From 530954515f998ff82998aad2da0f80457dcd1d34 Mon Sep 17 00:00:00 2001
From: Jeff Cantrill <jcantril@redhat.com>
Date: Wed, 26 Aug 2026 10:42:35 -0400
Subject: [PATCH] feat(Dockerfile): modify base to use ubi-micro to reduce
 attack vectors

---
 Dockerfile     | 30 +++++++++++++++++-------------
 Dockerfile.art | 25 +++++++++++++++----------
 2 files changed, 32 insertions(+), 23 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 81ff013d8..67ca02788 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,20 +17,26 @@ COPY ./must-gather ./must-gather
 USER 0
 RUN make build
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal
-
-RUN INSTALL_PKGS=" \
-      openssl \
+FROM registry.access.redhat.com/ubi9/ubi:latest AS packages
+
+# Install ubi-micro runtime packages into a staging root directory using DNF
+RUN mkdir -p /mnt/rootfs && \
+    dnf install -y --installroot /mnt/rootfs \
+      --releasever 9 \
+      --setopt=install_weak_deps=false \
+      --nodocs \
+      openssl-libs \
+      ca-certificates \
       rsync \
       file \
-      xz \
-      " && \
-    microdnf install -y ${INSTALL_PKGS} && \
-    rpm -V ${INSTALL_PKGS} && \
-    microdnf clean all && \
-    mkdir /tmp/ocp-clo && \
-    chmod og+w /tmp/ocp-clo
+      xz && \
+    dnf --installroot /mnt/rootfs clean all && \
+    mkdir -p /mnt/rootfs/tmp/ocp-clo && \
+    chmod og+w /mnt/rootfs/tmp/ocp-clo
+
+FROM registry.access.redhat.com/ubi9/ubi-micro
 
+COPY --from=packages /mnt/rootfs/ /
 COPY --from=builder /opt/app-root/src/bin/cluster-logging-operator /usr/bin/
 COPY --from=builder /opt/app-root/src/bin/must-gather /usr/bin/
 
@@ -50,5 +56,3 @@ LABEL \
         name="openshift-logging/cluster-logging-rhel9-operator" \
         com.redhat.component="cluster-logging-operator-container" \
         io.openshift.maintainer.product="OpenShift Container Platform" \
-
-
diff --git a/Dockerfile.art b/Dockerfile.art
index c4fb941ab..9b9ad6d9b 100644
--- a/Dockerfile.art
+++ b/Dockerfile.art
@@ -8,19 +8,24 @@ WORKDIR /opt/app-root/src
 
 RUN make build BUILD_OPTS="-tags strictfipsruntime"
 
-FROM registry.redhat.io/ubi9/ubi-minimal:9.7
-
-RUN INSTALL_PKGS=" \
+# Install ubi-micro runtime packages into a staging root directory using DNF
+RUN mkdir -p /mnt/rootfs && \
+    dnf install -y --installroot /mnt/rootfs \
+      --releasever 9 \
+      --setopt=install_weak_deps=false \
+      --nodocs \
+      openssl-libs \
+      ca-certificates \
       rsync \
       file \
-      xz \
-      " && \
-    microdnf install -y $INSTALL_PKGS && \
-    rpm -V $INSTALL_PKGS && \
-    microdnf clean all && \
-    mkdir /tmp/ocp-clo && \
-    chmod og+w /tmp/ocp-clo
+      xz && \
+    dnf --installroot /mnt/rootfs clean all && \
+    mkdir -p /mnt/rootfs/tmp/ocp-clo && \
+    chmod og+w /mnt/rootfs/tmp/ocp-clo
+
+FROM registry.redhat.io/ubi9/ubi-micro:9.8
 
+COPY --from=builder /mnt/rootfs/ /
 COPY --from=builder /opt/app-root/src/bin/cluster-logging-operator /usr/bin/
 COPY --from=builder /opt/app-root/src/bin/must-gather /usr/bin/