Repository navigation
Float the base images and update packages at build time (release-2.12) - #2
Merged
Merged
Conversation
Neither base is rebuilt any more: nodejs 18 was last built in June 2025 and nginx 1.22 in January, so floating them would gain nothing. Move to the nodejs 22 and nginx 1.26 images. nodejs 18 also cannot install this branch's lockfile, which needs node 20 or later. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Alex O'Regan <alex.oregan@tigera.io>
A floating base only helps once the registry rebuilds it; updating at build time also picks up errata released since. The update reverts /var/log/nginx to the nginx package's root:root ownership, so the base image's chown is re-applied before dropping back to uid 1001. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Alex O'Regan <alex.oregan@tigera.io>
The update layer was served from the build cache whenever the base image was unchanged, so the image could ship updates days old. Declaring BUILD_DATE ahead of the update makes it re-run when the build passes a new value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Alex O'Regan <alex.oregan@tigera.io>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Alex O'Regan <alex.oregan@tigera.io>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
BUILD_DATE does not invalidate the update layer, allowing stale runtime packages to remain cached.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Updates release-2.12 container bases, runtime packages, and npm dependencies.
Changes:
- Moves build and runtime images to maintained UBI versions.
- Adds runtime package updates and restores nginx log permissions.
- Refreshes audited dependency versions.
| File | Summary |
|---|---|
package-lock.json |
Applies dependency security updates. |
build/Containerfile |
Updates base images and runtime package handling. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+27
to
+29
| ARG BUILD_DATE=unknown | ||
| RUN dnf -y update && \ | ||
| dnf -y clean all |
aaaaaaaalex
added this pull request to stack #4
September 29, 2026 09:39
anthonytwh
approved these changes
Sep 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Links
main: Float the base images and update packages at build time #1pluginAPIversion floor)📝 Description
The same image remediation as #1, for the
release-2.12line, which builds the plugin for OpenShift consoles up to 4.21. Landing it here means release branches cut fromrelease-2.12pick it up.nodejs-18was last built in June 2025 andnginx-122in January. The builder moves toubi9/nodejs-22:latestand the web server toubi9/nginx-126:latest.nodejs-18also cannot install this branch's lockfile, which needs node 20 or later, so the branch did not build before this change./var/log/nginxownership re-applied afterwards: updating nginx resets it toroot:root 0711, and without restoring it the container crash-loops as uid 1001.BUILD_DATEdeclared ahead of it, rather than being served from the build cache.npm audit fix). Shipped dependencies go from 1 high + 7 moderate to 5 moderate. The remaining five are only fixed by console SDK 4.22 orreact-router7, both of which need React 18, and consoles up to 4.21 provide React 17 — so they cannot be fixed on this line.Only
build/Containerfileandpackage-lock.jsonchange.🎥 Demo
Built and run locally with
VERSION=2.12.0:/var/log/nginxowned by1001:0; RHEL 9.8, nginx 1.26.3;plugin-manifest.jsonserved (HTTP 200).loadPluginEntry("forklift-console-plugin@2.12.0", …).Not yet loaded in a live 4.21 console.
📝 CC://
🤖 Generated with Claude Code