OCPBUGS-77414: simplify dockerfile by removing cachito dependencies#356
Conversation
Remove Cachito dependency management from build process to use direct npm installation. This eliminates the need for remote sources and associated environment variables while disabling Cypress binary installation to reduce build overhead. Key changes: - Remove REMOTE_SOURCES copy and environment setup - Switch to direct npm installation with CYPRESS_INSTALL_BINARY=0 - Fix typo in comment: 'none-root' → 'non-root' - Standardize package manager usage to dnf consistently
WalkthroughDockerfile.art was updated to simplify the builder stage by removing Cachito-based dependency management and replacing it with direct npm commands. The package manager was changed from yum to dnf, and a comment typo was corrected. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile.art`:
- Around line 14-19: The DNF cleanup is not in the conventional
scanner-acceptable form, causing Trivy DS-0019; update the RUN that installs
packages (the block installing nginx) so after dnf install you explicitly run
dnf clean all and then remove DNF caches (e.g., rm -rf /var/cache/dnf) before
the chown/chmod steps; keep the install command (INSTALL_PKGS/nginx) and the
subsequent rpm -V check but reorder/append the explicit cache removal so
scanners reliably detect cleanup.
ℹ️ Review info
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
Dockerfile.art
| RUN INSTALL_PKGS="nginx" && \ | ||
| dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \ | ||
| rpm -V $INSTALL_PKGS && \ | ||
| yum -y clean all --enablerepo='*' && \ | ||
| dnf -y clean all --enablerepo='*' && \ | ||
| chown -R 1001:0 /var/lib/nginx /var/log/nginx /run && \ | ||
| chmod -R ug+rwX /var/lib/nginx /var/log/nginx /run |
There was a problem hiding this comment.
Make DNF cleanup scanner-compliant to avoid CI/security gate failures.
Line 17 still triggers Trivy DS-0019 in this PR context. Even if cleanup is logically present, use the conventional dnf clean all + cache directory removal pattern to satisfy scanners consistently.
Proposed fix
RUN INSTALL_PKGS="nginx" && \
dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \
rpm -V $INSTALL_PKGS && \
- dnf -y clean all --enablerepo='*' && \
+ dnf -y clean all && \
+ rm -rf /var/cache/dnf && \
chown -R 1001:0 /var/lib/nginx /var/log/nginx /run && \
chmod -R ug+rwX /var/lib/nginx /var/log/nginx /run📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN INSTALL_PKGS="nginx" && \ | |
| dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \ | |
| rpm -V $INSTALL_PKGS && \ | |
| yum -y clean all --enablerepo='*' && \ | |
| dnf -y clean all --enablerepo='*' && \ | |
| chown -R 1001:0 /var/lib/nginx /var/log/nginx /run && \ | |
| chmod -R ug+rwX /var/lib/nginx /var/log/nginx /run | |
| RUN INSTALL_PKGS="nginx" && \ | |
| dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \ | |
| rpm -V $INSTALL_PKGS && \ | |
| dnf -y clean all && \ | |
| rm -rf /var/cache/dnf && \ | |
| chown -R 1001:0 /var/lib/nginx /var/log/nginx /run && \ | |
| chmod -R ug+rwX /var/lib/nginx /var/log/nginx /run |
🧰 Tools
🪛 Trivy (0.69.1)
[error] 14-19: 'dnf clean all' missing
'dnf clean all' is missed: INSTALL_PKGS="nginx" && dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && rpm -V $INSTALL_PKGS && dnf -y clean all --enablerepo='*' && chown -R 1001:0 /var/lib/nginx /var/log/nginx /run && chmod -R ug+rwX /var/lib/nginx /var/log/nginx /run
Rule: DS-0019
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile.art` around lines 14 - 19, The DNF cleanup is not in the
conventional scanner-acceptable form, causing Trivy DS-0019; update the RUN that
installs packages (the block installing nginx) so after dnf install you
explicitly run dnf clean all and then remove DNF caches (e.g., rm -rf
/var/cache/dnf) before the chown/chmod steps; keep the install command
(INSTALL_PKGS/nginx) and the subsequent rpm -V check but reorder/append the
explicit cache removal so scanners reliably detect cleanup.
There was a problem hiding this comment.
Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!
lgarciaaco
changed the title
openshift-ci-robot
added
jira/severity-critical
|
@lgarciaaco: This pull request references Jira Issue OCPBUGS-77414, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@lgarciaaco: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: lgarciaaco, upalatucci The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
@lgarciaaco: Jira Issue OCPBUGS-77414: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-77414 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
4 participants
Summary
Simplified Dockerfile.art by removing Cachito dependency management and using standard npm ci workflow.
Changes
Summary by CodeRabbit