From 7c6d56bc5ca862de2372b68db1b5bbed6ad59dae Mon Sep 17 00:00:00 2001 From: Jon Schlueter Date: Tue, 1 Sep 2026 17:13:48 -0400 Subject: [PATCH 1/8] base: sort bindata entries --- containers/base/bindeps.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/containers/base/bindeps.txt b/containers/base/bindeps.txt index c1871e5b..74a16a09 100644 --- a/containers/base/bindeps.txt +++ b/containers/base/bindeps.txt @@ -3,7 +3,7 @@ curl glibc-langpack-en procps-ng python3 +python3-pip sudo util-linux-user which -python3-pip From e66ee7f17048d63f8091a532d1e18b41d9f0fcc7 Mon Sep 17 00:00:00 2001 From: Jon Schlueter Date: Tue, 1 Sep 2026 17:16:56 -0400 Subject: [PATCH 2/8] base: add tzdata rpm and setup /etc/localtime --- containers/base/Containerfile | 1 + containers/base/bindeps.txt | 1 + containers/base/rpms.in.yaml | 1 + 3 files changed, 3 insertions(+) diff --git a/containers/base/Containerfile b/containers/base/Containerfile index f6e64dd7..79f2ab20 100644 --- a/containers/base/Containerfile +++ b/containers/base/Containerfile @@ -84,6 +84,7 @@ RUN touch /usr/local/bin/kolla_extend_start && \ # Fix nsswitch.conf RUN sed -ri '/^(passwd:|group:)/ s/systemd//g' /etc/nsswitch.conf +RUN if [ ! -f "/etc/localtime" ]; then ln -s /usr/share/zoneinfo/Etc/UTC /etc/localtime; fi # Create /openstack directory (convention from tcib) RUN mkdir -p /openstack diff --git a/containers/base/bindeps.txt b/containers/base/bindeps.txt index 74a16a09..998ee421 100644 --- a/containers/base/bindeps.txt +++ b/containers/base/bindeps.txt @@ -5,5 +5,6 @@ procps-ng python3 python3-pip sudo +tzdata util-linux-user which diff --git a/containers/base/rpms.in.yaml b/containers/base/rpms.in.yaml index 14bc5878..20da6014 100644 --- a/containers/base/rpms.in.yaml +++ b/containers/base/rpms.in.yaml @@ -16,5 +16,6 @@ packages: - python3 - python3-pip - sudo + - tzdata - util-linux-user - which From 9470b9ae28be5d2d74baa254d65341059419b891 Mon Sep 17 00:00:00 2001 From: Jon Schlueter Date: Tue, 1 Sep 2026 17:19:01 -0400 Subject: [PATCH 3/8] base: add a couple of downstream only comments Making note that copying in the rpms.repo and openssl-fips-provider-so workaround are upstream only --- containers/base/Containerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/containers/base/Containerfile b/containers/base/Containerfile index 79f2ab20..9650128c 100644 --- a/containers/base/Containerfile +++ b/containers/base/Containerfile @@ -28,6 +28,7 @@ ENV REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem USER root COPY ${CONSTRAINTS_FILE} /deps-upper-constraints.txt +# SKIP IN DOWNSTREAM COPY rpms.repo /etc/yum.repos.d/rpms.repo COPY bindeps.txt /tmp/bindeps.txt @@ -38,6 +39,7 @@ RUN if [ -f "/etc/yum.repos.d/ubi.repo" ]; then rm -f /etc/yum.repos.d/ubi.repo # As this was introduced RHEL only https://redhat.atlassian.net/browse/RHEL-30258 and later bundled differently # for CentOS https://redhat.atlassian.net/browse/RHEL-105298 # remove this until fixed in CentOS-10-stream +# SKIP IN DOWNSTREAM RUN rpm -e openssl-fips-provider-so --nodeps || true RUN pkgs=$(cat /tmp/bindeps.txt | grep -v '^#' | grep -v '^$' | tr '\n' ' ') && \ From aeb25ce7bf14d5689ad0f8a852652b6f00104ee1 Mon Sep 17 00:00:00 2001 From: Jon Schlueter Date: Tue, 1 Sep 2026 17:22:36 -0400 Subject: [PATCH 4/8] base: rotate to use arg UBI_BASE_IMAGE for FROM --- containers/base/Containerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/containers/base/Containerfile b/containers/base/Containerfile index 9650128c..91b368ad 100644 --- a/containers/base/Containerfile +++ b/containers/base/Containerfile @@ -13,7 +13,9 @@ # License for the specific language governing permissions and limitations # under the License. -FROM registry.access.redhat.com/ubi10/ubi-minimal:latest +ARG UBI_BASE_IMAGE=registry.access.redhat.com/ubi10/ubi-minimal:latest + +FROM ${UBI_BASE_IMAGE} LABEL maintainer="OpenStack Kubernetes Operator team" From d60388fefa0e09ce1a0ee4473efed56e58cdc5c2 Mon Sep 17 00:00:00 2001 From: Jon Schlueter Date: Tue, 1 Sep 2026 17:34:27 -0400 Subject: [PATCH 5/8] base: rotate to two stage python builder moved pbr to pythonbuilddep added necessary compilers to build dumb-init which is C based added builddeps with necessary rpms for building build necessary wheels in the builder stage and copy and install them Rotation to support downstream hermetic builds dumb-init is a C based project so it should be in a builder image not just built in the main image and installed --- containers/base/Containerfile | 28 +++++++++++++++++++++++++++- containers/base/builddeps.txt | 5 +++++ containers/base/pythonbuilddeps.txt | 1 + containers/base/pythondeps.txt | 1 - containers/base/rpms.in.yaml | 3 +++ 5 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 containers/base/builddeps.txt create mode 100644 containers/base/pythonbuilddeps.txt diff --git a/containers/base/Containerfile b/containers/base/Containerfile index 91b368ad..253ad53b 100644 --- a/containers/base/Containerfile +++ b/containers/base/Containerfile @@ -15,6 +15,30 @@ ARG UBI_BASE_IMAGE=registry.access.redhat.com/ubi10/ubi-minimal:latest +# --- Build stage: compile wheels from source --- +FROM ${UBI_BASE_IMAGE} AS build + +ARG CONSTRAINTS_FILE=requirements.lock +COPY ${CONSTRAINTS_FILE} /deps-upper-constraints.txt + +# We can force build from source of all packages optionally +ARG PIP_NO_BINARY="" +ENV PIP_NO_BINARY=${PIP_NO_BINARY} + +COPY builddeps.txt /tmp/builddeps.txt +RUN pkgs=$(cat /tmp/builddeps.txt | grep -v '^#' | grep -v '^$' | tr '\n' ' ') && \ + if [ -n "${pkgs}" ]; then microdnf -y install ${pkgs}; microdnf clean all; fi + +COPY pythonbuilddeps.txt /tmp/pythonbuilddeps.txt +RUN pkgs=$(cat /tmp/pythonbuilddeps.txt | grep -v '^#' | grep -v '^$' | tr '\n' ' ') && \ + if [ -n "${pkgs}" ]; then pip3 install --no-cache-dir -c /deps-upper-constraints.txt ${pkgs}; fi + +# Second, build the wheels for the dependencies and place them in a different directory +RUN pip3 wheel --no-cache-dir --no-deps \ + --find-links=/wheels/pkgs \ + --wheel-dir=/wheels/deps -r /deps-upper-constraints.txt + +# --- Runtime stage --- FROM ${UBI_BASE_IMAGE} LABEL maintainer="OpenStack Kubernetes Operator team" @@ -48,12 +72,14 @@ RUN pkgs=$(cat /tmp/bindeps.txt | grep -v '^#' | grep -v '^$' | tr '\n' ' ') && if [ -n "${pkgs}" ]; then microdnf -y install ${pkgs} && microdnf clean all && rm -rf /var/cache/dnf; fi && \ rm /tmp/bindeps.txt +COPY --from=build /wheels /wheels COPY pythondeps.txt /tmp/pythondeps.txt RUN extrapkgs=$(cat /tmp/pythondeps.txt | grep -v '^#' | grep -v '^$' | tr '\n' ' ') && \ pip3 install --no-cache-dir --prefix=/usr \ -c /deps-upper-constraints.txt \ + --find-links=/wheels/deps \ ${extrapkgs} && \ - rm -rf /tmp/pythondeps.txt + rm -rf /wheels /tmp/pythondeps.txt # DNF configuration RUN crudini --set /etc/dnf/dnf.conf main clean_requirements_on_remove True && \ diff --git a/containers/base/builddeps.txt b/containers/base/builddeps.txt new file mode 100644 index 00000000..59b6914b --- /dev/null +++ b/containers/base/builddeps.txt @@ -0,0 +1,5 @@ +# Build dependencies for compiling dumb-init C extension +gcc +python3-devel +python3-pip +python3-wheel diff --git a/containers/base/pythonbuilddeps.txt b/containers/base/pythonbuilddeps.txt new file mode 100644 index 00000000..1d45dc6e --- /dev/null +++ b/containers/base/pythonbuilddeps.txt @@ -0,0 +1 @@ +pbr diff --git a/containers/base/pythondeps.txt b/containers/base/pythondeps.txt index e9feca3b..47e90bc9 100644 --- a/containers/base/pythondeps.txt +++ b/containers/base/pythondeps.txt @@ -1,3 +1,2 @@ crudini -pbr dumb-init diff --git a/containers/base/rpms.in.yaml b/containers/base/rpms.in.yaml index 20da6014..f088e32f 100644 --- a/containers/base/rpms.in.yaml +++ b/containers/base/rpms.in.yaml @@ -11,10 +11,13 @@ arches: packages: - ca-certificates - curl + - gcc - glibc-langpack-en - procps-ng - python3 + - python3-devel - python3-pip + - python3-wheel - sudo - tzdata - util-linux-user From 773124b0ab8166bc15437eb2e186058d20d18024 Mon Sep 17 00:00:00 2001 From: Jon Schlueter Date: Tue, 1 Sep 2026 20:12:12 -0400 Subject: [PATCH 6/8] update buildrequirements.lock.master --- containers/base/buildrequirements.lock.master | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/containers/base/buildrequirements.lock.master b/containers/base/buildrequirements.lock.master index 0b99a463..7f4e2fe8 100644 --- a/containers/base/buildrequirements.lock.master +++ b/containers/base/buildrequirements.lock.master @@ -1,7 +1,7 @@ flit-core==4.0.2 packaging==26.3 -setuptools-scm==10.2.1 -vcs-versioning==2.3.1 +setuptools-scm==10.2.2 +vcs-versioning==2.3.2 wheel==0.48.0 # The following packages are considered to be unsafe in a requirements file: From 9d24fead9609e4e07fbe312e95594c94a5248548 Mon Sep 17 00:00:00 2001 From: Jon Schlueter Date: Wed, 2 Sep 2026 08:54:21 -0400 Subject: [PATCH 7/8] Update containers/base/Containerfile Co-authored-by: Emma Foley --- containers/base/Containerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/containers/base/Containerfile b/containers/base/Containerfile index 253ad53b..513bd880 100644 --- a/containers/base/Containerfile +++ b/containers/base/Containerfile @@ -113,7 +113,7 @@ RUN touch /usr/local/bin/kolla_extend_start && \ chmod 755 /usr/local/bin/kolla_extend_start # Fix nsswitch.conf -RUN sed -ri '/^(passwd:|group:)/ s/systemd//g' /etc/nsswitch.conf +RUN if [ -f "/etc/nsswitch.conf" ]; then sed -ri '/^(passwd:|group:)/ s/systemd//g' /etc/nsswitch.conf; fi RUN if [ ! -f "/etc/localtime" ]; then ln -s /usr/share/zoneinfo/Etc/UTC /etc/localtime; fi # Create /openstack directory (convention from tcib) From e028f761cfff1749c127914360038950669387f8 Mon Sep 17 00:00:00 2001 From: Jon Schlueter Date: Wed, 2 Sep 2026 08:59:27 -0400 Subject: [PATCH 8/8] base: include pbr in pythondeps --- containers/base/pythondeps.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/containers/base/pythondeps.txt b/containers/base/pythondeps.txt index 47e90bc9..0df04681 100644 --- a/containers/base/pythondeps.txt +++ b/containers/base/pythondeps.txt @@ -1,2 +1,3 @@ crudini dumb-init +pbr