CARRY: build Konflux supervisor and CLI images with static glibc instead of musl - #25
Merged
Merged
Conversation
📝 WalkthroughWalkthroughThe CLI and supervisor Dockerfiles replace static musl builds with static glibc builds on UBI9. The builders use GNU Rust targets and Estimated code review effort: 3 (Moderate) | ~25 minutes 🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deploy/docker/Dockerfile.konflux.supervisor`:
- Around line 83-84: Update the runtime stage around the openshell-sandbox COPY
and entrypoint to create and use a dedicated non-root runtime user via USER.
Ensure any required network operations are handled by a narrowly privileged
helper or only the minimal necessary capabilities, while preserving the existing
binary execution behavior.
In `@deploy/konflux/cli/rpms.in.yaml`:
- Around line 15-22: Update the repository declarations in the RPM input
configuration to explicitly include the UBI CDN repository named
ubi-9-codeready-builder-rpms, matching the established declaration in the
supervisor RPM configuration. Ensure this repository is available to
rpm-lockfile-prototype during clean regeneration while preserving the existing
package list.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 2f12adc8-42f4-4971-8055-ac8b2b2b66a1
📒 Files selected for processing (8)
deploy/docker/Dockerfile.konflux.clideploy/docker/Dockerfile.konflux.supervisordeploy/konflux/cli/generic-fetcher.yamldeploy/konflux/cli/rpms.in.yamldeploy/konflux/cli/rpms.lock.yamldeploy/konflux/supervisor/generic-fetcher.yamldeploy/konflux/supervisor/rpms.in.yamldeploy/konflux/supervisor/rpms.lock.yaml
💤 Files with no reviewable changes (2)
- deploy/konflux/supervisor/generic-fetcher.yaml
- deploy/konflux/cli/generic-fetcher.yaml
EmilienM
changed the title
…ead of musl The Konflux (RHEL, hermetic) supervisor and CLI images built their Rust binaries as fully-static musl binaries, which meant building musl libc from source and installing the musl rust-std target. That drove RHEL-219374 (asking Red Hat to ship rust-std-static-musl) and needed a prodsec exception for the from-source musl build. Build both as fully-static glibc binaries instead: install glibc-static from the public UBI9 CodeReady Builder repo and compile the existing GNU target with `-C target-feature=+crt-static`. This removes the musl-from-source stage, the musl rust-std prefetch, and the rust-std-static-musl dependency, so the productized images no longer depend on musl. The binaries remain genuinely fully static (static-PIE, no PT_INTERP, no DT_NEEDED). Static glibc resolves DNS, users, and groups through its built-in default files+dns NSS services, verified working in Alpine, busybox, and UBI containers, so the injected supervisor keeps functioning in non-glibc user containers. Follows upstream NVIDIA#2682, which added the glibc-static build mechanism to the non-Konflux path. Signed-off-by: Emilien Macchi <emacchi@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Konflux (RHEL, hermetic) supervisor and CLI images built their Rust binaries as fully-static musl binaries. That meant building musl libc from source and installing the musl
rust-stdtarget, which drove RHEL-219374 (asking Red Hat to shiprust-std-static-musl) and required a prodsec exception for the from-source musl build.This builds both binaries as fully-static glibc binaries instead: install
glibc-staticfrom the public UBI9 CodeReady Builder repo and compile the existing GNU target with-C target-feature=+crt-static. No musl anywhere, so RHEL-219374 and the prodsec exception are no longer needed.Follows upstream NVIDIA#2682, which added the
glibc-staticmechanism to the non-Konflux build path (it kept musl as the default and did not touch these Konflux images).Related Issue
No GitHub issue: this is midstream productization build tooling (
Dockerfile.konflux.*/deploy/konflux/*exist only in this fork). Driven by RHEL-219374 and follows upstream NVIDIA#2682.Changes
deploy/docker/Dockerfile.konflux.{supervisor,cli}: remove the build-musl-from-source stage;dnf install glibc-static; compile<arch>-unknown-linux-gnuwithRUSTFLAGS="-C target-feature=+crt-static"; update comments and image LABELs (musl → glibc).deploy/konflux/{supervisor,cli}/generic-fetcher.yaml: drop the musl source tarball and bothrust-std-*-muslartifacts. The GNUrust-stdshipped with the toolchain is reused.deploy/konflux/{supervisor,cli}/rpms.in.yaml: addglibc-static; dropgzip(only the musl.tar.gzused it; it remains available transitively). Both declare the CRB repo (ubi-9-codeready-builder-rpms, public UBI CDN) inline, matching the gateway config. The CLI was converged fromrepofiles/base-imageubi.repoto the same inlinerepos:+ in-filearches:+context.bare: trueform, so a cleanrpm-lockfile-prototyperegeneration is repo-explicit and consistent across all three Konflux configs (verified: clean regen reproduces the identical package set withglibc-static/libxcrypt-staticfrom CRB).deploy/konflux/{supervisor,cli}/rpms.lock.yaml: addglibc-static+ its dependencylibxcrypt-staticfor both arches. Entries were produced withrpm-lockfile-prototypeand spliced onto the current lockfile to keep the diff to just these two packages. A full regeneration additionally bumpskernel-headers/libarchive/libgcrypt/tzdatato newer CDN builds; that unrelated drift is left to MintMaker.Testing
openshell-sandboxwith the new mechanism in a UBI9 container →ET_DYNstatic-PIE, noPT_INTERP, noDT_NEEDED,ldd→ "statically linked". There is noopenssl-sys/opensslinCargo.lock(TLS is rustls + aws-lc-rs/ring), so nothing links dynamic OpenSSL.getaddrinfo), users (getpwnam/getpwuid), and groups (getgrnam) successfully in Alpine (musl), busybox, and UBI9 containers. Static glibc links its defaultfiles+dnsNSS services in, so no runtime.sodlopenis needed and the injected supervisor keeps resolving inside non-glibc user containers. The link-timeUsing 'getaddrinfo' in statically linked applications ...warning is expected and does not reflect a runtime failure for the default services./etc/nsswitch.confpointing hostname/user resolution at non-default modules (sss/ldap/mdns/myhostname) is the only case that could differ; standardfiles dnsentries still resolve. This is inherent to any static-glibc binary.glibc-static 2.34-275.el9_8matches the already-pinnedglibc-devel;libxcrypt-static 4.4.18-3.el9is the only added transitive dep; all six edited YAML files parse.mise run e2esandbox path exercised against a non-glibc/distroless user container (per AGENTS.md "Sandbox Infra Changes"), and a check of whether static glibc also resolves thendots:5DNS behavior behind Supervisor's musl DNS resolver fails for external domains in Kubernetes (ndots:5) NVIDIA/OpenShell#2053 (glibc's resolver is expected to handle it, unlike musl).Checklist
architecture/build.mddocuments the unchanged upstream musl build path; the Konflux images have no architecture doc.