From 77c45900019f8a5e42e1ae274c6337b4f9b8d2b1 Mon Sep 17 00:00:00 2001
From: jbtrystram <jbtrystram@redhat.com>
Date: Tue, 15 Sep 2026 10:49:59 +0200
Subject: [PATCH] Containerfile: use hummingbird base images

Use hardenned images from the hummingbird project.

Containerfile : install util-linux-core in runtime

The `nsenter` binary is required as it's called before calling
`bootc status`. Let's install the RPM that ships it into the runtime
image.
This is not great as it pulls a lot of dependencies, so later on we
should probably do that in go.

Also make the containerfile use build args so we can use overrides to
pul the hummingbird images from another repo

Signed-off-by: jbtrystram <jbtrystram@redhat.com>
(cherry picked from commit a6249f1b3a8df1eb0d7dad50f0d4d338d66e0990)
---
 Containerfile | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/Containerfile b/Containerfile
index a0d6f175..afcda61b 100644
--- a/Containerfile
+++ b/Containerfile
@@ -1,9 +1,25 @@
-FROM quay.io/fedora/fedora-minimal:44 AS buildroot
-ARG DNF_FLAGS="-y --setopt=install_weak_deps=False"
+ARG GO_BUILDER_IMAGE=quay.io/hummingbird/go:1.26.8-builder
+ARG CORE_RUNTIME_IMAGE=quay.io/hummingbird/core-runtime:2.43
+
+
+FROM ${GO_BUILDER_IMAGE} AS deps
+# We pull required dependencies and overlay them
+# on top of the runtime image
+ARG DNF_FLAGS="-y --setopt=install_weak_deps=False --nodocs"
 RUN --mount=type=cache,id=dnf,target=/var/cache/libdnf5 \
-    dnf install ${DNF_FLAGS} golang
+    mkdir -p /staged &&\
+    dnf install -y \
+        --use-host-config \
+        --installroot=/staged \
+        util-linux-core && \
+    # Remove metadata and manpages
+    rm -rf /staged/var/lib/dnf \
+        /staged/var/log/* \
+        /staged/var/lib/rpm \
+        /staged/usr/share/{man,doc,locale}
+
+FROM ${GO_BUILDER_IMAGE} AS builder
 
-FROM buildroot as builder
 ARG VERSION=dev
 ARG GIT_COMMIT=unknown
 WORKDIR /workspace
@@ -17,7 +33,8 @@ RUN --mount=type=cache,id=gomod,target=/root/go/pkg/mod \
     go build -ldflags "${LDFLAGS}" -o manager ./cmd/controller/ && \
     go build -ldflags "${LDFLAGS}" -o daemon ./cmd/daemon/
 
-FROM quay.io/fedora/fedora-minimal:44
+FROM ${CORE_RUNTIME_IMAGE}
+COPY --from=deps /staged/usr /usr
 COPY --from=builder /workspace/manager /workspace/daemon /usr/local/bin/
 USER 65532:65532
 ENTRYPOINT ["manager"]