Update UBI 9 base image to 9.8-1785906690

[clcollins]

Summary

• Bump builder stage from ubi9:9.7-1778044007 to ubi9:9.8-1785906690
• Bump runtime stage from ubi9:9.8-1781496985 to ubi9:9.8-1785906690
• Picks up go-toolset 1.26.5-1.el9_8 (from 1.26.3), enabling downstream operators to build with Go 1.26.5
• Includes latest RPM security fixes

Test plan

• Boilerplate image builds successfully
• go version in built image reports 1.26.5
• Downstream operator builds pass with updated boilerplate

🤖 Created with assistance from Claude claude@anthropic.com

Summary by CodeRabbit

• Chores
  • Updated the application’s container base images to a newer UBI9 build.
  • Preserved existing build tooling installation and verification steps.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0e03cb4d-faa1-4939-804b-7c11590b6338

📥 Commits

Reviewing files that changed from the base of the PR and between d5a1587 and d97f0e1.

📒 Files selected for processing (1)

• config/Dockerfile

🚧 Files skipped from review as they are similar to previous changes (1)

• config/Dockerfile

---

Walkthrough

The Dockerfile updates the UBI9 base image tag in both builder and runtime stages. Other Docker build and runtime instructions remain unchanged.

Changes

UBI9 image refresh

Layer / File(s)	Summary
Update builder and runtime images config/Dockerfile	Both stages use UBI9 9.8-1785906690 instead of 9.8-1781496985.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: psav, xiaoyu74

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the update to the UBI 9 base image used by the builder and runtime images.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only two UBI image references in config/Dockerfile; it adds or modifies no Ginkgo tests or test titles.
Test Structure And Quality	✅ Passed	The pull request changes only two UBI image references in config/Dockerfile and adds no Ginkgo test code, so this test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	The pull request changes only two UBI image references in config/Dockerfile; it adds no Ginkgo e2e tests or MicroShift API usage.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit changes only config/Dockerfile; it adds no Ginkgo e2e tests or other test code that could assume a multi-node cluster.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only two UBI9 image references in config/Dockerfile; it adds no deployment manifests, operator code, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The commit changes only config/Dockerfile. Process-level Go code has no stdout writes or klog usage; Ginkgo suite logging targets GinkgoWriter.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only config/Dockerfile and adds no Ginkgo e2e tests, so IPv6 or disconnected test compatibility is not applicable.
No-Weak-Crypto	✅ Passed	The PR only changes two UBI9 image tags; the patch adds no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison code.
Container-Privileges	✅ Passed	The PR changes only two UBI9 FROM tags. It adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root directives.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only two UBI image references; no logging code or sensitive data was added. Existing checksum echoes contain public integrity hashes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (1)

config/Dockerfile (1)

31-31: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Security Misconfiguration (CWE-16)

Reachability: Internal · Exploitability: Theoretical

Document the approved CI build-image exception.

config/Dockerfile produces a published CI build image, so its Go tools are intentional. Document the approved exception. If this image is used at runtime, move the CI toolchain to a separate image.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/Dockerfile` at line 31, Document the approved exception alongside the
config/Dockerfile base image, explaining that the published CI build image
intentionally includes Go tooling. If this Dockerfile is also used for runtime
workloads, separate the CI toolchain into a dedicated image instead.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@config/Dockerfile`:
- Line 31: Add a suitable HEALTHCHECK instruction to the Dockerfile based on the
one-shot CI command usage, or document the approved exception directly if health
checks are intentionally inappropriate. Keep the existing base image and
container behavior unchanged.
- Around line 4-6: Update the final-stage GOCILINT_VERSION declaration to
v2.12.2 so it matches the builder-stage version used by GOCILINT_LOCATION; leave
the checksum and download URL configuration unchanged.
- Line 2: Update both UBI9 base-image declarations in config/Dockerfile at lines
2-2 and 31-31, replacing the pinned 9.8-1785906690 tag with the approved
floating UBI9 tag so both builder and runtime stages receive managed updates.

---

Nitpick comments:
In `@config/Dockerfile`:
- Line 31: Document the approved exception alongside the config/Dockerfile base
image, explaining that the published CI build image intentionally includes Go
tooling. If this Dockerfile is also used for runtime workloads, separate the CI
toolchain into a dedicated image instead.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b0a4e6a4-03bf-4d64-ab2d-f7bbc992a7f9

📥 Commits

Reviewing files that changed from the base of the PR and between d5a1587 and 1e7c65c.

⛔ Files ignored due to path filters (2)

• boilerplate/openshift/golang-lint/ensure.sh is excluded by !boilerplate/**
• boilerplate/openshift/golang-osd-operator/ensure.sh is excluded by !boilerplate/**

📒 Files selected for processing (1)

• config/Dockerfile

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[joshbranham]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clcollins, joshbranham

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [clcollins,joshbranham]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment