Repository navigation
fix(images): populate package inventories and SBOMs for minimal containers - #19369
Open
Adit Jha (aditjha-msft) wants to merge 1 commit into
Open
Adit Jha (aditjha-msft) wants to merge 1 commit into
Adit Jha (aditjha-msft) wants to merge 1 commit into
Conversation
Retain the post-cleanup RPM database only in staging and use profile-scoped KIWI OCI exclusions to keep it out of shipped minimal containers. Preserve the existing inventory/SBOM pipeline and verify populated inventories plus database-free filesystems. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2fb5f77f-1b0c-4bfd-b384-65cacf315198
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The packaging-policy decision and unverified production SBOM, signing, and publishing integration require human sign-off.
0 open findings
What changed in this PR
Keeps the RPM database in build staging for KIWI inventories and SBOMs while excluding it from shipped minimal and workload containers.
Changes:
- Preserve package records after cleanup.
- Apply OCI exclusions through minimal/workload profile inheritance.
- Add inventory and database-exclusion checks, and document the policy.
| File | Description |
|---|---|
| docs/containers-workloads.md | Documents staging-only RPM database retention. |
| base/images/tests/cases/static/test_container_inventory.py | Checks inventories and shipped database absence. |
| base/images/teams/containers-workloads.xml | Applies exclusions to workload profiles. |
| base/images/teams/container.xml | Applies exclusions to distroless profiles. |
| base/images/container-exclude-files.yaml | Excludes both RPM database paths. |
| base/images/config-container-base.sh | Preserves the staging RPM database during cleanup. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Adit Jha (aditjha-msft)
changed the title
Adit Jha (aditjha-msft)
marked this pull request as ready for review
October 17, 2026 00:23
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix empty
.packagesfiles and missing installed-package entries in minimal-container SBOMs.Retain the final RPM database in staging so KIWI can populate
.packagesand the existing SBOM generator can consume it. Exclude/usr/lib/sysimage/rpmand/var/lib/rpmwhen constructing the OCI image, keeping the shipped image database-free without restoring RPM/DNF tooling.Exclusions are scoped to distroless/workload profiles;
container-base/coreand VM/WSL images are unaffected. Regression checks cover populated inventories and database exclusion.Koji validation
The official-tag BusyBox scratch build passed on x86_64 and ARM64:
https://172.202.186.211/koji/taskinfo?taskID=1407578
busybox-1.37.0-6.azl4.PyTorch also passed on x86_64 and ARM64: 241 and 85 package records respectively, with matching SBOM package/version sets, including
python3-torch-2.8.0-9.azl4. KIWI logs confirm the database exclusions were applied.https://172.202.186.211/koji/taskinfo?taskID=1407698