diff --git a/anax-in-container/Dockerfile.ubi.amd64 b/anax-in-container/Dockerfile.ubi.amd64 index b28504604..99c3365cf 100644 --- a/anax-in-container/Dockerfile.ubi.amd64 +++ b/anax-in-container/Dockerfile.ubi.amd64 @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9-minimal:latest +FROM registry.access.redhat.com/ubi10-minimal:latest LABEL vendor="IBM" LABEL summary="The agent in a general purpose container." @@ -11,7 +11,7 @@ ARG DOCKER_VER=27.5.1 # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure # Install docker cli, which requires tar / gunzip to unpack, then remove tar / gzip packages # Create required directories -ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip" +ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar gzip" RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \ && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \ && microdnf upgrade -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager krb5-libs \ @@ -22,7 +22,12 @@ RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disablepl && microdnf clean all --disableplugin=subscription-manager \ && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \ && mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \ - && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust + && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust \ + && printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \ + && printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \ + && chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore # add license file COPY LICENSE.txt /licenses @@ -38,5 +43,7 @@ ADD hzn /usr/bin/ WORKDIR /root COPY script/anax.service /root/ +# This is for testing locally. Will remove later. +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD curl -sf http://localhost:8510/status > /dev/null || exit 1 # You can add a 2nd arg to this on the docker run cmd or the CMD statement in another dockerfile, to configure a specific environment ENTRYPOINT ["/root/anax.service", "start"] diff --git a/anax-in-container/Dockerfile.ubi.arm64 b/anax-in-container/Dockerfile.ubi.arm64 index d8abc2a16..b0cc733d3 100644 --- a/anax-in-container/Dockerfile.ubi.arm64 +++ b/anax-in-container/Dockerfile.ubi.arm64 @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9-minimal:latest +FROM registry.access.redhat.com/ubi10-minimal:latest LABEL vendor="IBM" LABEL summary="The agent in a general purpose container." @@ -11,7 +11,7 @@ ARG DOCKER_VER=27.5.1 # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure # Install docker cli, which requires tar / gunzip to unpack, then remove tar / gzip packages # Create required directories -ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip" +ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar gzip curl" RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \ && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \ && curl -4fsSLO https://download.docker.com/linux/static/stable/aarch64/docker-${DOCKER_VER}.tgz \ @@ -21,8 +21,12 @@ RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disable && microdnf clean all --disableplugin=subscription-manager \ && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \ && mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \ - && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust - + && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust \ + && printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \ + && printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \ + && chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore # add license file COPY LICENSE.txt /licenses @@ -37,5 +41,8 @@ ADD hzn /usr/bin/ WORKDIR /root COPY script/anax.service /root/ + +# This is for testing locally. Will remove later. +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD curl -sf http://localhost:8510/status > /dev/null || exit 1 # You can add a 2nd arg to this on the docker run cmd or the CMD statement in another dockerfile, to configure a specific environment ENTRYPOINT ["/root/anax.service", "start"] diff --git a/anax-in-container/Dockerfile.ubi.ppc64el b/anax-in-container/Dockerfile.ubi.ppc64el index d3160b8fe..1534444a6 100644 --- a/anax-in-container/Dockerfile.ubi.ppc64el +++ b/anax-in-container/Dockerfile.ubi.ppc64el @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9-minimal:latest +FROM registry.access.redhat.com/ubi10-minimal:latest LABEL vendor="IBM" LABEL summary="The agent in a general purpose container." @@ -14,7 +14,7 @@ COPY EPEL.repo /etc/yum.repos.d # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure # Install docker cli, which requires tar / gunzip to unpack, then remove tar / gzip packages # Create required directories -ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip" +ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar gzip" RUN microdnf clean all \ && rm -rf /var/cache/dnf /var/cache/PackageKit \ && microdnf update -y libxml2 --nodocs --nobest --setopt=install_weak_deps=0 --disableplugin=subscription-manager \ @@ -26,7 +26,12 @@ RUN microdnf clean all \ && microdnf clean all --disableplugin=subscription-manager \ && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \ && mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \ - && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust + && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust \ + && printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \ + && printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \ + && chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore # add license file COPY LICENSE.txt /licenses @@ -42,5 +47,7 @@ ADD hzn /usr/bin/ WORKDIR /root COPY script/anax.service /root/ +# This is for testing locally. Will remove later. +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD curl -sf http://localhost:8510/status > /dev/null || exit 1 # You can add a 2nd arg to this on the docker run cmd or the CMD statement in another dockerfile, to configure a specific environment ENTRYPOINT ["/root/anax.service", "start"] diff --git a/anax-in-container/Dockerfile.ubi.s390x b/anax-in-container/Dockerfile.ubi.s390x index cd2d4ddbd..c3e6f598c 100644 --- a/anax-in-container/Dockerfile.ubi.s390x +++ b/anax-in-container/Dockerfile.ubi.s390x @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9-minimal:latest +FROM registry.access.redhat.com/ubi10-minimal:latest LABEL vendor="IBM" LABEL summary="The agent in a general purpose container." @@ -11,7 +11,7 @@ ARG DOCKER_VER=18.06.3-ce # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure # Install docker cli, which requires tar / gunzip to unpack, then remove tar / gzip packages # Create required directories -ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar gzip" +ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar gzip" RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \ && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \ && curl -4fsSLO https://download.docker.com/linux/static/stable/s390x/docker-${DOCKER_VER}.tgz \ @@ -21,7 +21,12 @@ RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disable && microdnf clean all --disableplugin=subscription-manager \ && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \ && mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \ - && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust + && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust \ + && printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \ + && printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \ + && chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore # add license file COPY LICENSE.txt /licenses @@ -37,5 +42,7 @@ ADD hzn /usr/bin/ WORKDIR /root COPY script/anax.service /root/ +# This is for testing locally. Will remove later. +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD curl -sf http://localhost:8510/status > /dev/null || exit 1 # You can add a 2nd arg to this on the docker run cmd or the CMD statement in another dockerfile, to configure a specific environment ENTRYPOINT ["/root/anax.service", "start"] diff --git a/anax-in-k8s/Dockerfile.ubi.amd64 b/anax-in-k8s/Dockerfile.ubi.amd64 index cc3efeb97..23a3c8212 100644 --- a/anax-in-k8s/Dockerfile.ubi.amd64 +++ b/anax-in-k8s/Dockerfile.ubi.amd64 @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9-minimal:latest +FROM registry.access.redhat.com/ubi10-minimal:latest LABEL vendor="IBM" LABEL summary="The agent for edge clusters." @@ -8,13 +8,18 @@ LABEL description="The agent in a container that is used solely for the purpose # The anax.service calls jq (from jq) and killall (from psmisc) # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure # Create required directories -ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar" +ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar" RUN microdnf update libxml2 -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \ && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \ && microdnf clean all --disableplugin=subscription-manager \ && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \ && mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \ && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/trust /etc/docker/certs.d \ + && printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \ + && printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \ + && chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore \ && adduser agentuser -u 1000 -U -f -1 -c "agent user,1,2,3" # add license file diff --git a/anax-in-k8s/Dockerfile.ubi.arm64 b/anax-in-k8s/Dockerfile.ubi.arm64 index 50ab8520c..acaa6bd6f 100644 --- a/anax-in-k8s/Dockerfile.ubi.arm64 +++ b/anax-in-k8s/Dockerfile.ubi.arm64 @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9-minimal:latest +FROM registry.access.redhat.com/ubi10-minimal:latest LABEL vendor="IBM" LABEL summary="The agent for edge clusters." @@ -8,13 +8,18 @@ LABEL description="The agent in a container that is used solely for the purpose # The anax.service calls jq (from jq) and killall (from psmisc) # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure # Create required directories -ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng tar" +ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng tar" RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \ && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \ && microdnf clean all --disableplugin=subscription-manager \ && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \ && mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \ && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust /etc/docker/certs.d \ + && printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \ + && printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \ + && chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore \ && adduser agentuser -u 1000 -U -f -1 -c "agent user,1,2,3" # add license file diff --git a/anax-in-k8s/Dockerfile.ubi.ppc64el b/anax-in-k8s/Dockerfile.ubi.ppc64el index 62b645ada..96cec06a8 100644 --- a/anax-in-k8s/Dockerfile.ubi.ppc64el +++ b/anax-in-k8s/Dockerfile.ubi.ppc64el @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9-minimal:latest +FROM registry.access.redhat.com/ubi10-minimal:latest LABEL vendor="IBM" LABEL summary="The agent for edge clusters." @@ -11,7 +11,7 @@ COPY EPEL.repo /etc/yum.repos.d # The anax.service calls jq (from jq) and killall (from psmisc) # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure # Create required directories -ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng" +ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng" RUN microdnf clean all \ && rm -rf /var/cache/dnf /var/cache/PackageKit \ && microdnf update -y libxml2 --nodocs --nobest --setopt=install_weak_deps=0 --disableplugin=subscription-manager \ @@ -20,6 +20,11 @@ RUN microdnf clean all \ && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \ && mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \ && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust /etc/docker/certs.d \ + && printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \ + && printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \ + && chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore \ && adduser agentuser -u 1000 -U -f -1 -c "agent user,1,2,3" # add license file diff --git a/anax-in-k8s/Dockerfile.ubi.s390x b/anax-in-k8s/Dockerfile.ubi.s390x index c9ee17f09..3903d505a 100644 --- a/anax-in-k8s/Dockerfile.ubi.s390x +++ b/anax-in-k8s/Dockerfile.ubi.s390x @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9-minimal:latest +FROM registry.access.redhat.com/ubi10-minimal:latest LABEL vendor="IBM" LABEL summary="The agent for edge clusters." @@ -11,13 +11,18 @@ COPY EPEL.repo /etc/yum.repos.d # The anax.service calls jq (from jq) and killall (from psmisc) # anax does not use iptables directly but the github.com/coreos/go-iptables/iptables dependency needs the directory structure # Create required directories -ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq iptables vim-minimal psmisc procps-ng" +ARG REQUIRED_RPMS="openssl ca-certificates shadow-utils jq nftables vim-minimal psmisc procps-ng" RUN microdnf update -y libxml2 --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager \ && microdnf install -y --nodocs --setopt=install_weak_deps=0 --disableplugin=subscription-manager ${REQUIRED_RPMS} \ && microdnf clean all --disableplugin=subscription-manager \ && rm -rf /mnt/rootfs/var/cache/* /mnt/rootfs/var/log/dnf* /mnt/rootfs/var/log/yum.* \ && mkdir -p /licenses /usr/horizon/bin /usr/horizon/web /var/horizon \ && mkdir -p /etc/horizon/agbot/policy.d /etc/horizon/policy.d /etc/horizon/trust /etc/docker/certs.d \ + && printf '#!/bin/sh\necho "iptables v1.8.7 (nf_tables)"\n' > /usr/sbin/iptables \ + && printf '#!/bin/sh\necho "ip6tables v1.8.7 (nf_tables)"\n' > /usr/sbin/ip6tables \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-save \ + && printf '#!/bin/sh\nexit 0\n' > /usr/sbin/iptables-restore \ + && chmod +x /usr/sbin/iptables /usr/sbin/ip6tables /usr/sbin/iptables-save /usr/sbin/iptables-restore \ && adduser agentuser -u 1000 -U -f -1 -c "agent user,1,2,3" # add license file