[salv-orlando]

Switch UBI image from ubi9-minimal to ubi9-micro

Summary

The operator is a static Go binary (CGO_ENABLED=0). At runtime it only needs a shell, coreutils and the CA bundle. This PR moves the final image from ubi9/ubi-minimal to ubi9/ubi-micro, which removes the package manager and everything it drags in (rpm, microdnf, curl-minimal, libxml2, glib2, libarchive, openssl-libs, util-linux libs).

This is the clean alternative to removing packages in place (rpm -e --nodeps, as attempted in 7eaa5ac): rpm-libs and libcurl-minimal are hard dependencies of microdnf, so they can't be removed on ubi-minimal without breaking the package manager.

What changed (build/Dockerfile)

• New rootfs build stage on ubi-minimal that installs coreutils-single and ca-certificates into an empty root with microdnf --installroot.
• Final stage is now ubi9/ubi-micro, with that rootfs copied on top.
• coreutils-single is requested explicitly. Without it the resolver picks the full coreutils, which links libcrypto and pulls openssl-libs back in.
• microdnf 3.9 requires --config, --noplugins and --setopt values for cachedir, reposdir and varsdir whenever --installroot is used.

	Before	After
Packages in rpmdb	~109	31
Image size	170 MB	120 MB
rpm / microdnf / curl	present	absent

CVEs removed from the image

Red Hat has not released a fix for any of these, so they could not be fixed by rebuilding on a newer base.

Package	Identifier	Description
curl	BDSA-2022-1336	Bearer token memory leak (no CVE id in the scan report)
curl	CVE-2026-5773	libcurl reuses wrong connection for SMB transfers
curl	CVE-2026-6276	Stale Host: header leaks cookies on handle reuse
curl	CVE-2026-8932	Connection reused after mTLS option change
curl	CVE-2026-18924	HTTP/2 Server Push use-after-free on cleanup
curl	CVE-2026-19931	Negotiate connection reused with empty credentials
curl	CVE-2026-80230	Pinned public key not enforced when peer verification is off
curl	CVE-2026-82209	Public Suffix List bypass in Set-Cookie Domain
glib2	CVE-2026-1484 (BDSA-2026-1153)	g_base64_encode() integer overflow
glib2	CVE-2026-1485 (BDSA-2026-1152)	treemagic parse_header() buffer underflow
libarchive	CVE-2026-4426 (BDSA-2026-5247)	zisofs shift out-of-bounds
libxml2	CVE-2025-27113 (BDSA-2025-1294)	xmlPatMatch NULL dereference
openssl-libs	CVE-2026-42772 (BDSA-2026-35489)	QUIC stream reassembly
openssl-libs	CVE-2026-72897 (BDSA-2026-35764)	TLS 1.3 signature_algorithms out-of-bounds write
rpm	CVE-2026-84837 (BDSA-2026-31377)	rpmbuild -t* command injection
rpm	CVE-2026-95521 (BDSA-2026-35043)	Source RPM %() macro command injection
rpm	CVE-2026-95519 (BDSA-2026-35042)	Manifest %() macro command injection
util-linux	BDSA-2026-28059	libblkid DOS partition parser integer overflow. The report cites CVE-2026-53615, which Red Hat has no record of

Still present

• CVE-2026-89161 (pcre2, pcre2_jit_match incorrect free). pcre2 is part of ubi9-micro itself, because libselinux requires it. Red Hat lists it as Affected with no fix yet.

Testing

• Image builds from the repo's build/Dockerfile on linux/arm64 and linux/amd64
• rpmdb inspected on both: 31 packages, no flagged package except pcre2
• Operator starts through the entrypoint as UID 1001 and as an arbitrary UID (--user 1234:0)
• CA bundle present at /etc/pki/tls/certs/ca-bundle.crt (146 certificates), so the system-roots fallback in getConnectorTLSConfig still works
• make test-e2e passes
• Scanner re-run on the new image (to be done after merge)

Notes for reviewers

• The image no longer has rpm, microdnf or curl, so tools can't be installed in a running pod. /bin/bash is still available.
• To debug, run a throwaway ubi-minimal container that shares the operator's PID namespace and has CAP_SYS_PTRACE. Then inspect with rpm --root /proc/1/root -qa.
• The rootfs stage needs network access to the UBI repos at build time, as the old ubi-minimal image already did. The base is still the unpinned :latest tag.

AI Assistance

• Code generation (Dockerfile change)
• Commit messages
• Documentation (this PR description)

🤖 Generated with Claude Code

The merge-base changed after approval.