From e3f3961246fd5363269b1b193d49765b866179c6 Mon Sep 17 00:00:00 2001
From: Jeff Cantrill <jcantril@redhat.com>
Date: Thu, 3 Sep 2026 10:43:57 -0400
Subject: [PATCH] feat(Dockerfile): modify base to use ubi-micro

This reverts commit 29898c7eca362b7a57b8510b883a332b7bfa2169.
---
 Dockerfile     | 24 +++++++++++++++++-------
 Dockerfile.art | 32 +++++++++++++++++++++-----------
 2 files changed, 38 insertions(+), 18 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index dc4bf8c354a0f..a6e7fffa5b02e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,7 +12,6 @@ RUN INSTALL_PKGS=" \
       llvm \
       cyrus-sasl-devel \
       libtool \
-      crypto-policies-scripts \
       " && \
     dnf install -y $INSTALL_PKGS && \
     rpm -V $INSTALL_PKGS && \
@@ -33,14 +32,25 @@ COPY . /src
 RUN /src/scripts/environment/install-protoc.sh
 RUN make build
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal
+RUN mkdir -p /mnt/rootfs && \
+    dnf install -y --installroot /mnt/rootfs \
+      --releasever 9 \
+      --setopt install_weak_deps=false \
+      --nodocs \
+      systemd \
+      openssl-libs \
+      cyrus-sasl-lib \
+      crypto-policies-scripts \
+      ca-certificates && \
+    dnf --installroot /mnt/rootfs clean all
+
+RUN chroot /mnt/rootfs update-crypto-policies --set DEFAULT:PQ
+
+FROM registry.access.redhat.com/ubi9/ubi-micro
 
-RUN microdnf install -y systemd tar crypto-policies-scripts && \
-    microdnf clean all
+COPY --from=builder /mnt/rootfs/ /
 
-# Copy PQ crypto-policies configuration from builder
-COPY --from=builder /etc/crypto-policies/ /etc/crypto-policies/
+COPY --from=builder /src/target/release/vector /usr/bin/vector
 
-COPY --from=builder /src/target/release/vector /usr/bin
 WORKDIR /usr/bin
 CMD ["/usr/bin/vector"]
diff --git a/Dockerfile.art b/Dockerfile.art
index 8ea731797ee8e..aaafed048faa0 100644
--- a/Dockerfile.art
+++ b/Dockerfile.art
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi9/ubi-minimal AS builder
+FROM registry.access.redhat.com/ubi9/ubi:latest AS builder
 
 RUN INSTALL_PKGS=" \
       gcc-c++ \
@@ -8,12 +8,12 @@ RUN INSTALL_PKGS=" \
       openssl-devel \
       llvm-toolset \
       rust-toolset-1.92.0 \
-      crypto-policies-scripts \
       " && \
-    microdnf install -y $INSTALL_PKGS && \
-    rpm -V $INSTALL_PKGS
+    dnf install -y $INSTALL_PKGS && \
+    rpm -V $INSTALL_PKGS && \
+    dnf clean all
 
-# Enable post-quantum cryptography
+# Enable post-quantum cryptography in builder environment
 RUN update-crypto-policies --set DEFAULT:PQ
 
 COPY . /opt/app-root/src
@@ -27,15 +27,25 @@ RUN make build-offline
 # See: https://github.com/openshift/enhancements/pull/2021
 RUN strip --strip-all /opt/app-root/src/target/release/vector
 
-RUN cp /opt/app-root/src/target/release/vector /usr/bin
+# Install ubi-micro runtime packages into a staging root directory using DNF
+RUN mkdir -p /mnt/rootfs && \
+    dnf install -y --installroot /mnt/rootfs \
+      --releasever 9 \
+      --setopt=install_weak_deps=false \
+      --nodocs \
+      systemd \
+      openssl-libs \
+      crypto-policies-scripts \
+      ca-certificates && \
+    dnf --installroot /mnt/rootfs clean all
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal
+# Configure PQ crypto policy inside the staging root filesystem
+RUN chroot /mnt/rootfs update-crypto-policies --set DEFAULT:PQ
 
-COPY --from=builder /usr/bin/vector /usr/bin/
-RUN microdnf install -y systemd crypto-policies-scripts
+FROM registry.access.redhat.com/ubi9/ubi-micro
 
-# Copy PQ crypto-policies configuration from builder
-COPY --from=builder /etc/crypto-policies/ /etc/crypto-policies/
+COPY --from=builder /mnt/rootfs/ /
+COPY --from=builder /opt/app-root/src/target/release/vector /usr/bin/vector
 
 WORKDIR /usr/bin
 CMD ["/usr/bin/vector"]