From 95278ff72bac4a51ffde71544e751c0088f388f0 Mon Sep 17 00:00:00 2001
From: Jeff Cantrill <jcantril@redhat.com>
Date: Wed, 9 Sep 2026 15:34:02 -0400
Subject: [PATCH] feat(Dockerfile): modify base image to be ubi-micro to reduce
 CVEs

ref: LOG-9959
---
 Dockerfile     | 23 +++++++++++++++++------
 Dockerfile.art | 17 ++++++++++++++---
 2 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index dc4bf8c354a0f..478349a1471f7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -33,14 +33,25 @@ COPY . /src
 RUN /src/scripts/environment/install-protoc.sh
 RUN make build
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal
-
-RUN microdnf install -y systemd tar crypto-policies-scripts && \
-    microdnf clean all
-
+FROM registry.access.redhat.com/ubi9/ubi:latest AS packages
+
+# Install ubi-micro runtime packages into a staging root directory using DNF
+RUN mkdir -p /mnt/rootfs && \
+    dnf install -y --installroot=/mnt/rootfs \
+      --releasever=9 \
+      --setopt=install_weak_deps=false \
+      --nodocs \
+      systemd \
+      tar \
+      crypto-policies-scripts && \
+    dnf --installroot=/mnt/rootfs clean all
+
+FROM registry.access.redhat.com/ubi9/ubi-micro
+
+COPY --from=packages /mnt/rootfs/ /
 # Copy PQ crypto-policies configuration from builder
 COPY --from=builder /etc/crypto-policies/ /etc/crypto-policies/
+COPY --from=builder /src/target/release/vector /usr/bin/
 
-COPY --from=builder /src/target/release/vector /usr/bin
 WORKDIR /usr/bin
 CMD ["/usr/bin/vector"]
diff --git a/Dockerfile.art b/Dockerfile.art
index 8ea731797ee8e..be6a2d0300bba 100644
--- a/Dockerfile.art
+++ b/Dockerfile.art
@@ -29,11 +29,22 @@ RUN strip --strip-all /opt/app-root/src/target/release/vector
 
 RUN cp /opt/app-root/src/target/release/vector /usr/bin
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal
+FROM registry.access.redhat.com/ubi9/ubi:latest AS packages
 
-COPY --from=builder /usr/bin/vector /usr/bin/
-RUN microdnf install -y systemd crypto-policies-scripts
+# Install ubi-micro runtime packages into a staging root directory using DNF
+RUN mkdir -p /mnt/rootfs && \
+    dnf install -y --installroot=/mnt/rootfs \
+      --releasever=9 \
+      --setopt=install_weak_deps=false \
+      --nodocs \
+      systemd \
+      crypto-policies-scripts && \
+    dnf --installroot=/mnt/rootfs clean all
+
+FROM registry.access.redhat.com/ubi9/ubi-micro
 
+COPY --from=packages /mnt/rootfs/ /
+COPY --from=builder /usr/bin/vector /usr/bin/
 # Copy PQ crypto-policies configuration from builder
 COPY --from=builder /etc/crypto-policies/ /etc/crypto-policies/