feat(Dockerfile): modify base to use ubi-micro to reduce attack vectors

[jcantrill]

Description

This PR:

• Modifies the final base image to ubi-micro to reduce the exposure to CVEs that are not part of the dependencies of the product

Replaces #3432

Summary by CodeRabbit

• Chores
  • Upgraded the build environment to Go 1.26.
  • Updated runtime images to a smaller UBI Micro base.
  • Added required runtime support for OpenSSL, certificates, synchronization, file inspection, and archive handling.
  • Ensured the application temporary directory is available with appropriate write permissions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4e89c14a-2ba7-441b-99ab-415737e38a17

📥 Commits

Reviewing files that changed from the base of the PR and between 4035d00 and 869ae7a.

📒 Files selected for processing (2)

• Dockerfile
• Dockerfile.art

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The Dockerfiles update Go builder images to version 1.26. Runtime images switch from UBI Minimal with direct microdnf installation to UBI Micro with packages staged through DNF.

Changes

Container image refresh

Layer / File(s)	Summary
Go 1.26 builder images Dockerfile, Dockerfile.art	Both builder stages use Go 1.26-based images.
UBI Micro runtime staging Dockerfile, Dockerfile.art	Runtime packages are installed into /mnt/rootfs, repository data is cleaned, /tmp/ocp-clo is created with writable permissions, and the staged filesystem is copied into UBI Micro 9.7.

Estimated code review effort: 2 (Simple) | ~15 minutes

Merge Risk: ⚪ Minimal · up to 869ae

The PR changes the final container base image to UBI Micro to reduce unnecessary CVE exposure, and no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: vparfonov, xperimental

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description states the primary intent and references the replaced pull request, but it omits the mandatory /cc and /assign directives. It also does not include the template's Links section or suff…	Add at least one reviewer with /cc and one approver with /assign from the top-level OWNERS file. Add the Links section and include related issues, dependent pull requests, or explicitly state that none apply. Expand the description with the…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: switching the Docker runtime base image to UBI Micro to reduce attack vectors.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description states the primary intent and references the replaced pull request, but it omits the mandatory /cc and /assign directives. It also does not include the template's Links section or sufficient implementation context.

Resolution

Add at least one reviewer with /cc and one approver with /assign from the top-level OWNERS file. Add the Links section and include related issues, dependent pull requests, or explicitly state that none apply. Expand the description with the implementation summary and rationale for the UBI Micro transition.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcantrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jcantrill]

/hold

[vparfonov]

/retest-required

[vparfonov]

/test e2e-using-bundle

[vparfonov]

@jcantrill can you please also change go version in go.mod to 1.26.7

[openshift-ci]

@jcantrill: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[vparfonov]

/label verified