From 24d9d417069ad872b49e99481bc3fc043db5190e Mon Sep 17 00:00:00 2001
From: jbtrystram <jbtrystram@redhat.com>
Date: Tue, 15 Sep 2026 10:49:59 +0200
Subject: [PATCH] Containerfile: use hummingbird base images

Use hardenned images from the hummingbird project.

Containerfile : install util-linux-core in runtime

The `nsenter` binary is required as it's called before calling
`bootc status`. Let's install the RPM that ships it into the runtime
image.
This is not great as it pulls a lot of dependencies, so later on we
should probably do that in go.

Also make the containerfile use build args so we can use overrides to
pul the hummingbird images from another repo

Signed-off-by: jbtrystram <jbtrystram@redhat.com>
---
 Containerfile | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/Containerfile b/Containerfile
index a0d6f175..afcda61b 100644
--- a/Containerfile
+++ b/Containerfile
@@ -1,9 +1,25 @@
-FROM quay.io/fedora/fedora-minimal:44 AS buildroot
-ARG DNF_FLAGS="-y --setopt=install_weak_deps=False"
+ARG GO_BUILDER_IMAGE=quay.io/hummingbird/go:1.26.8-builder
+ARG CORE_RUNTIME_IMAGE=quay.io/hummingbird/core-runtime:2.43
+
+
+FROM ${GO_BUILDER_IMAGE} AS deps
+# We pull required dependencies and overlay them
+# on top of the runtime image
+ARG DNF_FLAGS="-y --setopt=install_weak_deps=False --nodocs"
 RUN --mount=type=cache,id=dnf,target=/var/cache/libdnf5 \
-    dnf install ${DNF_FLAGS} golang
+    mkdir -p /staged &&\
+    dnf install -y \
+        --use-host-config \
+        --installroot=/staged \
+        util-linux-core && \
+    # Remove metadata and manpages
+    rm -rf /staged/var/lib/dnf \
+        /staged/var/log/* \
+        /staged/var/lib/rpm \
+        /staged/usr/share/{man,doc,locale}
+
+FROM ${GO_BUILDER_IMAGE} AS builder
 
-FROM buildroot as builder
 ARG VERSION=dev
 ARG GIT_COMMIT=unknown
 WORKDIR /workspace
@@ -17,7 +33,8 @@ RUN --mount=type=cache,id=gomod,target=/root/go/pkg/mod \
     go build -ldflags "${LDFLAGS}" -o manager ./cmd/controller/ && \
     go build -ldflags "${LDFLAGS}" -o daemon ./cmd/daemon/
 
-FROM quay.io/fedora/fedora-minimal:44
+FROM ${CORE_RUNTIME_IMAGE}
+COPY --from=deps /staged/usr /usr
 COPY --from=builder /workspace/manager /workspace/daemon /usr/local/bin/
 USER 65532:65532
 ENTRYPOINT ["manager"]