Add ubi-base based on ubi10 by akurinnoy · Pull Request #237 · devfile/developer-images

akurinnoy · 2025-09-19T09:15:47Z

This PR introduces new ubi-base image based on ubi10. It adds GH workflows for production builds and for PR validations. Building UDI based on ubi10 is disabled so far.

This PR also enhances GH workflows to make them fork-friendly:

env:
  REGISTRY: ${{ vars.REGISTRY || 'quay.io/devfile' }}

One can set repository variable REGISTRY to their custom registry (e.g. quay.io/yourusername). Otherwise, the fallback registry (quay.io/devfile) will be used.

How to test

Create a DevWorkspace, it should start successfully:

Devfile

link: https://gist.github.com/akurinnoy/afccc6da6105a5c87911acb648bb88a9/raw/c83a1952c939ca51bd847d70a1f32158554f50e4/ubi10-base

schemaVersion: 2.3.0
metadata:
  name: ubi10-base
  generateName: ubi10-base-
components:
  - name: tools
    container:
      args:
        - tail
        - '-f'
        - /dev/null
      image: quay.io/devfile/base-developer-image:ubi10-pr-237
      memoryLimit: 10G
      memoryRequest: 512Mi
      cpuRequest: 1000m
      cpuLimit: 5000m
      env:
        - name: KUBEDOCK_ENABLED
          value: 'true'

DevWorkspace

cat << EOF | oc apply -f -
kind: DevWorkspace
apiVersion: workspace.devfile.io/v1alpha2
metadata:
  name: test-ubi10
spec:
  started: true
  template:
    components:
      - name: tools
        container:
          image: 'quay.io/devfile/base-developer-image:ubi10-pr-237'
          memoryLimit: 10G
          memoryRequest: 512Mi
          cpuLimit: 5000m
          cpuRequest: 1000m
          args:
            - tail
            - '-f'
            - /dev/null
          env:
            - name: KUBEDOCK_ENABLED
              value: 'true'
          sourceMapping: /projects
  contributions:
    - name: che-code
      uri: https://eclipse-che.github.io/che-plugin-registry/main/v3/plugins/che-incubator/che-code/latest/devfile.yaml
      components:
        - name: che-code-runtime-description
          container:
            env:
              - name: CODE_HOST
                value: 0.0.0.0
EOF

Open Che Code and check if all the development tools are included, see https://github.com/devfile/developer-images/blob/86af50296b6c4187376feea5e22a9e993fbb00e5/README.md#included-development-tools
Check (thanks @dkwon17 ):

persistent home storage
- stow correctly runs on first start, and does not on subsequent starts
podman build (podman build -t hello https://github.com/containers/PodmanHello.git)
- overlay set up
kubedock
- podman run (podman run quay.io/dkwon17/test:1234)

How to get image size

Pull the image:

podman pull quay.io/devfile/base-developer-image:ubi10-pr-237

Get total size:

podman images quay.io/devfile/base-developer-image:ubi10-pr-237 --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}"
# REPOSITORY:TAG                                     SIZE
# quay.io/devfile/base-developer-image:ubi10-pr-237  789 MB

Get compressed size:

podman save quay.io/devfile/base-developer-image:ubi10-pr-237 | gzip | wc -c | numfmt --to=iec
# 256M

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

github-actions · 2025-09-19T13:10:46Z

Pull Request UBI 10 images published ✨

Base Image: quay.io/devfile/base-developer-image:ubi10-pr-237

github-actions · 2025-09-19T13:29:10Z

Pull Request images published ✨

UDI: quay.io/devfile/universal-developer-image:pr-237

rohanKanojia · 2025-09-22T14:23:28Z

@@ -0,0 +1,55 @@
+#!/bin/bash


There appears to be duplication between ubi9/ and ubi10/. Would it make sense to factor out shared scripts (e.g. kubedock_setup.sh, podman-wrapper.sh) into a common location to reduce duplication and ease maintenance?

I kept this duplication on purpose, so that after switching to ubi10, we can delete the ubi9/ directory.

@dkwon17 Is this approach correct?

Yes, eventually I'd imagine we will deprecate ubi9 sometime after fully adopting ubi10, just like we did for ubi8

rohanKanojia · 2025-09-22T14:25:05Z

+| `wget`              |`wget`                               |`wget`                               |
+| `zip`               |`zip`                                |`zip`                                |
+| `zsh`               |`NOT AVAILABLE (fedora only)`        |`NOT AVAILABLE (fedora only)`        |
+| **TOTAL SIZE**      | **903MB** (341MB compressed)        | **TODO**   |


Will this be updated with final values or any additional notes before merging the PR?

As for me this info is redundant in README.md:

It requires manual updates whenever we install or remove something, which is easy to forget.

The value may differ across architectures.

If anyone needs this detail, they can always find it on quay.io, where the image is published

@dkwon17 can we remove the image size info?

+1 to remove image sizes

dkwon17 · 2025-09-22T23:07:10Z

+    echo user:10000:65536 > /etc/subgid
+
+# Adjust storage.conf to enable Fuse storage.
+RUN sed -i -e 's|^#mount_program|mount_program|g' -e '/additionalimage.*/a "/var/lib/shared",' /usr/share/containers/storage.conf


In the base/ubi9 image, I noticed that the storage.conf file path /etc/containers/storage.conf

Is this location supposed to be different for UBI9 and UBI10?

In ubi10 there is no /etc/containers/storage.conf so used the default distribution-provided configuration file, which is /usr/share/containers/storage.conf. Now I understand that the correct approach would have been to copy the default storage.conf to /etc/containers/.

I also noticed that the entrypoint.sh creates a new config that takes precedence over the system-wide ones:

developer-images/base/ubi10/entrypoint.sh

Lines 14 to 22 in 699a882

# Configure container builds to use vfs or fuse-overlayfs

if [ ! -d "${HOME}/.config/containers" ]; then

mkdir -p ${HOME}/.config/containers

if [ -c "/dev/fuse" ] && [ -f "/usr/bin/fuse-overlayfs" ]; then

(echo '[storage]';echo 'driver = "overlay"';echo '[storage.options.overlay]';echo 'mount_program = "/usr/bin/fuse-overlayfs"') > ${HOME}/.config/containers/storage.conf

else

(echo '[storage]';echo 'driver = "vfs"') > "${HOME}"/.config/containers/storage.conf

fi

fi

It looks like this modifications to storage.conf in the Dockerfile are dead code.

dkwon17 · 2025-09-22T23:08:08Z

+
+# Add kubedock
+# See release page for details https://github.com/joyrex2001/kubedock/releases/tag/0.18.1
+ENV KUBEDOCK_VERSION 0.18.1


Could we also incorporate the changes from #235 as well?

I'm preparing a fixup for this.

dkwon17 · 2025-09-22T23:19:59Z

Thank you @akurinnoy ,

What I've successfully tested so far:

persistent home storage
- stow correctly runs on first start, and does not on subsequent starts
podman build (podman build -t hello https://github.com/containers/PodmanHello.git)
- overlay set up
kubedock
- podman run (podman run quay.io/dkwon17/test:1234)

github-actions · 2025-09-23T11:15:49Z

Pull Request UBI 10 images published ✨

Base Image: quay.io/devfile/base-developer-image:ubi10-pr-237

github-actions · 2025-09-23T11:35:23Z

Pull Request images published ✨

UDI: quay.io/devfile/universal-developer-image:pr-237

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

github-actions · 2025-09-23T13:04:04Z

Pull Request UBI 10 images published ✨

Base Image: quay.io/devfile/base-developer-image:ubi10-pr-237

github-actions · 2025-09-23T13:21:36Z

Pull Request images published ✨

UDI: quay.io/devfile/universal-developer-image:pr-237

rohanKanojia · 2025-09-23T16:33:17Z

I tested the PR using devfile, and it seems to be working

podman build -t hello https://github.com/containers/PodmanHello.git works
podman run quay.io/dkwon17/test:1234 works
Total Size: 803 MB
Compressed Size: 275M

Installed Tools

Command	Version Info
bash	GNU bash, version 5.2.26(1)-release
bat	bat 0.18.3
buildah	buildah version 1.39.4
curl	curl 8.9.1
ps	procps-ng 4.0.4
diff	GNU diffutils 3.10
gh	gh version 2.73.0
git	git version 2.47.3
git-lfs	git-lfs/3.6.1
ip	iproute2-6.11.0
kubedock	kubedock 0.18.2
less	less 661
lsof	lsof 4.98.0
man	man 2.12.0
nano	GNU nano, version 8.1
netstat	net-tools 2.10-alpha
7z	7-Zip 24.09
rg	ripgrep 13.0.0
rsync	rsync version 3.4.1
scp	Part of OpenSSH_9.9p1, OpenSSL 3.2.2 4 Jun 2024
sed	GNU sed 4.9
shasum	6.04
socat	socat version 1.7.4.4
sudo	1.9.15
stow	GNU Stow 2.4.0
tail	tail (GNU coreutils) 9.5
tar	tar (GNU tar) 1.35
time	GNU Time 1.9
vim	VIM - Vi IMproved 9.1
wget	GNU Wget 1.24.5
zip	Zip 3.0 (July 5th 2008)

dkwon17 · 2025-09-24T00:34:47Z

+| `wget`              |`wget`                               |`wget`                               |
+| `zip`               |`zip`                                |`zip`                                |
+| `zsh`               |`NOT AVAILABLE (fedora only)`        |`NOT AVAILABLE (fedora only)`        |
+| **TOTAL SIZE**      | **903MB** (341MB compressed)        | **TODO**   |


+1 to remove image sizes

openshift-ci · 2025-09-29T21:28:40Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: akurinnoy, dkwon17

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

feat: Use latest upstream UBI9 image, update kubedock and gh-cli Signed-off-by: Ivan Suftin <isuftin@usgs.gov> feat: Update /etc/sub*id files to support nested containers (devfile#232) * feat: Update /etc/sub*id files in order to run podman command in a user namespace Signed-off-by: Anatolii Bazko <abazko@redhat.com> feat: Use latest upstream UBI9 image, update kubedock and gh-cli (devfile#235) Signed-off-by: Ivan Suftin <isuftin@usgs.gov> Add ubi-base based on ubi10 (devfile#237) Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com> chore: Import certificates on the start (devfile#240) * chore: Import certificates on the start Signed-off-by: Anatolii Bazko <abazko@redhat.com> chore: set Node 20 as a default version (devfile#229) Signed-off-by: Valerii <vsvydenk@redhat.com> Update base ubi9 image to latest Update GH CLI release Update ripgrep Update bat Update fd Update kubedock Update base/ubi9/Dockerfile Fix the upstream Docker image identifier Co-authored-by: David Kwon <dakwon@redhat.com>

feat: Use latest upstream UBI9 image, update kubedock and gh-cli Signed-off-by: Ivan Suftin <isuftin@usgs.gov> feat: Update /etc/sub*id files to support nested containers (devfile#232) * feat: Update /etc/sub*id files in order to run podman command in a user namespace Signed-off-by: Anatolii Bazko <abazko@redhat.com> feat: Use latest upstream UBI9 image, update kubedock and gh-cli (devfile#235) Signed-off-by: Ivan Suftin <isuftin@usgs.gov> Add ubi-base based on ubi10 (devfile#237) Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com> chore: Import certificates on the start (devfile#240) * chore: Import certificates on the start Signed-off-by: Anatolii Bazko <abazko@redhat.com> chore: set Node 20 as a default version (devfile#229) Signed-off-by: Valerii <vsvydenk@redhat.com> Update base ubi9 image to latest Update GH CLI release Update ripgrep Update bat Update fd Update kubedock Update base/ubi9/Dockerfile Fix the upstream Docker image identifier Co-authored-by: David Kwon <dakwon@redhat.com> Signed-off-by: Ivan Suftin <isuftin@usgs.gov>

akurinnoy added 4 commits September 18, 2025 16:22

feat: add ubi10-base build

d3e93db

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

chore: add workflows to build ubi10-base images

92af3db

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

chore: add ability to use another registry (in forks) via env variable

713d5ae

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

chore: add notes about ubi10-base images, REGISTRY variable

90724d1

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

akurinnoy requested review from SDawley, dkwon17 and svor as code owners September 19, 2025 09:15

akurinnoy mentioned this pull request Sep 19, 2025

Ubi10 base test next #236

Closed

fixup! feat: add ubi10-base build

022fc16

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

akurinnoy force-pushed the ubi10-base branch from 5fafed5 to 022fc16 Compare September 19, 2025 09:46

devfile deleted a comment from github-actions Bot Sep 19, 2025

fixup! fixup! feat: add ubi10-base build

86af502

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

devfile deleted a comment from github-actions Bot Sep 19, 2025

akurinnoy self-assigned this Sep 22, 2025

rohanKanojia reviewed Sep 22, 2025

View reviewed changes

Comment thread .github/workflows/pr-check-ubi10.yaml

rohanKanojia reviewed Sep 22, 2025

View reviewed changes

dkwon17 reviewed Sep 22, 2025

View reviewed changes

akurinnoy added 2 commits September 23, 2025 15:56

fixup! chore: add notes about ubi10-base images, REGISTRY variable

a20655c

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

fixup! fixup! fixup! feat: add ubi10-base build

fab1905

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

akurinnoy force-pushed the ubi10-base branch from 699a882 to fab1905 Compare September 23, 2025 12:57

dkwon17 approved these changes Sep 29, 2025

View reviewed changes

openshift-ci Bot assigned dkwon17 Sep 29, 2025

openshift-ci Bot added the lgtm label Sep 29, 2025

dkwon17 merged commit 4b34b0b into main Sep 29, 2025
11 checks passed

dkwon17 deleted the ubi10-base branch September 29, 2025 21:29

	# Configure container builds to use vfs or fuse-overlayfs
	if [ ! -d "${HOME}/.config/containers" ]; then
	mkdir -p ${HOME}/.config/containers
	if [ -c "/dev/fuse" ] && [ -f "/usr/bin/fuse-overlayfs" ]; then
	(echo '[storage]';echo 'driver = "overlay"';echo '[storage.options.overlay]';echo 'mount_program = "/usr/bin/fuse-overlayfs"') > ${HOME}/.config/containers/storage.conf
	else
	(echo '[storage]';echo 'driver = "vfs"') > "${HOME}"/.config/containers/storage.conf
	fi
	fi

Conversation

akurinnoy commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How to test

How to get image size

Uh oh!

github-actions Bot commented Sep 19, 2025

Uh oh!

github-actions Bot commented Sep 19, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dkwon17 commented Sep 22, 2025

Uh oh!

github-actions Bot commented Sep 23, 2025

Uh oh!

github-actions Bot commented Sep 23, 2025

Uh oh!

github-actions Bot commented Sep 23, 2025

Uh oh!

github-actions Bot commented Sep 23, 2025

Uh oh!

rohanKanojia commented Sep 23, 2025

Installed Tools

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Sep 29, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

akurinnoy commented Sep 19, 2025 •

edited

Loading