container base image needs to be updated

[kannanlakshmi]

@keith-mcclellan is working on putting CRDB container image back on the Redhat registry as this is required for any partnership between Redhat and Cockroach Labs. We appear to be using some stale base images for our containers https://github.com/cockroachdb/cockroach/blob/2168fe87d168520989488859e88ee39301f8bb6b/build/builder/Dockerfile
Base images tend to have security vulnerabilities and this will need to addressed before he can proceed with the Redhat marketplace.

cc @keith-mcclellan for more information as he found the older images

cc @kenliu for triage

[keith-mcclellan]

I found at least two spots where we're pinning ourselves to old base images:

https://github.com/cockroachdb/cockroach/blob/2168fe87d168520989488859e88ee39301f8bb6b/build/deploy/Dockerfile

FROM debian:9.8-slim should be the latest LTS which would be stretch-slim (currently maps to 9.11-slim)

https://github.com/cockroachdb/cockroach/blob/2168fe87d168520989488859e88ee39301f8bb6b/build/builder/Dockerfile

FROM ubuntu:xenial-20170915 should at a minimum be FROM ubuntu:xenial but better bionic (latest LTS)

[keith-mcclellan]

Red Hat is specifically asking us to support a version of the database on their UBI though, where they manage the security patching for the underlying dependencies

[kenliu]

@bobvawter FYI I'm adding this to the backlog

[kenliu]

@bobvawter can look at this as part of revving the go version

[kenliu]

we're going to work on this in the next week or two

[bobvawter]

Related: #44905

[kenliu]

@bobvawter any update on this issue?

[bobvawter]

Per discussion with release team, the consensus is to hold until the 20.1 release goes out, since the changing the base image will impact testing. Also coordinating with @aaron-crl viz security requirements. Will update this ticket with notes from that chat.

[bobvawter]

Now that the release is out, will get back to this after landing the updated TeamCity agent OS image.

[kenliu]

Reopening this because we hadn't yet updated the base image to use the latest redhat UBI

[kenliu]

Before we close out this issue, we need to follow up with Keith to understand better what the release process is for distributing to the RedHat marketplace.

https://marketplace.redhat.com/en-us/products/cockroachdb-operator

[jlinder]

Current status:

• For 20.2.0 and forward, we are using the ubi8/ubi-minimal image as the base image for our docker images
• We met with Keith to get the process for publishing docker images to the Red Hat Marketplace. We've pushed images for the 20.1.7, 20.1.8 and 20.2.0 builds. We will handle pushing images for new builds going forward. We have yet to automate the process and are tracking that as a separate task.

With that, we can close this issue.