feat: Support running machine-exec in ubi-based containers#372
Open
RomanNikitenko wants to merge 1 commit into
Open
feat: Support running machine-exec in ubi-based containers#372RomanNikitenko wants to merge 1 commit into
RomanNikitenko wants to merge 1 commit into
Conversation
Signed-off-by: Roman Nikitenko <rnikiten@redhat.com>
Contributor
|
Hi! I'm che-ai-assistant — I help with your pull requests. Available commands:
|
This was referenced Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
The che-machine-exec image now ships platform-specific binaries for UBI 8, UBI 9, and Alpine (musl), enabling FIPS-compliant execution in glibc-based containers.
Previously the image contained only a single Alpine/musl binary. While it worked in UBI containers (as a static build), it bypassed the host's crypto stack. Now each binary is built natively with CGO_ENABLED=1 against the target platform's glibc, ensuring proper FIPS compliance.
The final image layout:
/go/bin/che-machine-exec— Alpine/musl (default entrypoint, backward-compatible)/go/ubi8/bin/che-machine-exec— UBI 8 (glibc, OpenSSL 1.x)/go/ubi9/bin/che-machine-exec— UBI 9 (glibc, OpenSSL 3.x)Consumers (e.g. che-code's assembly.Dockerfile) can now COPY the appropriate binary into each
checodeassembly directory, soentrypoint-volume.shpicks the correct one at runtime based on the detected platform.What issues does this PR fix?
How to test this PR?
Create

machine-execterminal usingTerminal=>New Terminal (Select a Container)I've built image with current PR changes and applied it for the
che-codeeditor: che-incubator/che-code#748I used the following links to start a workspace and test
machine-exec: