RHOAIENG-10350 feat(Dockerfiles): switch from s2i python images to plain ubi/c9s bases

base/c9s-python-3.11/Dockerfile

@@ -1,4 +1,21 @@
-FROM quay.io/sclorg/python-311-c9s:c9s
+FROM quay.io/centos/centos:stream9
+
+# perform the setup that python image used to do for us
+#  but this way it uses a lot less disk space (hundreds of megabytes less)
+ENV APP_ROOT="/opt/app-root"
+ENV HOME="${APP_ROOT}/src"
+ENV VIRTUAL_ENV="${APP_ROOT}"
+ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
+ENV PYTHON_VERSION=3.11
+ENV PIP_NO_CACHE_DIR=off
+RUN mkdir --parents "${HOME}" && chmod --recursive 0771 ${APP_ROOT} && chown --recursive 1001:0 ${APP_ROOT} && \
+    useradd --uid 1001 --gid 0 --no-create-home --home-dir "${HOME}" \
+      --comment "Default Application User" --shell /bin/bash default && \
+    dnf install -y python${PYTHON_VERSION}-pip && dnf clean all && rm -rf /var/cache/yum/*
+COPY --from=quay.io/sclorg/s2i-core-c9s:latest /usr/bin/fix-permissions /usr/bin/rpm-file-permissions /usr/bin/
+
+USER 1001
+RUN python${PYTHON_VERSION} -m venv "${VIRTUAL_ENV}"
 
 ARG SOURCE_CODE=base/c9s-python-3.11
 
@@ -24,7 +41,11 @@ COPY ${SOURCE_CODE}/Pipfile.lock ./
 USER root
 
 # Install usefull OS packages
-RUN dnf install -y mesa-libGL && dnf clean all && rm -rf /var/cache/yum
+RUN dnf install -y \
+      mesa-libGL \
+      patch \
+      wget \
+    && dnf clean all && rm -rf /var/cache/yum
 
 # Other apps and tools installed as default user
 USER 1001

base/ubi9-python-3.11/Dockerfile

@@ -1,4 +1,21 @@
-FROM registry.access.redhat.com/ubi9/python-311:latest
+FROM registry.access.redhat.com/ubi9/ubi:latest
+
+# perform the setup that python s2i image used to do for us
+#  but this way it uses a lot less disk space (hundreds of megabytes less)
+ENV APP_ROOT="/opt/app-root"
+ENV HOME="${APP_ROOT}/src"
+ENV VIRTUAL_ENV="${APP_ROOT}"
+ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
+ENV PYTHON_VERSION=3.11
+ENV PIP_NO_CACHE_DIR=off
+RUN mkdir --parents "${HOME}" && chmod --recursive 0771 ${APP_ROOT} && chown --recursive 1001:0 ${APP_ROOT} && \
+    useradd --uid 1001 --gid 0 --no-create-home --home-dir "${HOME}" \
+      --comment "Default Application User" --shell /bin/bash default && \
+    dnf install -y python${PYTHON_VERSION}-pip && dnf clean all && rm -rf /var/cache/yum/*
+COPY --from=quay.io/sclorg/s2i-core-c9s:latest /usr/bin/fix-permissions /usr/bin/rpm-file-permissions /usr/bin/
+
+USER 1001
+RUN python${PYTHON_VERSION} -m venv "${VIRTUAL_ENV}"
 
 ARG SOURCE_CODE=base/ubi9-python-3.11
 
@@ -20,13 +37,17 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]"
 # Install Python dependencies from Pipfile.lock file
 COPY ${SOURCE_CODE}/Pipfile.lock ./
 
-RUN echo "Installing softwares and packages" && micropipenv install && rm -f ./Pipfile.lock
+RUN echo "Installing software and packages" && micropipenv install && rm -f ./Pipfile.lock
 
 # OS Packages needs to be installed as root
 USER root
 
 # Install usefull OS packages
-RUN dnf install -y mesa-libGL && dnf clean all && rm -rf /var/cache/yum
+RUN dnf install -y \
+      mesa-libGL \
+      patch \
+      wget \
+    && dnf clean all && rm -rf /var/cache/yum
 
 # Other apps and tools installed as default user
 USER 1001
@@ -38,7 +59,7 @@ RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/oc
     rm -f /tmp/openshift-client-linux.tar.gz
 
 # Fix permissions to support pip in Openshift environments
-RUN chmod -R g+w /opt/app-root/lib/python3.11/site-packages && \
+RUN chmod -R g+w /opt/app-root/lib/python${PYTHON_VERSION}/site-packages && \
       fix-permissions /opt/app-root -P
 
 WORKDIR /opt/app-root/src

tests/containers/base_image_test.py

@@ -5,6 +5,7 @@
 import json
 import logging
 import pathlib
+import platform
 import re
 import tempfile
 import textwrap
@@ -135,16 +136,23 @@ def test_oc_command_runs_fake_fips(self, image: str, subtests: pytest_subtests.S
             tmp_crypto.chmod(0o777)
 
             container = testcontainers.core.container.DockerContainer(image=image, user=54321, group_add=[0])
-            container.with_volume_mapping(str(tmp_crypto), "/proc/sys", mode="ro,z")
+
+            # if /proc/sys/crypto/fips_enabled exists, only replace this file,
+            # otherwise (Ubuntu case), assume entire /proc/sys/crypto does not exist
+            if platform.system().lower() == "darwin" or pathlib.Path("/proc/sys/crypto/fips_enabled").exists():
+                container.with_volume_mapping(str(tmp_crypto / 'crypto' / 'fips_enabled'), "/proc/sys/crypto/fips_enabled", mode="ro,z")
+            else:
+                container.with_volume_mapping(str(tmp_crypto), "/proc/sys", mode="ro,z")
+
             container.with_command("/bin/sh -c 'sleep infinity'")
 
             try:
                 container.start()
 
                 with subtests.test("/proc/sys/crypto/fips_enabled is 1"):
-                    ecode, output = container.exec(["/bin/sh", "-c", "sysctl crypto.fips_enabled"])
+                    ecode, output = container.exec(["/bin/sh", "-c", "cat /proc/sys/crypto/fips_enabled"])
                     assert ecode == 0, output.decode()
-                    assert "crypto.fips_enabled = 1\n" == output.decode(), output.decode()
+                    assert "1\n" == output.decode(), f"Unexpected crypto/fips_enabled content: {output.decode()}"
 
                 # 0: enabled, 1: partial success, 2: not enabled
                 with subtests.test("/fips-mode-setup --is-enabled reports 1"):