fix(rocprofiler-systems): fix Dockerfile Trivy misconfigurations

.github/workflows/rocprofiler-systems-continuous-integration.yml

@@ -195,7 +195,8 @@ jobs:
 
       - name: Install MPI
         run: |
-          apt install -y libopenmpi-dev
+          apt-get update
+          apt-get install -y libopenmpi-dev
           echo "✅ MPI Installed!"
 
       - name: Install Latest Nightly ROCm

projects/rocprofiler-systems/docker/Dockerfile.opensuse

@@ -27,6 +27,7 @@ RUN zypper --non-interactive update -y && \
         gcc-c++ gcc-fortran git gmock gtest iproute2 libdrm-devel libnuma-devel \
         ninja nlohmann_json-devel openmpi3-devel python3-pip rpm-build \
         sqlite3-devel wget libucp-devel libuct-devel && \
+    zypper clean --all && \
     python3 -m pip install --upgrade pip && \
     python3 -m pip install 'cmake==3.25'
 
@@ -45,7 +46,7 @@ RUN if [ "${ROCM_MAJOR}" != "0" ] || [ "${ROCM_MINOR}" != "0" ]; then \
         zypper --non-interactive --no-gpg-checks install -y https://repo.radeon.com/amdgpu-install/${ROCM_VERSION_URL}/sle/${OS_VERSION}/amdgpu-install-${ROCM_MAJOR}.${ROCM_MINOR}.${ROCM_VERSN}-1.noarch.rpm && \
         zypper --non-interactive --gpg-auto-import-keys refresh && \
         zypper --non-interactive install -y rocm-dev rccl-devel libpciaccess0 && \
-        zypper --non-interactive clean --all; \
+        zypper clean --all; \
     fi
 
 ARG PYTHON_VERSIONS="8 9 10 11 12 13 14 15"
@@ -74,3 +75,7 @@ RUN if python3 -c "import sys; sys.exit(0 if sys.version_info >= (3, 8) else 1)"
 
 WORKDIR /home
 SHELL [ "/bin/bash", "--login", "-c" ]
+
+# Build/development image that runs as root by design.
+# trivy:ignore:DS-0002
+USER root

projects/rocprofiler-systems/docker/Dockerfile.opensuse.ci

@@ -30,7 +30,7 @@ RUN zypper --non-interactive update -y && \
         gcc-c++ gcc-fortran git gmock gtest iproute2 ninja nlohmann_json-devel \
         openmpi3-devel papi-devel python3-devel python3-pip rpm-build \
         sqlite3-devel vim wget libucp-devel libuct-devel && \
-    zypper --non-interactive clean --all && \
+    zypper clean --all && \
     python3 -m pip install --upgrade pip && \
     python3 -m pip install 'cmake==3.25' perfetto
 
@@ -74,3 +74,7 @@ RUN if [ -n "${GPU_TYPE}" ]; then \
 
 WORKDIR /home
 SHELL [ "/bin/bash", "--login", "-c" ]
+
+# Build/development image that runs as root by design.
+# trivy:ignore:DS-0002
+USER root

projects/rocprofiler-systems/docker/Dockerfile.rhel

@@ -89,3 +89,7 @@ ENV LC_ALL C.UTF-8
 SHELL [ "/bin/bash", "--login", "-c" ]
 COPY ./docker/entrypoint-rhel.sh /docker-entrypoint.sh
 ENTRYPOINT [ "/docker-entrypoint.sh" ]
+
+# Build/development image that runs as root by design.
+# trivy:ignore:DS-0002
+USER root

projects/rocprofiler-systems/docker/Dockerfile.rhel.ci

@@ -95,3 +95,7 @@ RUN if [ -n "${ROCM_VERSION}" ]; then \
 
 WORKDIR /home
 SHELL [ "/bin/bash", "--login", "-c" ]
+
+# Build/development image that runs as root by design.
+# trivy:ignore:DS-0002
+USER root

projects/rocprofiler-systems/docker/Dockerfile.ubuntu

@@ -25,30 +25,33 @@ ENV PATH=${HOME}/.local/bin:${PATH}
 
 RUN apt-get update && \
     apt-get dist-upgrade -y && \
-    apt-get install -y apt-utils autoconf autotools-dev bash-completion \
-        build-essential chrpath cmake curl flex gettext git-core gnupg2 iproute2 \
-        libgmock-dev libgtest-dev libnuma1 libopenmpi-dev libpapi-dev libpfm4-dev \
-        librpm-dev libsqlite3-dev libtool libudev1 lsb-release m4 ninja-build \
-        nlohmann-json3-dev python3-pip rpm wget \
-        libucx-dev ucx-utils && \
+    apt-get install -y --no-install-recommends \
+        apt-utils autoconf autotools-dev bash-completion build-essential ca-certificates \
+        chrpath cmake curl flex gettext git-core gnupg2 iproute2 libgmock-dev \
+        libgtest-dev libnuma1 libopenmpi-dev libpapi-dev libpfm4-dev librpm-dev \
+        libsqlite3-dev libtool libucx-dev libudev1 lsb-release m4 ninja-build \
+        nlohmann-json3-dev python3-dev python3-pip rpm ucx-utils wget && \
     OS_VERSION=$(grep '^VERSION_ID=' /etc/os-release | cut -d'=' -f2 | tr -d '"') && \
     OS_ID=$(grep '^ID=' /etc/os-release | cut -d'=' -f2 | tr -d '"') && \
     if [ "${OS_ID}" == "ubuntu" ] && [ "${OS_VERSION}" == "22.04" ]; then \
         python3 -m pip install 'cmake==3.25'; \
     else \
         python3 -m pip install --break-system-packages 'cmake==3.25' perfetto; \
-    fi
+    fi && \
+    rm -rf /var/lib/apt/lists/*
 
 RUN if [ "${ROCM_MAJOR}" != "0" ] || [ "${ROCM_MINOR}" != "0" ]; then \
         OS_VERSION=$(grep '^VERSION_ID=' /etc/os-release | cut -d'=' -f2 | tr -d '"') && \
         OS_CODENAME=$(grep '^VERSION_CODENAME=' /etc/os-release | cut -d'=' -f2) && \
         AMDGPU_DEB="amdgpu-install_${ROCM_MAJOR}.${ROCM_MINOR}.${ROCM_VERSN}-1_all.deb" && \
         wget https://repo.radeon.com/amdgpu-install/${ROCM_VERSION_URL}/ubuntu/${OS_CODENAME}/${AMDGPU_DEB} && \
-        apt-get install -y ./${AMDGPU_DEB} && \
         apt-get update && \
-        apt-get install -y rocm-dev rccl-dev libpciaccess0 ${EXTRA_PACKAGES} && \
-        apt-get autoclean; \
-    fi
+        apt-get install -y --no-install-recommends ./${AMDGPU_DEB} && \
+        apt-get update && \
+        apt-get install -y --no-install-recommends rocm-dev rccl-dev libpciaccess0 ${EXTRA_PACKAGES} && \
+        apt-get clean; \
+    fi && \
+    rm -rf /var/lib/apt/lists/*
 
 ARG PYTHON_VERSIONS="8 9 10 11 12 13 14 15"
 
@@ -83,3 +86,7 @@ RUN if python3 -c "import sys; sys.exit(0 if sys.version_info >= (3, 8) else 1)"
 ENV LC_ALL=C.UTF-8
 WORKDIR /home
 SHELL [ "/bin/bash", "--login", "-c" ]
+
+# Build/development image that runs as root by design.
+# trivy:ignore:DS-0002
+USER root

projects/rocprofiler-systems/docker/Dockerfile.ubuntu.ci

@@ -23,13 +23,15 @@ ENV CMAKE_PREFIX_PATH="/usr/local"
 
 RUN apt-get update && \
     apt-get dist-upgrade -y && \
-    apt-get install -y autoconf autotools-dev bash-completion build-essential \
-        bzip2 ccache chrpath cmake curl environment-modules flex gettext git-core gnupg2 \
-        gzip iproute2 libgmock-dev libgtest-dev libiberty-dev libpapi-dev libpfm4-dev \
-        libsqlite3-dev libtool locales lsb-release m4 ninja-build nlohmann-json3-dev \
-        pkg-config python3-pip software-properties-common unzip wget vim zip zlib1g-dev \
-        libucx-dev ucx-utils && \
-    apt-get autoclean
+    apt-get install -y --no-install-recommends \
+        autoconf autotools-dev bash-completion build-essential bzip2 ca-certificates \
+        ccache chrpath cmake curl environment-modules flex gettext git-core gnupg2 gzip \
+        iproute2 libgmock-dev libgtest-dev libiberty-dev libpapi-dev libpfm4-dev \
+        libsqlite3-dev libtool libucx-dev locales lsb-release m4 ninja-build \
+        nlohmann-json3-dev pkg-config python3-dev python3-pip software-properties-common \
+        ucx-utils unzip vim wget zip zlib1g-dev && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 
 RUN OS_VERSION=$(grep '^VERSION_ID=' /etc/os-release | cut -d'=' -f2 | tr -d '"') && \
     OS_ID=$(grep '^ID=' /etc/os-release | cut -d'=' -f2 | tr -d '"') && \
@@ -99,18 +101,24 @@ RUN if [ -n "${ROCM_VERSION}" ]; then \
         OS_CODENAME=$(grep '^VERSION_CODENAME=' /etc/os-release | cut -d'=' -f2) && \
         if [ "${OS_CODENAME}" = "bookworm" ]; then OS_CODENAME=jammy; fi && \
         wget -q https://repo.radeon.com/amdgpu-install/${ROCM_VERSION}/ubuntu/${OS_CODENAME}/amdgpu-install_${ROCM_MAJOR}.${ROCM_MINOR}.${ROCM_VERSN}-1_all.deb && \
-        DEBIAN_FRONTEND=noninteractive apt-get install -y --allow-downgrades \
+        apt-get update && \
+        DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --allow-downgrades \
             -o Dpkg::Options::="--force-confnew" \
             ./amdgpu-install_${ROCM_MAJOR}.${ROCM_MINOR}.${ROCM_VERSN}-1_all.deb && \
         rm -f ./amdgpu-install_*.deb && \
         apt-get update && \
         if [ ! -d /opt/rocm ]; then \
-            apt-get install -y rocm-dev; \
+            apt-get install -y --no-install-recommends rocm-dev; \
         fi && \
-        apt-get install -y rocdecode-dev libavformat-dev libavcodec-dev libomp-dev libopenmpi-dev && \
-        apt-get autoclean; \
-    fi
+        apt-get install -y --no-install-recommends rocdecode-dev libavformat-dev libavcodec-dev libomp-dev libopenmpi-dev && \
+        apt-get clean; \
+    fi && \
+    rm -rf /var/lib/apt/lists/*
 
 ENV LC_ALL=C.UTF-8
 WORKDIR /home
 SHELL [ "/bin/bash", "--login", "-c" ]
+
+# Build/development image that runs as root by design.
+# trivy:ignore:DS-0002
+USER root