Feature Request: Update container images to latest UBI baseimage

[bencourliss]

Is your feature request related to a problem? Please describe.

We should update all container images to UBI 9.5 to pull in security fixes and other updates.

Describe the solution you'd like.

Currently we are using UBI 9.2. There is a newer version, 9.5 available for all architectures (amd64, arm64, ppc64le, s390x). The Dockerfiles should change to FROM registry.access.redhat.com/ubi9/ubi-minimal:9.5

Additionally, some work should be done to see if we can support ubi-micro instead of ubi-minimal to reduce the threat surface attack area.

relates to #3852

Describe alternatives you've considered

No response

Additional context.

No response

[naphelps]

The Exchange uses registry.access.redhat.com/ubi9-minimal:latest as its base image. The packages are always up to date at the time of creating a container. The addition size shrinkage from going to the micro variant is moot presently for the mgmt hub, but this may be useful for storage constrained IoT devices in the field running an agent(Anax). Alternatively, project Ocre (https://lf-edge.atlassian.net/wiki/spaces/LE/pages/15832446/Project+Ocre) achieves this goal of space constrained devices better.

[johnwalicki]

I've never been a fan of using :latest containers. Its non-deterministic and you can't necessarily rebuild a specific anax container image and get the same bit for bit results if the underlying :latest has changed. If I want to go back in time and recreate/respin a specific version of Open Horizon, :latest makes that impossible.

IMHO, this should be reverted to use the whatever is most current, ubi-minimal:9.5 , for this anax release. Then, when you bump to the next anax release, move to the then current ubi-minimal:x.y

[johnwalicki]

Another consideration.... When you need to do a security scan, you'll get a bunch of CVEs against the anax container contents. This might be a CVE list since :latest at the time of the build/release, but you won't actually know which :latest that was. If these containers are pinned to a ubi-minimal:9.x base, you can compare the Red Hat CVE list and know exactly what package updates are. Its a lot more transparent than nebulous :latest