chore(images): refresh base packages with microdnf update during build

Run 'microdnf update -y --nodocs' before installing additional packages
in every component Dockerfile that derives from a UBI base, mirroring
what we already do in image-pgadmin. This guarantees the resulting
image picks up RHEL Z-stream errata that landed after ubi-minimal was
last republished, instead of inheriting whatever vulnerable versions
happened to be baked into the parent layer.

Files updated:
  * components/image-collector/Dockerfile
  * components/image-pgbackrest/Dockerfile
  * components/image-pgbouncer/Dockerfile
  * components/image-postgres/Dockerfile.postgres
  * components/image-postgres/Dockerfile.postgres-upgrade
  * components/image-postgres/Dockerfile.postgis

This matches the equivalent change already present in the internal
Crunchy build of these images.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ValClarkson

components/image-collector/Dockerfile

@@ -34,6 +34,7 @@ FROM registry.access.redhat.com/ubi9/ubi-minimal
 COPY --from=build --chmod=0777 /otelcol-contrib /otelcol-contrib
 COPY --from=build /licenses /licenses
 
-RUN microdnf install -y 'logrotate' 'procps-ng'
+RUN microdnf update -y --nodocs \
+ && microdnf install -y 'logrotate' 'procps-ng'
 
 USER 2

components/image-pgbackrest/Dockerfile

@@ -38,6 +38,7 @@ RUN rpm -ivh \
 # Delete the repo file as it is large and unneeded.
 ARG PGBACKREST_VERSION
 RUN rpm -ivh "https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-$(arch)/pgdg-redhat-repo-latest.noarch.rpm" \
+ && microdnf update -y --nodocs \
  && microdnf install -y --nodocs --setopt install_weak_deps=0 'shadow-utils' \
  && groupadd --gid 26 postgres \
  && useradd  --gid 26 --uid 26 --no-log-init postgres \

components/image-pgbouncer/Dockerfile

@@ -8,6 +8,7 @@ ARG PGBOUNCER_VERSION=1.24.1
 
 # The c-ares package is in the rhel-9-for-$(arch)-baseos-rpms repo, so we must enable it
 RUN rpm -ivh "https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-$(arch)/pgdg-redhat-repo-latest.noarch.rpm" \
+ && microdnf update -y --nodocs \
  && microdnf install -y --nodocs --setopt install_weak_deps=0 \
  --enablerepo="rhel-9-for-$(arch)-baseos-rpms" \
  "pgbouncer-${PGBOUNCER_VERSION}" \

components/image-postgres/Dockerfile.postgis

@@ -26,6 +26,10 @@ rpm -ivh "https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-$(arch)/pg
 # Disable module to avoid conflicts
 microdnf --assumeyes module disable postgresql || true
 
+# Refresh base packages so any CVE patches that landed in the upstream
+# repos after the parent crunchy-postgres image was built are picked up.
+microdnf update -y --nodocs
+
 microdnf install -y --nodocs --setopt install_weak_deps=0 \
     --enablerepo="codeready-builder-for-rhel-9-$(arch)-rpms" \
     perl \

components/image-postgres/Dockerfile.postgres

@@ -32,6 +32,11 @@ rpm -ivh "https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
 # Disable the built-in PostgreSQL module to avoid conflicts with PGDG packages
 microdnf --assumeyes module disable postgresql || true
 
+# Refresh all base-image packages against the current RHEL/EPEL/PGDG repos so
+# the build picks up CVE patches that landed after ubi-minimal was last
+# republished.
+microdnf update -y --nodocs
+
 # Ensure complete timezone database is present (some minimal UBI layers
 # can have tzdata partially pruned); reinstall guarantees fresh /usr/share/zoneinfo
 microdnf reinstall -y --nodocs 'tzdata'

components/image-postgres/Dockerfile.postgres-upgrade

@@ -18,6 +18,10 @@ rpm -ivh "https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-$(arch)/pg
 # Disable module to avoid conflicts
 microdnf --assumeyes module disable postgresql || true
 
+# Refresh base packages so any CVE patches that landed in the upstream
+# repos after the parent crunchy-postgres image was built are picked up.
+microdnf update -y --nodocs
+
 # Build package list for all target versions
 PKGS="$(for POSTGRES_VERSION in ${POSTGRES_UPGRADE_VERSIONS}; do
 POSTGRES_MAJOR_VERSION="${POSTGRES_VERSION%.*}"