Merge pull request #4235 from open-horizon/revert-4228-feat_ubi9_micro

Revert "Use ubi-micro instead of ubi-minimal to reduce the threat surface attack area."

anax-in-container/Dockerfile.alpine.amd64

@@ -11,7 +11,6 @@ ARG DOCKER_VER=19.03.8
 # install docker cli
 # make required directories
 RUN microdnf update -y --nodocs && microdnf clean all && microdnf install --nodocs -y shadow-utils \
-    && microdnf install -y curl \
     && microdnf install --nodocs -y openssl ca-certificates \
     && microdnf install -y wget iptables vim-minimal procps tar \
     && wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 \

anax-in-container/Dockerfile.ubi.amd64

@@ -1,24 +1,9 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent in a general purpose container."
 LABEL description="A container which holds the edge node agent, to be used in environments where there is no operating system package that can install the agent natively."
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 ARG DOCKER_VER=26.1.4
 
 # The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
@@ -30,7 +15,6 @@ ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal
 RUN  microdnf update  -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
   && microdnf upgrade -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager krb5-libs \
-  && microdnf install -y curl \
   && curl -4fsSLO https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VER}.tgz \
   && tar xzvf docker-${DOCKER_VER}.tgz --strip 1 -C /usr/bin docker/docker \
   && rm docker-${DOCKER_VER}.tgz \

anax-in-container/Dockerfile.ubi.arm64

@@ -1,24 +1,9 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent in a general purpose container."
 LABEL description="A container which holds the edge node agent, to be used in environments where there is no operating system package that can install the agent natively."
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 ARG DOCKER_VER=24.0.9
 
 # The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
@@ -29,7 +14,6 @@ ARG DOCKER_VER=24.0.9
 ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip"
 RUN  microdnf update  -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
-  && microdnf install -y curl \
   && curl -4fsSLO https://download.docker.com/linux/static/stable/aarch64/docker-${DOCKER_VER}.tgz \
   && tar xzvf docker-${DOCKER_VER}.tgz --strip 1 -C /usr/bin docker/docker \
   && rm docker-${DOCKER_VER}.tgz \

anax-in-container/Dockerfile.ubi.ppc64el

@@ -1,24 +1,9 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent in a general purpose container."
 LABEL description="A container which holds the edge node agent, to be used in environments where there is no operating system package that can install the agent natively."
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 ARG DOCKER_VER=18.06.3-ce
 
 # add EPEL repo with jq pkg and all deps
@@ -34,7 +19,6 @@ RUN  microdnf clean all \
   && rm -rf /var/cache/dnf /var/cache/PackageKit \
   && microdnf update -y --nodocs --nobest --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
-  && microdnf install -y curl \
   && curl -4fsSLO https://download.docker.com/linux/static/stable/ppc64le/docker-${DOCKER_VER}.tgz \
   && tar xzvf docker-${DOCKER_VER}.tgz --strip 1 -C /usr/bin docker/docker \
   && rm docker-${DOCKER_VER}.tgz \

anax-in-container/Dockerfile.ubi.s390x

@@ -1,24 +1,9 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent in a general purpose container."
 LABEL description="A container which holds the edge node agent, to be used in environments where there is no operating system package that can install the agent natively."
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 ARG DOCKER_VER=18.06.3-ce
 
 # The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
@@ -29,7 +14,6 @@ ARG DOCKER_VER=18.06.3-ce
 ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip"
 RUN  microdnf update  -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
-  && microdnf install -y curl \
   && curl -4fsSLO https://download.docker.com/linux/static/stable/s390x/docker-${DOCKER_VER}.tgz \
   && tar xzvf docker-${DOCKER_VER}.tgz --strip 1 -C /usr/bin docker/docker \
   && rm docker-${DOCKER_VER}.tgz \

anax-in-container/Dockerfile_agbot.ubi

@@ -1,24 +1,9 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The deployment engine."
 LABEL description="The Agbot scans all the edge nodes in the system initiating deployment of services and model to all eligible nodes."
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 # The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
 # The anax.service calls jq (from jq) and killall (from psmisc)
 # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
@@ -27,7 +12,6 @@ COPY --from=base /etc/pki /etc/pki/
 # Create required directories
 ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng gettext"
 RUN  microdnf update  -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
-  && microdnf install -y curl \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
   && microdnf upgrade -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager krb5-libs \
   && microdnf clean all --disableplugin=subscription-manager \

anax-in-k8s/Dockerfile.ubi.amd64

@@ -1,31 +1,15 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent for edge clusters."
 LABEL description="The agent in a container that is used solely for the purpose of running the agent in a kubernetes edge cluster."
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 # The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
 # The anax.service calls jq (from jq) and killall (from psmisc)
 # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
 # Create required directories
 ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar"
 RUN  microdnf update  -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
-  && microdnf install -y curl \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
   && microdnf clean all --disableplugin=subscription-manager \
   && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \

anax-in-k8s/Dockerfile.ubi.arm64

@@ -1,31 +1,15 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent for edge clusters."
 LABEL description="The agent in a container that is used solely for the purpose of running the agent in a kubernetes edge cluster."
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 # The anax binary (secrets manager code) shells out to groupadd, groupdel (from shadow-utils), pkill (from procps-ng)
 # The anax.service calls jq (from jq) and killall (from psmisc)
 # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure
 # Create required directories
 ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar"
 RUN  microdnf update  -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
-  && microdnf install -y curl \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
   && microdnf clean all --disableplugin=subscription-manager \
   && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \

anax-in-k8s/Dockerfile.ubi.auto-upgrade-cron.amd64

@@ -1,24 +1,9 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent auto upgrade cron job for edge clusters."
 LABEL description=""
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 # The build calls adduser (from shadow-utils)
 # The auto-upgrade-cronjob.sh calls jq (from jq)
 # Download kubectl
@@ -28,7 +13,6 @@ ARG REQUIRED_RPMS="shadow-utils jq"
 RUN  microdnf update  -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
   && microdnf clean all --disableplugin=subscription-manager \
-  && microdnf install -y curl \
   && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
   && curl -4LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl \
   && chmod +x ./kubectl \

anax-in-k8s/Dockerfile.ubi.auto-upgrade-cron.arm64

@@ -1,24 +1,9 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent auto upgrade cron job for edge clusters."
 LABEL description=""
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 # The build calls adduser (from shadow-utils)
 # The auto-upgrade-cronjob.sh calls jq (from jq)
 # Download kubectl
@@ -28,7 +13,6 @@ ARG REQUIRED_RPMS="shadow-utils jq"
 RUN  microdnf update  -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
   && microdnf clean all --disableplugin=subscription-manager \
-  && microdnf install -y curl \
   && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
   && curl -4LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/arm64/kubectl \
   && chmod +x ./kubectl \

anax-in-k8s/Dockerfile.ubi.auto-upgrade-cron.ppc64el

@@ -1,24 +1,9 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent auto upgrade cron job for edge clusters."
 LABEL description=""
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 # add EPEL repo with jq pkg and all deps
 COPY EPEL.repo /etc/yum.repos.d
 
@@ -33,7 +18,6 @@ RUN microdnf clean all \
   && microdnf update -y --nodocs --nobest --setopt=install_weak_deps=0 --disableplugin=subscription-manager \ 
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
   && microdnf clean all --disableplugin=subscription-manager \
-  && microdnf install -y curl \
   && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
   && curl -4LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/ppc64le/kubectl \
   && chmod +x ./kubectl \

anax-in-k8s/Dockerfile.ubi.auto-upgrade-cron.s390x

@@ -1,24 +1,9 @@
-# Building microdnf from ubi9-minimal base
-FROM registry.access.redhat.com/ubi9-minimal:latest AS base
-
-#---------------------------------------------------------------
-FROM registry.access.redhat.com/ubi9-micro:latest AS runtime
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
 
 LABEL vendor="IBM"
 LABEL summary="The agent auto upgrade cron job for edge clusters."
 LABEL description=""
 
-# Copy microdnf necessary files from the base stage
-COPY --from=base /usr/bin/microdnf /usr/bin/
-COPY --from=base /usr/bin/gpg /usr/bin/
-COPY --from=base /usr/bin/gpg2 /usr/bin/
-COPY --from=base /lib64 /lib64/
-COPY --from=base /usr/lib64 /usr/lib64/
-COPY --from=base /usr/lib/rpm /usr/lib/rpm/
-COPY --from=base /etc/dnf /etc/dnf/
-COPY --from=base /etc/rpm /etc/rpm/
-COPY --from=base /etc/pki /etc/pki/
-
 # add EPEL repo with jq pkg and all deps
 COPY EPEL.repo /etc/yum.repos.d
 
@@ -31,7 +16,6 @@ ARG REQUIRED_RPMS="shadow-utils jq"
 RUN  microdnf update  -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \
   && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \
   && microdnf clean all --disableplugin=subscription-manager \
-  && microdnf install -y curl \
   && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \
   && curl -4LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/s390x/kubectl \
   && chmod +x ./kubectl \