Skip to content

fix(frontend): upgrade base image to ubi9 to resolve python vulnerability#5380

Open
xnaveenx wants to merge 3 commits intolitmuschaos:masterfrom
xnaveenx:fix/frontend-python-upgrade
Open

fix(frontend): upgrade base image to ubi9 to resolve python vulnerability#5380
xnaveenx wants to merge 3 commits intolitmuschaos:masterfrom
xnaveenx:fix/frontend-python-upgrade

Conversation

@xnaveenx
Copy link
Copy Markdown
Contributor

@xnaveenx xnaveenx commented Jan 7, 2026

Proposed changes

Fixes #5379
Fixes #5314
This PR upgrades the ChaosCenter frontend base image from UBI 8 (ubi-minimal:8.5) to UBI 9 (ubi-minimal:9.7).

Reason for change: The previous UBI 8 base image relied on Python 3.6, which has reached end-of-life and contains known security vulnerabilities. UBI 9 ships with Python 3.9, resolving these issues.

This PR also includes the necessary configuration adjustments (package installation and file permissions) to ensure Nginx runs correctly in the stricter UBI 9 environment.

Types of changes

What types of changes does your code introduce to Litmus? Put an x in the boxes that apply

  • New feature (non-breaking change which adds functionality)
  • Bugfix (non-breaking change which fixes an issue)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation Update (if none of the other choices applies)

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

  • I have read the CONTRIBUTING doc
  • I have signed the commit for DCO to be passed.
  • Lint and unit tests pass locally with my changes
  • I have added tests that prove my fix is effective or that my feature works (if appropriate)
  • I have added necessary documentation (if appropriate)

Dependency

  • None

Special notes for your reviewer:

Detailed Changes & Rationales:

  1. Base Image Upgrade:

    • FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7
    • Why: To move from Python 3.6 to Python 3.9 and fix security vulnerabilities.
  2. Package Installation:

    • Added python3-pip to the install command.
    • Why: In UBI 8, pip was bundled with python3. In UBI 9, they are separate packages. Without this, pip3 install pyyaml fails.
  3. Permission Fixes (Nginx Crash Resolution):

    • Added touch /run/nginx.pid
    • Added chown/chmod for /var/lib/nginx and /run/nginx.pid
    • Why: UBI 9 has stricter default permissions than UBI 8. The container runs as non-root user 65534. Without explicitly granting ownership of the Nginx temp directories (/var/lib/nginx) and the PID file location, Nginx crashes immediately with "Permission Denied" errors.

Verification Steps Performed:

  1. Built the Docker image locally using the new Dockerfile.
  2. Deployed the pod in a local Kubernetes cluster.
  3. Status Check: Confirmed pod reached Running (1/1) state.
  4. Python Check: Executed into the pod and verified python3 --version returns Python 3.9.x.
  5. UI Check: Port-forwarded to port 8185 and successfully loaded the Litmus Dashboard, confirming Nginx is serving static assets correctly.

@xnaveenx xnaveenx force-pushed the fix/frontend-python-upgrade branch from ecd4000 to 80ee7ee Compare January 7, 2026 17:03
@PriteshKiri PriteshKiri requested a review from Jonsy13 January 13, 2026 12:37
@xnaveenx xnaveenx force-pushed the fix/frontend-python-upgrade branch 2 times, most recently from c33d8c9 to e97b61b Compare January 23, 2026 15:27
Signed-off-by: xnaveen <naveen010210@gmail.com>
@xnaveenx xnaveenx force-pushed the fix/frontend-python-upgrade branch from e97b61b to b3287af Compare January 30, 2026 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Upgrade Chaos Center Frontend to UBI 9 to fix EOL Python 3.6 Security: Vulnerability Scan Results for litmusportal-frontend

2 participants