fix: drop container image digest pinning, unify toolchain versions, migrate to Fedora

raballew · claude · raballew · commit 30fedcbf6b65 · 2026-06-09T19:24:02.000+02:00
- Disable pinDigests in Renovate -- most registries prune untagged
  manifests within weeks, making pinned digests counterproductive
- Rename renovate.json to renovate.jsonc to formally support comments
- Centralize uv version in .uv-version -- Containerfiles install via
  curl at build time, CI workflows and e2e scripts read the same file
- Migrate controller images from UBI9 to Fedora, install Go from
  .go-version via go.dev (replaces ubi9/go-toolset)
- Use fedora-minimal for controller/operator runtime stages
- Pin all Fedora images to registry.fedoraproject.org
- Parameterize Python version from .py-version in devfile Containerfiles
- Replace hardcoded podman fallback image in build_fits.sh with a
  Containerfile managed by Renovate natively
- Bump Fedora from 43 to 44

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -2,7 +2,7 @@
 	"name": "uv",
 	"build": {
 		"context": "..",
-		"dockerfile": "Dockerfile"
+		"dockerfile": "Containerfile"
 	},
 	"postCreateCommand": "cd python && make sync",
 	"postStartCommand": "cd python && uv python pin $(cat ../.py-version) && uv run pre-commit install",
diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
@@ -32,15 +32,15 @@ jobs:
           # Controller images
           - image_name: jumpstarter-dev/jumpstarter-controller
             label: jumpstarter-controller
-            dockerfile: controller/Dockerfile
+            dockerfile: controller/Containerfile
             context: controller
           - image_name: jumpstarter-dev/jumpstarter-operator
             label: jumpstarter-operator
-            dockerfile: controller/Dockerfile.operator
+            dockerfile: controller/Containerfile.operator
             context: controller
           - image_name: jumpstarter-dev/jumpstarter-operator-bundle
             label: jumpstarter-operator-bundle
-            dockerfile: controller/deploy/operator/bundle.Dockerfile
+            dockerfile: controller/deploy/operator/bundle.Containerfile
             context: controller/deploy/operator
             generate_bundle: true
           - image_name: jumpstarter-dev/microshift/bootc
@@ -50,16 +50,16 @@ jobs:
           # Python images (use repo root context for .git access needed by hatch-vcs)
           - image_name: jumpstarter-dev/jumpstarter
             label: jumpstarter
-            dockerfile: python/Dockerfile
+            dockerfile: python/Containerfile
             context: .
           - image_name: jumpstarter-dev/jumpstarter-utils
             label: jumpstarter-utils
-            dockerfile: python/Dockerfile.utils
+            dockerfile: python/Containerfile.utils
             context: python
           - image_name: jumpstarter-dev/jumpstarter-dev
             label: jumpstarter-dev
             dockerfile: python/.devfile/Containerfile
-            context: python
+            context: .
           - image_name: jumpstarter-dev/jumpstarter-devspace
             label: jumpstarter-devspace
             dockerfile: python/.devfile/Containerfile.client
@@ -70,6 +70,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - id: go
+        run: echo "version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+
       - name: Check if this image should be built
         id: check
         if: github.event_name == 'pull_request'
@@ -191,6 +194,7 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           build-args: |
+            GO_VERSION=${{ steps.go.outputs.version }}
             GIT_VERSION=${{ env.PEP440_VERSION }}
             GIT_COMMIT=${{ steps.build-args.outputs.git_commit }}
             BUILD_DATE=${{ steps.build-args.outputs.build_date }}
diff --git a/.github/workflows/build-oci-bundle.yaml b/.github/workflows/build-oci-bundle.yaml
@@ -6,7 +6,7 @@ on:
 jobs:
   build-fits:
     runs-on: ubuntu-24.04-arm
-    container: fedora:43
+    container: registry.fedoraproject.org/fedora:44
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
diff --git a/.github/workflows/documentation.yaml b/.github/workflows/documentation.yaml
@@ -45,10 +45,12 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.6"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Setup Pages
@@ -81,10 +83,12 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.6"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Verify generated gRPC docs are up to date
@@ -103,10 +107,12 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.6"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Check documentation links
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -70,7 +70,7 @@ jobs:
         uses: actions/cache@v5
         with:
           path: /tmp/controller-image.tar
-          key: controller-image-${{ matrix.arch }}-${{ hashFiles('controller/Makefile', 'controller/Dockerfile', 'controller/go.mod', 'controller/go.sum', 'controller/cmd/**', 'controller/api/**', 'controller/internal/**') }}
+          key: controller-image-${{ matrix.arch }}-${{ hashFiles('controller/Makefile', 'controller/Containerfile', 'controller/go.mod', 'controller/go.sum', 'controller/cmd/**', 'controller/api/**', 'controller/internal/**') }}
 
       - name: Build controller image
         if: steps.cache.outputs.cache-hit != 'true'
@@ -115,7 +115,7 @@ jobs:
           path: |
             /tmp/operator-image.tar
             /tmp/operator-install.yaml
-          key: operator-image-${{ matrix.arch }}-${{ hashFiles('controller/Makefile', 'controller/Dockerfile.operator', 'controller/go.mod', 'controller/go.sum', 'controller/deploy/operator/**', 'controller/api/**', 'controller/internal/**') }}
+          key: operator-image-${{ matrix.arch }}-${{ hashFiles('controller/Makefile', 'controller/Containerfile.operator', 'controller/go.mod', 'controller/go.sum', 'controller/deploy/operator/**', 'controller/api/**', 'controller/internal/**') }}
 
       - name: Build operator image and installer manifest
         if: steps.cache.outputs.cache-hit != 'true'
@@ -144,9 +144,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Cache python wheels
@@ -187,9 +190,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Install Go
@@ -245,9 +251,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Install Go
@@ -281,9 +290,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Install Go
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -38,7 +38,7 @@ jobs:
               - 'python/**'
               - '.github/workflows/lint.yaml'
             renovate:
-              - 'renovate.json'
+              - 'renovate.jsonc'
               - '.github/workflows/lint.yaml'
 
   lint-go:
@@ -94,10 +94,12 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.19"
+          version: ${{ steps.uv.outputs.version }}
           python-version-file: .py-version
 
       - name: Run ty
diff --git a/.github/workflows/python-tests.yaml b/.github/workflows/python-tests.yaml
@@ -53,10 +53,12 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install the latest version of uv
+      - id: uv
+        run: echo "version=$(cat .uv-version)" >> "$GITHUB_OUTPUT"
+      - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          version: "0.11.19"
+          version: ${{ steps.uv.outputs.version }}
           python-version: ${{ matrix.python-version }}
 
       - name: Install Qemu (Linux)
diff --git a/.uv-version b/.uv-version
@@ -0,0 +1 @@
+0.11.19
diff --git a/controller/Makefile b/controller/Makefile
@@ -123,6 +123,7 @@ run-router: manifests generate fmt vet ## Run a router from your host.
 .PHONY: docker-build
 docker-build: ## Build docker image with the manager.
 	$(CONTAINER_TOOL) build \
+		--build-arg GO_VERSION=$(shell cat ../.go-version) \
 		--build-arg GIT_VERSION=$(GIT_VERSION) \
 		--build-arg GIT_COMMIT=$(GIT_COMMIT) \
 		--build-arg BUILD_DATE=$(BUILD_DATE) \
@@ -141,8 +142,8 @@ docker-push: ## Push docker image with the manager.
 PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
 .PHONY: docker-buildx
 docker-buildx: ## Build and push docker image for the manager for cross-platform support
-	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
-	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
+	# copy existing Containerfile and insert --platform=${BUILDPLATFORM} into Containerfile.cross, and preserve the original Containerfile
+	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Containerfile > Containerfile.cross
 	- $(CONTAINER_TOOL) buildx create --name jumpstarter-controller-builder
 	$(CONTAINER_TOOL) buildx use jumpstarter-controller-builder
 	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) \
@@ -151,9 +152,9 @@ docker-buildx: ## Build and push docker image for the manager for cross-platform
 			--build-arg BUILD_DATE=$(BUILD_DATE) \
 			--tag ${DOCKER_REPO}:${DOCKER_TAG} \
 			--tag ${DOCKER_REPO}:latest \
-			-f Dockerfile.cross .
+			-f Containerfile.cross .
 	- $(CONTAINER_TOOL) buildx rm jumpstarter-controller-builder
-	rm Dockerfile.cross
+	rm Containerfile.cross
 
 .PHONY: build-installer
 build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
diff --git a/controller/deploy/operator/Makefile b/controller/deploy/operator/Makefile
@@ -172,10 +172,11 @@ run: manifests generate fmt vet ## Run a controller from your host.
 .PHONY: docker-build
 docker-build: ## Build docker image with the manager.
 	$(CONTAINER_TOOL) build \
+		--build-arg GO_VERSION=$(shell cat ../../../.go-version) \
 		--build-arg GIT_VERSION=$(GIT_VERSION) \
 		--build-arg GIT_COMMIT=$(GIT_COMMIT) \
 		--build-arg BUILD_DATE=$(BUILD_DATE) \
-		-t ${IMG} ../../ -f ../../Dockerfile.operator
+		-t ${IMG} ../../ -f ../../Containerfile.operator
 
 .PHONY: docker-push
 docker-push: ## Push docker image with the manager.
@@ -190,17 +191,17 @@ docker-push: ## Push docker image with the manager.
 PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
 .PHONY: docker-buildx
 docker-buildx: ## Build and push docker image for the manager for cross-platform support
-	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
-	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' ../../Dockerfile.operator > ../../Dockerfile.operator.cross
+	# copy existing Containerfile and insert --platform=${BUILDPLATFORM} into Containerfile.cross, and preserve the original Containerfile
+	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' ../../Containerfile.operator > ../../Containerfile.operator.cross
 	- $(CONTAINER_TOOL) buildx create --name jumpstarter-operator-builder
 	$(CONTAINER_TOOL) buildx use jumpstarter-operator-builder
 	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) \
 		--build-arg GIT_VERSION=$(GIT_VERSION) \
 		--build-arg GIT_COMMIT=$(GIT_COMMIT) \
 		--build-arg BUILD_DATE=$(BUILD_DATE) \
-		--tag ${IMG} -f ../../Dockerfile.operator.cross ../../
+		--tag ${IMG} -f ../../Containerfile.operator.cross ../../
 	- $(CONTAINER_TOOL) buildx rm jumpstarter-operator-builder
-	rm ../../Dockerfile.operator.cross
+	rm ../../Containerfile.operator.cross
 
 .PHONY: build-installer
 build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
@@ -347,7 +348,7 @@ contribute: bundle ## Update community-operators repos with the current bundle.
 
 .PHONY: bundle-build
 bundle-build: ## Build the bundle image.
-	$(CONTAINER_TOOL) build -f bundle.Dockerfile -t $(BUNDLE_IMG) .
+	$(CONTAINER_TOOL) build -f bundle.Containerfile -t $(BUNDLE_IMG) .
 
 .PHONY: bundle-push
 bundle-push: ## Push the bundle image.
diff --git a/e2e/compat/setup.sh b/e2e/compat/setup.sh
@@ -58,7 +58,7 @@ install_dependencies() {
 
     if ! command -v uv &> /dev/null; then
         log_info "Installing uv..."
-        curl -LsSf https://astral.sh/uv/install.sh | sh
+        curl -LsSf "https://astral.sh/uv/$(cat "$REPO_ROOT/.uv-version")/install.sh" | sh
         export PATH="$HOME/.cargo/bin:$PATH"
     fi
 
diff --git a/e2e/setup-e2e.sh b/e2e/setup-e2e.sh
@@ -43,7 +43,7 @@ install_dependencies() {
     # Install uv if not already installed
     if ! command -v uv &> /dev/null; then
         log_info "Installing uv..."
-        curl -LsSf https://astral.sh/uv/install.sh | sh
+        curl -LsSf "https://astral.sh/uv/$(cat "$REPO_ROOT/.uv-version")/install.sh" | sh
         export PATH="$HOME/.cargo/bin:$PATH"
     fi
     
diff --git a/python/.devfile/Containerfile b/python/.devfile/Containerfile
@@ -8,14 +8,16 @@ LABEL summary="devfile jumpstarter developer image"
 LABEL description="Image with developers tools."
 LABEL io.k8s.display-name="jumpstarter-developer-universal"
 
-COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uv  /bin/uv
-COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uvx /bin/uvx
+COPY .uv-version /tmp/.uv-version
+RUN curl -LsSf "https://astral.sh/uv/$(cat /tmp/.uv-version)/install.sh" | sh && \
+    mv /root/.local/bin/uv /bin/uv && mv /root/.local/bin/uvx /bin/uvx
 
 USER root
 
-RUN dnf -y install make git python3.12 libusbx python3-pyusb golang podman && dnf clean all
+COPY .py-version /tmp/.py-version
+RUN PY=$(cat /tmp/.py-version) && \
+    dnf -y install make git "python${PY}" libusbx python3-pyusb golang podman && dnf clean all
 
 USER 10001
 
-# This will make sure that we always run python from our venv instead
 RUN echo "alias python='uv run python'" >> /home/user/.bashrc
diff --git a/python/.devfile/Containerfile.client b/python/.devfile/Containerfile.client
@@ -1,10 +1,10 @@
-FROM --platform=$BUILDPLATFORM ghcr.io/astral-sh/uv:0.11.19 AS uv
-
-FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/ubi:9.5 AS builder
+FROM --platform=$BUILDPLATFORM registry.fedoraproject.org/fedora:44 AS builder
+COPY .uv-version /tmp/.uv-version
 RUN dnf install -y make git && \
+    curl -LsSf "https://astral.sh/uv/$(cat /tmp/.uv-version)/install.sh" | sh && \
+    mv /root/.local/bin/uv /bin/uv && mv /root/.local/bin/uvx /bin/uvx && \
     dnf clean all && \
     rm -rf /var/cache/dnf
-COPY --from=uv /uv /uvx /bin/
 ADD . /src
 RUN make -C /src/python build
 
@@ -21,24 +21,24 @@ LABEL io.k8s.display-name="jumpstarter-client-developer"
 
 USER root
 
-# switch to python 3.12 as the default
-RUN rm -rf /usr/bin/python && ln -s /usr/bin/python3.12 /usr/bin/python
+COPY .py-version /tmp/.py-version
+RUN PY=$(cat /tmp/.py-version) && \
+    rm -rf /usr/bin/python && ln -s "/usr/bin/python${PY}" /usr/bin/python
 
-RUN dnf -y install make git python3.12 python3.12 libusbx python3-pyusb python3.12-pip golang && dnf clean all
+RUN PY=$(cat /tmp/.py-version) && \
+    dnf -y install make git "python${PY}" libusbx python3-pyusb "python${PY}-pip" golang && dnf clean all
 
 USER 10001
 
-RUN --mount=from=builder,source=/src/python/dist,target=/dist python3.12 -m pip install /dist/*.whl
-
-RUN python3.12 -m pip install pytest
+RUN --mount=from=builder,source=/src/python/dist,target=/dist \
+    PY=$(cat /tmp/.py-version) && "python${PY}" -m pip install /dist/*.whl
 
-# now that all .config/.local/.cache files are available, fix permissions so a devspace
-# user could write to any of those
+RUN PY=$(cat /tmp/.py-version) && \
+    "python${PY}" -m pip install pytest
 
 USER root
 
 RUN mkdir -p /home/user/.config/jumpstarter/clients
 RUN chown 10001:0 -R /home/user/{.config,.local,.cache} && chmod g+rwx -R /home/user/{.config,.local,.cache}
 
 USER 10001
-
diff --git a/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/Containerfile b/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/Containerfile
@@ -0,0 +1 @@
+FROM registry.fedoraproject.org/fedora:44
diff --git a/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh b/python/packages/jumpstarter-driver-flashers/oci_bundles/aarch64-itb/build_fits.sh
diff --git a/renovate.jsonc b/renovate.jsonc
