi9/ubi-minimal@sha256:..." so the build is pinned
to the immutable digest.
|
|
||
| # Copy the inference-router into a thin image | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name "router.Dockerfile" -o -name "*router*.Dockerfile"Repository: opendatahub-io/kserve
Length of output: 84
🏁 Script executed:
git ls-files | grep -i dockerfileRepository: opendatahub-io/kserve
Length of output: 1567
🏁 Script executed:
cat -n router.Dockerfile | sed -n '35,50p'Repository: opendatahub-io/kserve
Length of output: 851
Remove :latest tag from runtime image reference (CWE-829).
Severity: Low. Line 41 includes mutable tag text alongside digest pin. While the digest ensures immutability, the :latest prefix creates semantic ambiguity and may confuse image reference parsing in supply-chain tooling.
Remediation code
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 | |
| FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@router.Dockerfile` at line 41, The FROM image reference currently includes a
mutable tag and a digest ("FROM
registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00");
remove the ":latest" tag so the runtime image is referenced only by its
immutable digest (e.g., change the FROM line to use
"registry.access.redhat.com/ubi9/ubi-minimal@sha256:7d4e47500f28ac3a2bff06c25eff9127ff21048538ae03ce240d57cf756acd00")
to avoid semantic ambiguity in tooling while keeping the digest intact.
israel-hdez
force-pushed
the
j54583
branch
2 times, most recently
from
cc086f9 to
d80163d
Compare
Add `USER 0` to builder imagen. Without it, Podman fails without a permission denied error. Additionally, remove usage of gcr distroless image Signed-off-by: Edgar Hernández <23639005+israel-hdez@users.noreply.github.com>
israel-hdez
changed the title
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: israel-hdez, jlost, spolti The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
Dockerfile (1)
42-42:⚠️ Potential issue | 🟠 MajorPin runtime base image to an immutable reference; avoid
:latest(CWE-494).Line 42 still uses a mutable tag. Replace
:latestwith a fixed version tag and digest to make builds reproducible and resistant to tag drift.Remediation
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest +FROM registry.access.redhat.com/ubi9/ubi-minimal:9.5-1741853987@sha256:<verified-digest>As per coding guidelines,
**/Dockerfile*: “Use specific image tags (not :latest)”.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` at line 42, Replace the mutable base image reference "FROM registry.access.redhat.com/ubi9/ubi-minimal:latest" with a pinned, immutable reference: choose a specific UBI9 minimal tag (e.g., a known minor/patch like :9.3-*) and append the corresponding image digest (sha256) so the line becomes "FROM registry.access.redhat.com/ubi9/ubi-minimal:<version>@sha256:<digest>"; update the Dockerfile's FROM line accordingly and ensure the chosen tag+digest is verified from the registry to make builds reproducible and avoid tag drift.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile`:
- Around line 6-7: The Dockerfile currently sets USER 0 globally causing deps,
builder, and license stages to run as root; limit root scope by using USER 0
only for the specific steps that require root (e.g., package installation or
file permission changes) and create/switch to a non-root user for the build
steps: modify the stages referenced (deps, builder, license) to perform
root-only actions under USER 0 and then add commands to create a non-root
user/group and switch to that user (USER <nonroot>) before running build tools
or dependency downloads, ensuring subsequent runs in build stages execute as
non-root.
---
Duplicate comments:
In `@Dockerfile`:
- Line 42: Replace the mutable base image reference "FROM
registry.access.redhat.com/ubi9/ubi-minimal:latest" with a pinned, immutable
reference: choose a specific UBI9 minimal tag (e.g., a known minor/patch like
:9.3-*) and append the corresponding image digest (sha256) so the line becomes
"FROM registry.access.redhat.com/ubi9/ubi-minimal:<version>@sha256:<digest>";
update the Dockerfile's FROM line accordingly and ensure the chosen tag+digest
is verified from the registry to make builds reproducible and avoid tag drift.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 1a6104df-1e85-4fa4-b2f7-144387c5ff15
📒 Files selected for processing (5)
Dockerfileagent.Dockerfilellmisvc-controller.Dockerfilepython/storage-initializer.Dockerfilerouter.Dockerfile
✅ Files skipped from review due to trivial changes (2)
- router.Dockerfile
- python/storage-initializer.Dockerfile
🚧 Files skipped from review as they are similar to previous changes (2)
- llmisvc-controller.Dockerfile
- agent.Dockerfile
| # Run as root during build (final image uses nonroot) | ||
| USER 0 |
There was a problem hiding this comment.
Limit root scope in build stages (CWE-250).
Line 7 sets root on deps, and both builder/license inherit it; this runs dependency download/build steps as root. Keep root only where strictly required, then drop to non-root before build commands.
Remediation
FROM deps AS builder
+USER 1001
ARG CMD=manager
ARG GOTAGS=""
COPY cmd/${CMD}/ cmd/${CMD}/
COPY pkg/ pkg/
RUN --mount=type=cache,target=/go/pkg/mod \
--mount=type=cache,target=/root/.cache/go-build \
CGO_ENABLED=0 GOOS=linux GOFLAGS=-mod=readonly go build -tags "${GOTAGS}" -a -o manager ./cmd/${CMD}
# ---- License stage (parallel with build on BuildKit) ----
FROM deps AS license
+USER 1001As per coding guidelines, **/Dockerfile*: “Run as non-root user”.
🧰 Tools
🪛 Trivy (0.69.3)
[error] 7-7: WORKDIR path not absolute
WORKDIR path 'gen-crd-api-reference-docs' should be absolute
Rule: DS-0009
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` around lines 6 - 7, The Dockerfile currently sets USER 0 globally
causing deps, builder, and license stages to run as root; limit root scope by
using USER 0 only for the specific steps that require root (e.g., package
installation or file permission changes) and create/switch to a non-root user
for the build steps: modify the stages referenced (deps, builder, license) to
perform root-only actions under USER 0 and then add commands to create a
non-root user/group and switch to that user (USER <nonroot>) before running
build tools or dependency downloads, ensuring subsequent runs in build stages
execute as non-root.
|
/retest |
1 similar comment
|
/retest |
|
@israel-hdez: The following test has Failed: OCI Artifact Browser URLInspecting Test Artifacts ManuallyTo inspect your test artifacts manually, follow these steps:
mkdir -p oras-artifacts
cd oras-artifacts
oras pull quay.io/opendatahub/odh-ci-artifacts:kserve-group-test-jqzn4 |
4 participants
What this PR does / why we need it:
Add
USER 0to builder imagen. Without it, Podman fails with apermission denied error.
Additionally, remove usage of gcr distroless image
Was related to https://redhat.atlassian.net/browse/RHOAIENG-54583
Feature/Issue validation/testing:
Running
make docker-build-*commands.Summary by CodeRabbit
Release Notes