There are several problems in the current image build process (see [[#25] The Future of Container Images - Image Build v2 - Rationale](https://gitlab.com/yaook/meta/-/issues/25#rationale)). [Re-thinking and implementing an new process](https://gitlab.com/yaook/meta/-/issues/25) could take some time. ## Proposal Until then we can improve the image build gradually to address some of the pain-points. Here are some possible improvements: - Have all container images scanned in CI and output an SBOM as artifact in ecyclone-dx (JSON) format. - Use layers where possible - Pin the base image version to snapshot images where possible - Extract build logic - Use a common directory layout for patches, e.g have one directory per OpenStack release - Move to common base images - Enable caching where possible ## Relevant images - [ ] [nova-compute](https://gitlab.com/yaook/images/nova-compute) - [ ] [nova(-api)](https://gitlab.com/yaook/images/nova) - [ ] [cinder](https://gitlab.com/yaook/images/cinder) - [ ] [keystone](https://gitlab.com/yaook/images/keystone) - [ ] [barbican](https://gitlab.com/yaook/images/barbican) - [ ] [glance](https://gitlab.com/yaook/images/glance) - [ ] [backup-creator](https://gitlab.com/yaook/images/backup-creator) (SBOM) - [ ] [backup-shifter](https://gitlab.com/yaook/images/backup-shifter) (SBOM) - [ ] [ceilometer](https://gitlab.com/yaook/images/ceilometer) (SBOM) - [ ] [ceilometer-agent-notification](https://gitlab.com/yaook/images/ceilometer-agent-notification) (SBOM) - [ ] [debugbox ??](https://gitlab.com/yaook/images/debugbox) - [ ] [designate](https://gitlab.com/yaook/images/designate) - [ ] [ironic](https://gitlab.com/yaook/images/infra-ironic) - [ ] [infra-ironic-dnsmasq](https://gitlab.com/yaook/images/infra-ironic-dnsmasq) (at least SBOM) - [ ] [infra-ironic-inspector](https://gitlab.com/yaook/images/infra-ironic-inspector) (SBOM) - [ ] [mariadb-galera](https://gitlab.com/yaook/images/mariadb-galera) (at least SBOM) - [ ] [neutron-ovn-agent](https://gitlab.com/yaook/images/neutron-ovn-agent) (SBOM and patches) - [ ] [openvswitch](https://gitlab.com/yaook/images/openvswitch) (SBOM, other rework may not needed, as we should have an openvswitch-base image for everything we include/build openvswitch (or ovs-python), so more rework there needed anyway) - [ ] [ovn](https://gitlab.com/yaook/images/ovn) (patch reorder) - [ ] [ovn-bgp-agent](https://gitlab.com/yaook/images/ovn-bgp-agent) (SBOM, maybe extract build logic) - [ ] [ovsdb-monitoring](https://gitlab.com/yaook/images/ovsdb-monitoring) (SBOM, maybe build logic extract) - [ ] [placement](https://gitlab.com/yaook/images/placement) (patches) - [ ] [rabbitmq-exporter](https://gitlab.com/yaook/images/rabbitmq-exporter) (SBOM) - [ ] [service-reload](https://gitlab.com/yaook/images/service-reload) (SBOM) - [ ] [ssl-terminator](https://gitlab.com/yaook/images/ssl-terminator) (SBOM) - [ ] [tempest](https://gitlab.com/yaook/images/tempest) (SBOM, may extract build logic and use same base image) Progress of SBOM build also tracked in https://gitlab.com/yaook/operator/-/work_items/513