feat: Migrate to UBI 9 base images for enterprise compliance and security improvements by gnPy · Pull Request #1714 · langflow-ai/openrag

gnPy · 2026-05-29T18:37:38Z

Summary by CodeRabbit

Chores
- Migrated container bases to UBI9 and converted the frontend to a multi-stage build with a smaller non-root runtime; applied OS updates for CVE remediation.
- Tightened Python/JS dependency constraints, added transitive overrides to address vulnerabilities, and targeted Python 3.12.
- Excluded package metadata from build context to streamline image builds.
Bug Fixes
- Improved startup: safer privilege dropping, clearer startup args/env handling, and more robust directory permission handling for OpenShift-friendly runs.

…ions and removing runtime pip

…untime image

coderabbitai · 2026-05-29T18:37:53Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Migrates backend, frontend, and Langflow Dockerfiles to Red Hat UBI9 bases; adds a frontend multi-stage build and frontend dependency overrides; targets Python 3.12 in tooling and dependencies; switches runtime privilege-drop to runuser-style; and makes Langflow/OpenShift filesystem, entrypoint, and Helm env changes.

Changes

UBI9 Migration and OpenShift Container Orchestration

Layer / File(s)	Summary
Build context and dependency updates `.dockerignore`, `pyproject.toml`, `frontend/package.json`, `.python-version`	Adds `.dockerignore` negations for `package.json`/`package-lock.json`. Sets Python requires to `>=3.12`, adds `authlib>=1.7.1`, bumps `python-multipart>=0.0.27`, adds `protobuf>=7.35.0,<8`, `idna>=3.15`, `urllib3>=2.7.0`; frontend bumps `postcss` to `8.5.10` and expands `overrides`.
Backend service UBI9 migration `Dockerfile.backend`, `scripts/backend-entrypoint.sh`	Backend switches from Debian Python to UBI9 `python-312`, replaces `apt` with `dnf`, installs build/runtime OS packages and `uv`, upgrades `pip`/`setuptools`, performs runtime Python package cleanup, and updates entrypoint to use a `runuser`-style privilege-drop with `VIRTUAL_ENV` in env.
Frontend service multi-stage UBI9 migration `Dockerfile.frontend`	Frontend rewritten as deps/builder/runtime multi-stage UBI9 Node.js build. Patches nodemon transitive packages, runs `npm ci`/`npm run build`, prunes dev deps, applies OS updates, copies production artifacts with `--chown=1001:0`, and runs as UID `1001` with `npm start`.
Langflow service UBI9 migration and entrypoint/k8s wiring `Dockerfile.langflow`, `scripts/langflow-entrypoint.py`, `kubernetes/.../langflow/deployment.yaml`	Langflow rebuilt on UBI9 `python-312`, installs OS build deps, compiles SQLite, installs `langflow==1.9.6rc0` and `uv`, pre-creates `/app/data` subdirs with group-writable OpenShift perms, updates entrypoint to chown/chmod `/app/data`, conditionally drop privileges only when root, and injects runtime env/args in Helm deployment to use `/app/data`.

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main objective of the pull request: migrating Docker images to UBI 9 base images for enterprise compliance and security.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (3)

Dockerfile.backend (2)
120-121: 💤 Low value

Stale comment contradicts the change.

The note says the entrypoint "may need to be updated to use 'runuser' instead of 'gosu'", but scripts/backend-entrypoint.sh already uses runuser. Drop this line to avoid confusion.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.backend` around lines 120 - 121, The Dockerfile.backend contains a
stale comment suggesting the entrypoint may need to switch from 'gosu' to
'runuser' even though scripts/backend-entrypoint.sh already uses runuser; remove
that note/comment from Dockerfile.backend to avoid confusion and keep docs
consistent with the actual entrypoint implementation (reference
Dockerfile.backend and scripts/backend-entrypoint.sh).
9-9: ⚡ Quick win

Pin base images instead of :latest for reproducible builds.

:latest makes builds non-deterministic and undermines the CVE-remediation intent of this PR (a future rebuild can silently pull a different OS layer). Prefer a versioned tag or, ideally, a digest. The same applies to Dockerfile.frontend and Dockerfile.langflow.

Also applies to: 62-62
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.backend` at line 9, The Dockerfiles currently use the floating tag
"registry.access.redhat.com/ubi9/python-311:latest" (and similar ":latest" in
Dockerfile.frontend and Dockerfile.langflow), which makes builds
non-reproducible; update each FROM instruction to pin a specific versioned tag
or, preferably, an immutable digest (sha256) for the base image (replace
"registry.access.redhat.com/ubi9/python-311:latest" with a concrete tag or
digest), and do the same for the FROM lines in Dockerfile.frontend and
Dockerfile.langflow so future rebuilds pull an identical OS layer.
Dockerfile.frontend (1)
56-63: ⚡ Quick win

Wildcard COPY globs won’t abort here.

The runtime COPY ... next.config.* / postcss.config.* / tailwind.config.* / biome.json* won’t fail in this repo because those files exist in frontend/ and Dockerfile.frontend copies frontend/ into /opt/app-root/src in the builder stage before the runtime copies occur.

Optional: biome.json is only used by the biome lint/format scripts (not by next start), so the biome.json* runtime COPY could be removed to slim the image.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.frontend` around lines 56 - 63, The runtime Dockerfile COPY lines
using wildcards (the COPY --from=builder ... next.config.* postcss.config.*
tailwind.config.* biome.json* entries) can silently succeed if files are
missing; update Dockerfile.frontend to either copy exact filenames (e.g.,
next.config.js/ts, postcss.config.js, tailwind.config.js) instead of globs so
missing files cause a build error, and remove the runtime COPY of biome.json*
(it’s only used for lint/format) to slim the image. Locate the COPY entries
shown in the diff and replace the wildcard copies with explicit file names or
drop the biome.json* COPY.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/langflow-entrypoint.py`:
- Around line 44-46: The unconditional privilege drop in langflow-entrypoint.py
(os.setgid(1000); os.setuid(1000)) fails for non-root OpenShift UIDs; guard
these calls by checking the effective UID first (use os.geteuid() == 0) and only
call os.setgid and os.setuid when running as root (optionally log or handle
PermissionError around the calls for safety), so modify the block containing
os.setgid/os.setuid to execute only under that root check.

---

Nitpick comments:
In `@Dockerfile.backend`:
- Around line 120-121: The Dockerfile.backend contains a stale comment
suggesting the entrypoint may need to switch from 'gosu' to 'runuser' even
though scripts/backend-entrypoint.sh already uses runuser; remove that
note/comment from Dockerfile.backend to avoid confusion and keep docs consistent
with the actual entrypoint implementation (reference Dockerfile.backend and
scripts/backend-entrypoint.sh).
- Line 9: The Dockerfiles currently use the floating tag
"registry.access.redhat.com/ubi9/python-311:latest" (and similar ":latest" in
Dockerfile.frontend and Dockerfile.langflow), which makes builds
non-reproducible; update each FROM instruction to pin a specific versioned tag
or, preferably, an immutable digest (sha256) for the base image (replace
"registry.access.redhat.com/ubi9/python-311:latest" with a concrete tag or
digest), and do the same for the FROM lines in Dockerfile.frontend and
Dockerfile.langflow so future rebuilds pull an identical OS layer.

In `@Dockerfile.frontend`:
- Around line 56-63: The runtime Dockerfile COPY lines using wildcards (the COPY
--from=builder ... next.config.* postcss.config.* tailwind.config.* biome.json*
entries) can silently succeed if files are missing; update Dockerfile.frontend
to either copy exact filenames (e.g., next.config.js/ts, postcss.config.js,
tailwind.config.js) instead of globs so missing files cause a build error, and
remove the runtime COPY of biome.json* (it’s only used for lint/format) to slim
the image. Locate the COPY entries shown in the diff and replace the wildcard
copies with explicit file names or drop the biome.json* COPY.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: aa06ad01-1764-45ec-8a98-29f5b5d335a4

📥 Commits

Reviewing files that changed from the base of the PR and between 8f4e663 and 8c90ae0.

⛔ Files ignored due to path filters (2)

frontend/package-lock.json is excluded by !**/package-lock.json
uv.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

.dockerignore
Dockerfile.backend
Dockerfile.frontend
Dockerfile.langflow
frontend/package.json
pyproject.toml
scripts/backend-entrypoint.sh
scripts/langflow-entrypoint.py

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

Dockerfile.langflow (1)

9-15: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Remove build-only toolchain from the final runtime image.

git, gcc, gcc-c++, and make are left installed after SQLite build, which unnecessarily expands runtime attack surface and vulnerability footprint. Keep them only for build, then uninstall before finalizing the layer.

🔧 Suggested hardening

-RUN dnf install -y --allowerasing \
+RUN dnf install -y --allowerasing \
     git \
     gcc \
     gcc-c++ \
     make \
     ca-certificates \
-    && dnf clean all
+    && dnf clean all
@@
 RUN curl -L https://www.sqlite.org/2024/sqlite-autoconf-3460000.tar.gz | tar -xz \
     && cd sqlite-autoconf-3460000 \
     && ./configure --prefix=/usr --libdir=/usr/lib64 \
     && make -j$(nproc) install \
     && cd .. \
-    && rm -rf sqlite-autoconf-3460000
+    && rm -rf sqlite-autoconf-3460000 \
+    && dnf remove -y git gcc gcc-c++ make \
+    && dnf clean all

Also applies to: 17-24

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.langflow` around lines 9 - 15, The runtime image currently keeps
build-only packages (git, gcc, gcc-c++, make) after building SQLite; remove them
or move the build into a separate stage. Modify the Dockerfile RUN that installs
"git gcc gcc-c++ make ca-certificates" so that either (a) you perform the SQLite
build in a dedicated builder stage and only copy the resulting artifacts into
the final stage, or (b) uninstall build packages immediately after build with
dnf remove git gcc gcc-c++ make && dnf clean all (preserving ca-certificates),
ensuring only runtime dependencies remain; apply the same change for the other
install block that contains those packages.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@Dockerfile.langflow`:
- Around line 9-15: The runtime image currently keeps build-only packages (git,
gcc, gcc-c++, make) after building SQLite; remove them or move the build into a
separate stage. Modify the Dockerfile RUN that installs "git gcc gcc-c++ make
ca-certificates" so that either (a) you perform the SQLite build in a dedicated
builder stage and only copy the resulting artifacts into the final stage, or (b)
uninstall build packages immediately after build with dnf remove git gcc gcc-c++
make && dnf clean all (preserving ca-certificates), ensuring only runtime
dependencies remain; apply the same change for the other install block that
contains those packages.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 53c2333a-8d12-42a3-9f90-f0e7f994cedb

📥 Commits

Reviewing files that changed from the base of the PR and between 8902d1d and ae73229.

📒 Files selected for processing (1)

Dockerfile.langflow

…rity improvements (#1714) * feat: migrate to UBI 9 base images for enterprise compliance * fix: update scripts/backend-entrypoint.sh for UBI9 compliance * fix: changed microdnf to dnf for ubi9 compatability * fix: Added --allowerasing flag to resolve curl-minimal conflict * fix: updated files * fix: mitigate backend and frontend CVEs by tightening dependency versions and removing runtime pip * fix: remediate frontend CVE dependency overrides and harden backend runtime image * fix: remediate dependency CVEs and reduce runtime image surface * fix: harden backend and frontend runtime images for CVE remediation * fix: apply comprehensive CVE fixes for backend and frontend containers * fix: explicitly copy package-lock.json to resolve npm ci build failure * fix: allow package.json and package-lock.json in Docker build context * fix: resolve CVEs across backend and frontend containers * fix: resolve CVE's * fix: resolve OSS CVE's * fix: resolve frontend CVEs * fix: upgrade system packages and nodemon dependencies to resolve issues * fix: add pysqlite3-binary to resolve SQLite version incompatibility * fix: resolved sqlite error * Update scripts/langflow-entrypoint.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: fixed path issues * Update Dockerfile.langflow Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: resolve UBI9 mem0 permission crash, preserve entrypoint, and pin base images * fix: UBI9 mem0 crash * fix: resolved dotenv issue * Fixed permission and wheel issue with langflow and backend * style: ruff autofix (auto) * changed langflow to 1.9.6.rc0 * fix image version * Reduce images size --------- Co-authored-by: Gautham N Pai <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Lucas Oliveira <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

…rity improvements (#1738) * feat: Migrate to UBI 9 base images for enterprise compliance and security improvements (#1714) * feat: migrate to UBI 9 base images for enterprise compliance * fix: update scripts/backend-entrypoint.sh for UBI9 compliance * fix: changed microdnf to dnf for ubi9 compatability * fix: Added --allowerasing flag to resolve curl-minimal conflict * fix: updated files * fix: mitigate backend and frontend CVEs by tightening dependency versions and removing runtime pip * fix: remediate frontend CVE dependency overrides and harden backend runtime image * fix: remediate dependency CVEs and reduce runtime image surface * fix: harden backend and frontend runtime images for CVE remediation * fix: apply comprehensive CVE fixes for backend and frontend containers * fix: explicitly copy package-lock.json to resolve npm ci build failure * fix: allow package.json and package-lock.json in Docker build context * fix: resolve CVEs across backend and frontend containers * fix: resolve CVE's * fix: resolve OSS CVE's * fix: resolve frontend CVEs * fix: upgrade system packages and nodemon dependencies to resolve issues * fix: add pysqlite3-binary to resolve SQLite version incompatibility * fix: resolved sqlite error * Update scripts/langflow-entrypoint.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: fixed path issues * Update Dockerfile.langflow Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: resolve UBI9 mem0 permission crash, preserve entrypoint, and pin base images * fix: UBI9 mem0 crash * fix: resolved dotenv issue * Fixed permission and wheel issue with langflow and backend * style: ruff autofix (auto) * changed langflow to 1.9.6.rc0 * fix image version * Reduce images size --------- Co-authored-by: Gautham N Pai <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Lucas Oliveira <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fixed documents.ts * update timeout on tests * fixed frontend image * chore: update uv.lock files after version bump * fix coderabbit * fix dockerfile langflow and deployment * fix cves * fix frontend docker * fixed frontend vulnerability and langflow not working * fix dockerfile langflow and entrypoint removing all unnecessary changes * fix langflow dockerfile * style: ruff autofix (auto) * revert deployment and fix backend --------- Co-authored-by: Gautham N Pai <[email protected]> Co-authored-by: Gautham N Pai <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Edwin Jose <[email protected]>

* feat: Migrate to UBI 9 base images for enterprise compliance and security improvements (#1714) * feat: migrate to UBI 9 base images for enterprise compliance * fix: update scripts/backend-entrypoint.sh for UBI9 compliance * fix: changed microdnf to dnf for ubi9 compatability * fix: Added --allowerasing flag to resolve curl-minimal conflict * fix: updated files * fix: mitigate backend and frontend CVEs by tightening dependency versions and removing runtime pip * fix: remediate frontend CVE dependency overrides and harden backend runtime image * fix: remediate dependency CVEs and reduce runtime image surface * fix: harden backend and frontend runtime images for CVE remediation * fix: apply comprehensive CVE fixes for backend and frontend containers * fix: explicitly copy package-lock.json to resolve npm ci build failure * fix: allow package.json and package-lock.json in Docker build context * fix: resolve CVEs across backend and frontend containers * fix: resolve CVE's * fix: resolve OSS CVE's * fix: resolve frontend CVEs * fix: upgrade system packages and nodemon dependencies to resolve issues * fix: add pysqlite3-binary to resolve SQLite version incompatibility * fix: resolved sqlite error * Update scripts/langflow-entrypoint.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: fixed path issues * Update Dockerfile.langflow Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix: resolve UBI9 mem0 permission crash, preserve entrypoint, and pin base images * fix: UBI9 mem0 crash * fix: resolved dotenv issue * Fixed permission and wheel issue with langflow and backend * style: ruff autofix (auto) * changed langflow to 1.9.6.rc0 * fix image version * Reduce images size --------- Co-authored-by: Gautham N Pai <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Lucas Oliveira <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fixed documents.ts * update timeout on tests * fixed frontend image * chore: update uv.lock files after version bump * fix coderabbit * fix dockerfile langflow and deployment * fix cves * fix frontend docker * fixed frontend vulnerability and langflow not working * fix dockerfile langflow and entrypoint removing all unnecessary changes * fix langflow dockerfile * style: ruff autofix (auto) * revert deployment and fix backend * Update uv.lock * fix * revert TS SDK to release-cpd; The branch carried the SDK half of #1666 (filter_id delete/search scoping) without the backend half, so the two new Knowledge Filters integration tests failed (HTTP 422, unscoped results). Reset documents.ts, types.ts and integration.test.ts to match release-cpd --------- Co-authored-by: Gautham N Pai <[email protected]> Co-authored-by: Gautham N Pai <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Lucas Oliveira <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Gautham N Pai added 19 commits May 25, 2026 12:31

feat: migrate to UBI 9 base images for enterprise compliance

e44d8d0

fix: update scripts/backend-entrypoint.sh for UBI9 compliance

064472d

fix: changed microdnf to dnf for ubi9 compatability

d9fdd62

fix: Added --allowerasing flag to resolve curl-minimal conflict

39ea42d

fix: updated files

40baafc

fix: mitigate backend and frontend CVEs by tightening dependency vers…

35cc124

…ions and removing runtime pip

fix: remediate frontend CVE dependency overrides and harden backend r…

eacfa00

…untime image

fix: remediate dependency CVEs and reduce runtime image surface

300dd88

fix: harden backend and frontend runtime images for CVE remediation

2d3a2a1

fix: apply comprehensive CVE fixes for backend and frontend containers

200409d

fix: explicitly copy package-lock.json to resolve npm ci build failure

b547ed9

fix: allow package.json and package-lock.json in Docker build context

4c98dd4

fix: resolve CVEs across backend and frontend containers

b38192e

fix: resolve CVE's

6c165be

fix: resolve OSS CVE's

7508a0f

fix: resolve frontend CVEs

35cf6fb

fix: upgrade system packages and nodemon dependencies to resolve issues

24aa802

fix: add pysqlite3-binary to resolve SQLite version incompatibility

222e5d0

fix: resolved sqlite error

8c90ae0

github-actions Bot added community frontend 🟨 Issues related to the UI/UX docker and removed community labels May 29, 2026

github-actions Bot added the enhancement 🔵 New feature or request label May 29, 2026

coderabbitai Bot reviewed May 29, 2026

View reviewed changes

Comment thread scripts/langflow-entrypoint.py Outdated

Update scripts/langflow-entrypoint.py

376eeb3

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

github-actions Bot added enhancement 🔵 New feature or request and removed enhancement 🔵 New feature or request labels May 29, 2026

github-actions Bot added enhancement 🔵 New feature or request and removed enhancement 🔵 New feature or request labels Jun 1, 2026

lucaseduoli added 2 commits June 2, 2026 10:23

changed langflow to 1.9.6.rc0

84e8485

Merge remote-tracking branch 'origin/main' into fix_ubi9-migration_v3

ae73229

github-actions Bot added enhancement 🔵 New feature or request and removed enhancement 🔵 New feature or request labels Jun 2, 2026

coderabbitai Bot reviewed Jun 2, 2026

View reviewed changes

fix image version

e4f580b

github-actions Bot added enhancement 🔵 New feature or request and removed enhancement 🔵 New feature or request labels Jun 2, 2026

Reduce images size

53cc2aa

github-actions Bot added enhancement 🔵 New feature or request and removed enhancement 🔵 New feature or request labels Jun 2, 2026

lucaseduoli changed the base branch from main to fix/ubi9_images June 2, 2026 19:30

github-actions Bot removed the enhancement 🔵 New feature or request label Jun 2, 2026

lucaseduoli merged commit c28b2d0 into langflow-ai:fix/ubi9_images Jun 2, 2026
15 of 17 checks passed

github-actions Bot added the enhancement 🔵 New feature or request label Jun 2, 2026

coderabbitai Bot mentioned this pull request Jun 2, 2026

feat: Migrate to UBI 9 base images for enterprise compliance and security improvements #1738

Merged

gnPy deleted the fix_ubi9-migration_v3 branch June 11, 2026 13:10

coderabbitai Bot mentioned this pull request Jun 24, 2026

fix: switch the images to ubi10 #1961

Merged

gnPy self-assigned this Jul 2, 2026

coderabbitai Bot mentioned this pull request Jul 2, 2026

fix: remediate image_scan CVEs in backend, frontend, and langflow images #2000

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Migrate to UBI 9 base images for enterprise compliance and security improvements#1714

feat: Migrate to UBI 9 base images for enterprise compliance and security improvements#1714
lucaseduoli merged 32 commits into
langflow-ai:fix/ubi9_imagesfrom
gnPy:fix_ubi9-migration_v3

gnPy commented May 29, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 29, 2026 •

edited

Loading

Reviews paused

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

gnPy commented May 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gnPy commented May 29, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 29, 2026 •

edited

Loading