Skip to content

feat: Support running machine-exec in ubi-based containers#372

Open
RomanNikitenko wants to merge 1 commit into
mainfrom
ubi-support
Open

feat: Support running machine-exec in ubi-based containers#372
RomanNikitenko wants to merge 1 commit into
mainfrom
ubi-support

Conversation

@RomanNikitenko

@RomanNikitenko RomanNikitenko commented Jul 8, 2026

Copy link
Copy Markdown
Member

What does this PR do?

The che-machine-exec image now ships platform-specific binaries for UBI 8, UBI 9, and Alpine (musl), enabling FIPS-compliant execution in glibc-based containers.

Previously the image contained only a single Alpine/musl binary. While it worked in UBI containers (as a static build), it bypassed the host's crypto stack. Now each binary is built natively with CGO_ENABLED=1 against the target platform's glibc, ensuring proper FIPS compliance.

The final image layout:

  • /go/bin/che-machine-exec — Alpine/musl (default entrypoint, backward-compatible)
  • /go/ubi8/bin/che-machine-exec — UBI 8 (glibc, OpenSSL 1.x)
  • /go/ubi9/bin/che-machine-exec — UBI 9 (glibc, OpenSSL 3.x)

Consumers (e.g. che-code's assembly.Dockerfile) can now COPY the appropriate binary into each checode assembly directory, so entrypoint-volume.sh picks the correct one at runtime based on the detected platform.

What issues does this PR fix?

How to test this PR?

Create machine-exec terminal using Terminal => New Terminal (Select a Container)
Screenshot 2026-07-08 at 18 34 52

I've built image with current PR changes and applied it for the che-code editor: che-incubator/che-code#748

I used the following links to start a workspace and test machine-exec:

Signed-off-by: Roman Nikitenko <rnikiten@redhat.com>
@tolusha

tolusha commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

  • /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
  • /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
  • /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
  • /che-ai-assistant help — Show this help message

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants