#ubi

2 posts

rhel

115 to 56: Remediating an Image That Cannot Patch Itself

UBI Micro scored 115 findings, 3 CRITICAL in Tomcat, and ships no rpm, dnf or microdnf — nothing inside it can upgrade anything. Building the fix outside and copying it in cleared 59 and introduced none, for +4.8% size. Three build bugs along the way, the last silently duplicating a 62 MB JAR.

rhel

895 to 575: Remediating Red Hat UBI 9 Full

The only image in the comparison with a package manager was also the worst offender at 895 findings. Its security channel turned out to be completely empty. A full dnf upgrade cleared 320 of them — and quietly introduced 20 new ones.