Skip to content

Updates to the Red Hat Dockerfile for Konflux #3967

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stevegrubb wants to merge 2 commits into
base: main
Choose a base branch
from
+27 −10
Open

Updates to the Red Hat Dockerfile for Konflux #3967

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1617ce8
Updates to the Red Hat Dockerfile for Konflux
stevegrubb Feb 10, 2026
1fe1361
hadolint ignoring
dtrawins Feb 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 27 additions & 10 deletions Dockerfile.redhat
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -271,10 +271,6 @@ COPY *\.bzl /ovms/
COPY yarn.lock /ovms/
COPY package.json /ovms/

# prebuild dependencies before copying sources
# hadolint ignore=DL3059
RUN bazel build --jobs=$JOBS ${debug_bazel_flags} //:ovms_dependencies @com_google_googletest//:gtest

# hadolint ignore=DL3059
RUN cp -v /etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt

Expand Down Expand Up @@ -310,17 +306,18 @@ RUN bash -c "sed -i -e 's|REPLACE_PROJECT_VERSION|${PROJECT_VERSION}|g' /ovms/sr
if [ "$ov_use_binary" == "0" ] ; then sed -i -e "s#REPLACE_OPENVINO_NAME#$(git --git-dir /openvino/.git log -n 1 | head -n 1 | cut -d' ' -f2 | head -c 12)#g" /ovms/src/version.hpp ; fi && \
bash -c "sed -i -e 's|REPLACE_BAZEL_BUILD_FLAGS|${debug_bazel_flags}${minitrace_flags}|g' /ovms/src/version.hpp"

# Custom Nodes
RUN bazel build --jobs=$JOBS ${debug_bazel_flags} //src:release_custom_nodes

# OVMS
ARG OPTIMIZE_BUILDING_TESTS=0
RUN rm -f /usr/lib64/cmake/OpenSSL/OpenSSLConfig.cmake

# Builds unit tests together with ovms server in one step
# It speeds up CI when tests are executed outside of the image building
# Konflux build system cuts off network access at times. Build all in 1 shot.
# hadolint ignore=SC2046
RUN bazel build --jobs=$JOBS ${debug_bazel_flags} ${minitrace_flags} //src:ovms $(if [ "$OPTIMIZE_BUILDING_TESTS" == "1" ] ; then echo -n //src:ovms_test; fi)
RUN bazel build --jobs=$JOBS ${debug_bazel_flags} //:ovms_dependencies @com_google_googletest//:gtest && \
bazel build --jobs=$JOBS ${debug_bazel_flags} //src:release_custom_nodes && \
Copy link
Collaborator

@dtrawins dtrawins Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we are using separate docker commands to take better advantage of docker cache. Usually the changes are from the target ovms and ovms_test. Why is it more reliable in one command?

Copy link
Contributor Author

@stevegrubb stevegrubb Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are times when bazel can't resolve packages due to konflux. (Konflux is designed to do hermetic builds. Of course, this is impossible due to bazel. But it is strict in it's interpretation of standards.) The only fix we could think of is move everything to a window when it has network access. The problem doesn't show up in podman or docker. But the solution doesn't affect them either. They still build.

Copy link
Contributor Author

@stevegrubb stevegrubb Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And maybe konflux blows up the cache between RUN commands? Konflux takes a very strict interpretation of what the OCI standard says. I wasn't the one that worked on this. Our DevOps team was tasked with the konflux migration. I am passing along what I heard discussed as they tried to solve it. When all 3 are in the same RUN command, it works.

bazel build --jobs=$JOBS ${debug_bazel_flags} ${minitrace_flags} //src:ovms \
$(if [ "$OPTIMIZE_BUILDING_TESTS" == "1" ] ; then echo -n //src:ovms_test; fi)

# Tests execution
COPY ci/check_coverage.bat /ovms/
Expand Down Expand Up @@ -348,14 +345,34 @@ ARG CAPI_FLAGS="--strip=always --config=mp_off_py_off --//:distro=redhat"
ARG JOBS=40
ARG LTO_ENABLE=OFF
WORKDIR /ovms
RUN bazel build --jobs $JOBS ${CAPI_FLAGS} //src:ovms_shared
# Konflux has a hard time locating the built binaries. Need to put it
# in a known location.
# hadolint ignore=DL4006
RUN mkdir -p /tmp/bazel-output && \
bazel --output_base=/tmp/bazel-output \
build --jobs=$JOBS ${CAPI_FLAGS} //src:ovms_shared && \
find /tmp/bazel-output -name libovms_shared.so && \
LIB_PATH=$(find /tmp/bazel-output -name libovms_shared.so | head -n1) && \
echo "Found built file: $LIB_PATH" && \
mkdir -p /ovms_release/lib && \
cp -v "$LIB_PATH" /ovms_release/lib/

# C api app with bazel
# hadolint ignore=DL3059
RUN bazel build --jobs $JOBS ${CAPI_FLAGS} //src:capi_cpp_example

# C-API benchmark app
RUN bazel build --jobs=$JOBS ${CAPI_FLAGS} //src:capi_benchmark && ./bazel-bin/src/capi_benchmark --niter 2 --nstreams 1 --servable_name "dummy"
# Konflux has a hard time locating the built binaries. Need to put it
# in a known location.
# hadolint ignore=DL4006
RUN mkdir -p /tmp/bazel-output && \
bazel --output_base=/tmp/bazel-output \
build --jobs=$JOBS ${CAPI_FLAGS} //src:capi_benchmark && \
CAPI_BIN=$(find /tmp/bazel-output -type f -name capi_benchmark | head -n1) && \
echo "Found built capi_benchmark: $CAPI_BIN" && \
chmod +x "$CAPI_BIN" && \
"$CAPI_BIN" --niter 2 --nstreams 1 --servable_name "dummy"

# C-api C/C++ app with gcc
COPY MakefileCapi /ovms/
RUN make -f MakefileCapi cpp CAPI_FLAGS="${CAPI_FLAGS}" && \
Expand Down