From 8ac38a0e842c52d1917c9f24aeef0f282de91aeb Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Thu, 26 Feb 2026 11:21:23 +0100 Subject: [PATCH 1/5] chore: Add ubi10 rust builder --- .../update-base-ubi-rust-builders.md | 2 + .github/workflows/ubi-rust-builder.yml | 4 +- ubi10-rust-builder/Dockerfile | 122 ++++++++++++++++++ ubi10-rust-builder/README.md | 31 +++++ 4 files changed, 157 insertions(+), 2 deletions(-) create mode 100644 ubi10-rust-builder/Dockerfile create mode 100644 ubi10-rust-builder/README.md diff --git a/.github/ISSUE_TEMPLATE/update-base-ubi-rust-builders.md b/.github/ISSUE_TEMPLATE/update-base-ubi-rust-builders.md index cb552e447..229f0cb34 100644 --- a/.github/ISSUE_TEMPLATE/update-base-ubi-rust-builders.md +++ b/.github/ISSUE_TEMPLATE/update-base-ubi-rust-builders.md @@ -52,6 +52,7 @@ Add/Change/Remove anything that isn't applicable anymore > checked, the issue can be moved into _Development: Done_. - [ ] Done for [ubi9-rust-builder/Dockerfile](https://github.com/stackabletech/docker-images/blob/main/ubi9-rust-builder/Dockerfile) +- [ ] Done for [ubi10-rust-builder/Dockerfile](https://github.com/stackabletech/docker-images/blob/main/ubi10-rust-builder/Dockerfile) - [ ] Can build the image locally - [ ] Can build an operator image @@ -60,6 +61,7 @@ Add/Change/Remove anything that isn't applicable anymore ```shell docker build -t oci.stackable.tech/sdp/ubi9-rust-builder . -f ubi9-rust-builder/Dockerfile +docker build -t oci.stackable.tech/sdp/ubi10-rust-builder . -f ubi10-rust-builder/Dockerfile # Change directory into the an operator repository and ensure the image can build docker build . -f docker/Dockerfile diff --git a/.github/workflows/ubi-rust-builder.yml b/.github/workflows/ubi-rust-builder.yml index 94638515e..59fa73875 100644 --- a/.github/workflows/ubi-rust-builder.yml +++ b/.github/workflows/ubi-rust-builder.yml @@ -26,7 +26,7 @@ jobs: fail-fast: false matrix: runner: ["ubuntu-latest", "ubicloud-standard-8-arm-ubuntu-2404"] - ubi-version: ["ubi9"] + ubi-version: ["ubi9", "ubi10"] steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: @@ -75,7 +75,7 @@ jobs: strategy: fail-fast: false matrix: - ubi-version: ["ubi9"] + ubi-version: ["ubi9", "ubi10"] steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: diff --git a/ubi10-rust-builder/Dockerfile b/ubi10-rust-builder/Dockerfile new file mode 100644 index 000000000..251afbf47 --- /dev/null +++ b/ubi10-rust-builder/Dockerfile @@ -0,0 +1,122 @@ +# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7 +# check=error=true + +# Find the latest version at https://catalog.redhat.com/en/software/containers/ubi10/ubi-minimal/66f1504a379b9c2cf23e145c#get-the-image +# IMPORTANT: Make sure to use the "Manifest List Digest" that references the images for multiple architectures +# rather than just the "Image Digest" that references the image for the selected architecture. +# The website is broken, so you can use this to find it: +# curl https://catalog.redhat.com/en/software/containers/ubi10/ubi-minimal/66f1504a379b9c2cf23e145c \ +# | grep -oE 'registry.redhat.io/ubi10/ubi-minimal@sha256:[a-z0-9]{64}' +FROM registry.access.redhat.com/ubi10/ubi-minimal@sha256:a74a7a92d3069bfac09c6882087771fc7db59fa9d8e16f14f4e012fe7288554c AS builder + +LABEL maintainer="Stackable GmbH" + +# Pin the rustup version to avoid unexpected breaking changes. +# See https://github.com/rust-lang/rustup/blob/4514d36fcc9c42416176111cd841c86f7ec44b2c/rustup-init.sh#L91 +# Find the latest version here: https://github.com/rust-lang/rustup/blob/master/CHANGELOG.md +# renovate: datasource=github-tags packageName=rust-lang/rustup +ENV RUSTUP_VERSION=1.28.2 +# This SHOULD be kept in sync with operator-templating and other tools to reduce build times +# Find the latest version here: https://doc.rust-lang.org/stable/releases.html +# renovate: datasource=github-releases packageName=rust-lang/rust +ENV RUST_DEFAULT_TOOLCHAIN_VERSION=1.89.0 +# Find the latest version here: https://crates.io/crates/cargo-cyclonedx +# renovate: datasource=crate packageName=cargo-cyclonedx +ENV CARGO_CYCLONEDX_CRATE_VERSION=0.5.7 +# Find the latest version here: https://crates.io/crates/cargo-auditable +# renovate: datasource=crate packageName=cargo-auditable +ENV CARGO_AUDITABLE_CRATE_VERSION=0.7.1 +# Find the latest version here: https://github.com/protocolbuffers/protobuf/releases +# Upload any newer version to nexus with ./.scripts/upload_new_protoc_version.sh +# renovate: datasource=github-releases packageName=protocolbuffers/protobuf +ENV PROTOC_VERSION=31.1 + +# Sets the default shell to Bash with strict error handling and robust pipeline processing. +# "-e": Exits immediately if a command exits with a non-zero status +# "-u": Treats unset variables as an error, preventing unexpected behavior from undefined variables. +# "-o pipefail": Causes a pipeline to return the exit status of the last command in the pipe that failed, ensuring errors in any part of a pipeline are not ignored. +# "-c": Allows the execution of commands passed as a string +# This is automatically inherited in all other Dockerfiles that use this unless it is overwritten +SHELL ["/bin/bash", "-euo", "pipefail", "-c"] + +# We configure microdnf to not install weak dependencies in this file +# Not doing this caused the content of images to become unpredictable because +# based on which packages get updated by `microdnf update` new weak dependencies +# might be installed that were not present earlier (the ubi base image doesn't +# seem to install weak dependencies) +# This also affects the packages that are installed in our Dockerfiles (java as prime +# example). +# https://github.com/stackabletech/docker-images/pull/533 +COPY stackable-base/stackable/dnf.conf /etc/dnf/dnf.conf + +# Update image and install everything needed for Rustup & Rust +RUN microdnf update \ + && microdnf install \ + clang \ + cmake \ + curl-minimal \ + findutils \ + gcc \ + gcc-c++ \ + # krb5 needed for secret-operator + krb5-devel \ + krb5-libs \ + libkadm5 \ + make \ + openssl-devel \ + pkg-config \ + systemd-devel \ + # tar needed to create the source code snapshot before building the Rust code + tar \ + unzip \ + && microdnf clean all \ + && rm -rf /var/cache/yum + +# Container Storage Interface is defined using GRPC/Protobuf, our operators that use it (secret-operator/listener-operator) require +# protoc via Prost (https://github.com/tokio-rs/prost). +WORKDIR /opt/protoc +# Prost does not document which version of protoc it expects (https://docs.rs/prost-build/0.12.4/prost_build/), so this should be the latest upstream version +# (within reason). +RUN ARCH=$(arch | sed 's/^aarch64$/aarch_64/') \ + && curl --fail --location --output protoc.zip "https://repo.stackable.tech/repository/packages/protoc/protoc-${PROTOC_VERSION}-linux-${ARCH}.zip" \ + && unzip protoc.zip \ + && rm protoc.zip +ENV PROTOC=/opt/protoc/bin/protoc +WORKDIR / + +# IMPORTANT +# If you change the toolchain version here, make sure to also change the "rust_version" +# property in operator-templating/config/rust.yaml +RUN < Date: Thu, 26 Feb 2026 11:40:32 +0100 Subject: [PATCH 2/5] chore(ubi-rust-builders): bump dependencies Note: Ignoring protoc (which could go to 34.0, but now it feels too close to the release time to update it). --- ubi10-rust-builder/Dockerfile | 6 +++--- ubi9-rust-builder/Dockerfile | 11 +++++++---- ubi9-rust-builder/README.md | 2 +- 3 files changed, 11 insertions(+), 8 deletions(-) diff --git a/ubi10-rust-builder/Dockerfile b/ubi10-rust-builder/Dockerfile index 251afbf47..753bfd9d6 100644 --- a/ubi10-rust-builder/Dockerfile +++ b/ubi10-rust-builder/Dockerfile @@ -15,17 +15,17 @@ LABEL maintainer="Stackable GmbH" # See https://github.com/rust-lang/rustup/blob/4514d36fcc9c42416176111cd841c86f7ec44b2c/rustup-init.sh#L91 # Find the latest version here: https://github.com/rust-lang/rustup/blob/master/CHANGELOG.md # renovate: datasource=github-tags packageName=rust-lang/rustup -ENV RUSTUP_VERSION=1.28.2 +ENV RUSTUP_VERSION=1.29.0 # This SHOULD be kept in sync with operator-templating and other tools to reduce build times # Find the latest version here: https://doc.rust-lang.org/stable/releases.html # renovate: datasource=github-releases packageName=rust-lang/rust -ENV RUST_DEFAULT_TOOLCHAIN_VERSION=1.89.0 +ENV RUST_DEFAULT_TOOLCHAIN_VERSION=1.93.0 # Find the latest version here: https://crates.io/crates/cargo-cyclonedx # renovate: datasource=crate packageName=cargo-cyclonedx ENV CARGO_CYCLONEDX_CRATE_VERSION=0.5.7 # Find the latest version here: https://crates.io/crates/cargo-auditable # renovate: datasource=crate packageName=cargo-auditable -ENV CARGO_AUDITABLE_CRATE_VERSION=0.7.1 +ENV CARGO_AUDITABLE_CRATE_VERSION=0.7.2 # Find the latest version here: https://github.com/protocolbuffers/protobuf/releases # Upload any newer version to nexus with ./.scripts/upload_new_protoc_version.sh # renovate: datasource=github-releases packageName=protocolbuffers/protobuf diff --git a/ubi9-rust-builder/Dockerfile b/ubi9-rust-builder/Dockerfile index f54a48b85..edfbbcf95 100644 --- a/ubi9-rust-builder/Dockerfile +++ b/ubi9-rust-builder/Dockerfile @@ -3,7 +3,10 @@ # Find the latest version at https://catalog.redhat.com/software/containers/ubi9/ubi-minimal/615bd9b4075b022acc111bf5?container-tabs=gti # IMPORTANT: Be sure to use the Manifest List Digest for multi-arch support -FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:bb08f2300cb8d12a7eb91dddf28ea63692b3ec99e7f0fa71a1b300f2756ea829 AS builder +# The website is broken, so you can use this to find it: +# curl https://catalog.redhat.com/en/software/containers/ubi9/ubi-minimal/615bd9b4075b022acc111bf5 \ +# | grep -oE 'registry.redhat.io/ubi9/ubi-minimal@sha256:[a-z0-9]{64}' +FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:c7d44146f826037f6873d99da479299b889473492d3c1ab8af86f08af04ec8a0 AS builder LABEL maintainer="Stackable GmbH" @@ -11,17 +14,17 @@ LABEL maintainer="Stackable GmbH" # See https://github.com/rust-lang/rustup/blob/4514d36fcc9c42416176111cd841c86f7ec44b2c/rustup-init.sh#L91 # Find the latest version here: https://github.com/rust-lang/rustup/blob/master/CHANGELOG.md # renovate: datasource=github-tags packageName=rust-lang/rustup -ENV RUSTUP_VERSION=1.28.2 +ENV RUSTUP_VERSION=1.29.0 # This SHOULD be kept in sync with operator-templating and other tools to reduce build times # Find the latest version here: https://doc.rust-lang.org/stable/releases.html # renovate: datasource=github-releases packageName=rust-lang/rust -ENV RUST_DEFAULT_TOOLCHAIN_VERSION=1.89.0 +ENV RUST_DEFAULT_TOOLCHAIN_VERSION=1.93.0 # Find the latest version here: https://crates.io/crates/cargo-cyclonedx # renovate: datasource=crate packageName=cargo-cyclonedx ENV CARGO_CYCLONEDX_CRATE_VERSION=0.5.7 # Find the latest version here: https://crates.io/crates/cargo-auditable # renovate: datasource=crate packageName=cargo-auditable -ENV CARGO_AUDITABLE_CRATE_VERSION=0.7.1 +ENV CARGO_AUDITABLE_CRATE_VERSION=0.7.2 # Find the latest version here: https://github.com/protocolbuffers/protobuf/releases # Upload any newer version to nexus with ./.scripts/upload_new_protoc_version.sh # renovate: datasource=github-releases packageName=protocolbuffers/protobuf diff --git a/ubi9-rust-builder/README.md b/ubi9-rust-builder/README.md index 946c1d407..ee593a4d2 100644 --- a/ubi9-rust-builder/README.md +++ b/ubi9-rust-builder/README.md @@ -10,7 +10,7 @@ This will bake in the current stable Rust version at the time this image was bui ## Example usage ```dockerfile -FROM oci.stackable.tech/ubi9-rust-builder AS builder +FROM oci.stackable.tech/sdp/ubi9-rust-builder AS builder FROM registry.access.redhat.com/ubi9/ubi-minimal AS operator LABEL maintainer="Stackable GmbH" From 6b1ddce01f633a9fe4b434b1a62ebd29a5be867e Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Thu, 26 Feb 2026 11:45:56 +0100 Subject: [PATCH 3/5] chore: Update changelog --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 304c146fb..2918754eb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,6 +25,7 @@ All notable changes to this project will be documented in this file. - spark: Add `3.5.8` ([#1414]). - spark-connect-client: Add `3.5.8` ([#1414]). - hbase: Backport HBASE-29797 to all HBAse versions (`2.6.3` and `2.6.4`) ([#1425]). +- ubi10-rust-builder: Add new ubi10 base image for operators to begin using ([#1432]). ### Changed @@ -43,6 +44,7 @@ All notable changes to this project will be documented in this file. Pull logging dependencies with `mvn` instead of `curl` to remove manual maintenance in Nexus `packages`. - hbase: Update `hbase-operator-tools` from `1.3.0-fd5a5fb` to `1.3.0` ([#1425]). - nifi: Backported NiFi-15567 to NiFi 2.6.0 and 2.7.2 to fix CVE CVE-2026-25903 ([#1429]). +- ubi9-rust-builder: Bump rustup, rust toolchain and cargo auditble versions ([#1432]). ### Removed @@ -106,6 +108,7 @@ All notable changes to this project will be documented in this file. [#1426]: https://github.com/stackabletech/docker-images/pull/1426 [#1428]: https://github.com/stackabletech/docker-images/pull/1428 [#1429]: https://github.com/stackabletech/docker-images/pull/1429 +[#1432]: https://github.com/stackabletech/docker-images/pull/1432 ## [25.11.0] - 2025-11-07 From 47ce0bfb37ca421c639a75e7069f6e8531b5c59a Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Thu, 26 Feb 2026 11:55:29 +0100 Subject: [PATCH 4/5] chore(ubi-rust-builders): Revert rustup update Note: The vesion from the changelog hasn't been tagged yet --- CHANGELOG.md | 2 +- ubi10-rust-builder/Dockerfile | 4 ++-- ubi9-rust-builder/Dockerfile | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2918754eb..33a2d7050 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -44,7 +44,7 @@ All notable changes to this project will be documented in this file. Pull logging dependencies with `mvn` instead of `curl` to remove manual maintenance in Nexus `packages`. - hbase: Update `hbase-operator-tools` from `1.3.0-fd5a5fb` to `1.3.0` ([#1425]). - nifi: Backported NiFi-15567 to NiFi 2.6.0 and 2.7.2 to fix CVE CVE-2026-25903 ([#1429]). -- ubi9-rust-builder: Bump rustup, rust toolchain and cargo auditble versions ([#1432]). +- ubi9-rust-builder: Bump rust toolchain and cargo auditable versions ([#1432]). ### Removed diff --git a/ubi10-rust-builder/Dockerfile b/ubi10-rust-builder/Dockerfile index 753bfd9d6..593d0caab 100644 --- a/ubi10-rust-builder/Dockerfile +++ b/ubi10-rust-builder/Dockerfile @@ -13,9 +13,9 @@ LABEL maintainer="Stackable GmbH" # Pin the rustup version to avoid unexpected breaking changes. # See https://github.com/rust-lang/rustup/blob/4514d36fcc9c42416176111cd841c86f7ec44b2c/rustup-init.sh#L91 -# Find the latest version here: https://github.com/rust-lang/rustup/blob/master/CHANGELOG.md +# Find the latest version here: https://github.com/rust-lang/rustup/tags # renovate: datasource=github-tags packageName=rust-lang/rustup -ENV RUSTUP_VERSION=1.29.0 +ENV RUSTUP_VERSION=1.28.2 # This SHOULD be kept in sync with operator-templating and other tools to reduce build times # Find the latest version here: https://doc.rust-lang.org/stable/releases.html # renovate: datasource=github-releases packageName=rust-lang/rust diff --git a/ubi9-rust-builder/Dockerfile b/ubi9-rust-builder/Dockerfile index edfbbcf95..967a590ed 100644 --- a/ubi9-rust-builder/Dockerfile +++ b/ubi9-rust-builder/Dockerfile @@ -12,9 +12,9 @@ LABEL maintainer="Stackable GmbH" # Pin the rustup version to avoid unexpected breaking changes. # See https://github.com/rust-lang/rustup/blob/4514d36fcc9c42416176111cd841c86f7ec44b2c/rustup-init.sh#L91 -# Find the latest version here: https://github.com/rust-lang/rustup/blob/master/CHANGELOG.md +# Find the latest version here: https://github.com/rust-lang/rustup/tags # renovate: datasource=github-tags packageName=rust-lang/rustup -ENV RUSTUP_VERSION=1.29.0 +ENV RUSTUP_VERSION=1.28.2 # This SHOULD be kept in sync with operator-templating and other tools to reduce build times # Find the latest version here: https://doc.rust-lang.org/stable/releases.html # renovate: datasource=github-releases packageName=rust-lang/rust From 369c6ad8cfdff64e5b09fcaa92ae3d30bdea67fe Mon Sep 17 00:00:00 2001 From: Nick Larsen Date: Thu, 26 Feb 2026 11:55:51 +0100 Subject: [PATCH 5/5] chore(nix): Run niv update --- nix/sources.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nix/sources.json b/nix/sources.json index f23de4c0b..09495b69b 100644 --- a/nix/sources.json +++ b/nix/sources.json @@ -5,10 +5,10 @@ "homepage": null, "owner": "NixOS", "repo": "nixpkgs", - "rev": "9f0c42f8bc7151b8e7e5840fb3bd454ad850d8c5", - "sha256": "1h3g9iyfj0xwz7i4ywcxjpp3p9xk7ahp563m0h1i25697sc2lrji", + "rev": "2fc6539b481e1d2569f25f8799236694180c0993", + "sha256": "15bmq6yx1sjjhlwq4b6sqzdifnsghwvh22fg6szp57xf97xivh6h", "type": "tarball", - "url": "https://github.com/NixOS/nixpkgs/archive/9f0c42f8bc7151b8e7e5840fb3bd454ad850d8c5.tar.gz", + "url": "https://github.com/NixOS/nixpkgs/archive/2fc6539b481e1d2569f25f8799236694180c0993.tar.gz", "url_template": "https://github.com///archive/.tar.gz" } }