MLE-32187 Release/docker 2.3.0 - #483
Merged
Merged
Conversation
- Remove broad microdnf update that was advancing glibc incompatibly - Upgrade glibc explicitly before installing pinned libnsl from AlmaLinux - Use libnsl-2.28-251.el8_10.31 matching current glibc in UBI repos - Add targeted microdnf upgrade for tzdata only - Update copilot instructions with External RPM pinning guidance
…dency MLE-28076: stabilize UBI libnsl dependency against glibc updates
… filtering - Use actual cluster name from /manage/v2/properties instead of hardcoded group name in dynamic-host-token, dynamic-hosts GET and DELETE URLs - Add Get Local Cluster Name keyword using /manage/v2/properties?format=json with dedicated ClusterNameSession alias to avoid overwriting callers' sessions - Filter dynamic host IDs by group membership via /manage/v2/hosts?group-id= to correctly count per-group dynamic hosts when multiple groups are in use - Fix Remove All Dynamic Hosts to send correct XML body to DELETE endpoint: namespace http://marklogic.com/manage/dynamic-host with <dynamic-host> children - Fix Dynamic Host Join Fails After Token Revoked to use correct port 7102 (was 8002) and resolve cluster name dynamically - Fix libnsl RPM URL in marklogic-deps-ubi:base: 8/BaseOS -> 8.10/BaseOS (cherry-picked from MLE-28076 and corrected)
…-cluster-name MLE-28088: Fix dynamic host tests using cluster name instead of group name
…esults MLE-28094: Fix stale test results causing false UNSTABLE builds
PDP-536: extend filesexcluded in .copyrightconfig
PDP-536: Adding copyright check
* Add internal ECR publishing for K8s tests * fix typo * chore: derive ECR registry URL via STS instead of hardcoded account ID Remove the global kubeNinjasEcrRegistry = '308453789681.dkr.ecr.us-west-1.amazonaws.com' constant. Instead, resolve the AWS account ID at runtime inside the existing KUBE_NINJAS_OPS_AWS_JENKINS withCredentials block using: aws sts get-caller-identity --query Account --output text This eliminates the hardcoded account number and is consistent with the approach used in marklogic-operator-kubernetes Jenkinsfile. --------- Co-authored-by: Vitaly Korolev <vitaly.korolev@marklogic.com>
Add explicit region Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* add missing python3 lib for root image * fix some bugs and update README * update lbnsl for UBI8 * review of the README * rewording in README * add lightweight test for gdb and python3 * fix issue with tzdata install * sync with develop branch * add microdnf clean all * fix TZ issue * fix gliches * try fix issue with timezone * fix test for gdb * fix structure-tests.yaml
MLE-27788: add tests for dynamic-host api changes
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
PR #423 removed redhat-lsb-core unconditionally from the UBI8 deps image. Both MarkLogic 10 and 11 RPMs require the lsb-core-amd64 package it provides; ML12 does not. Restore redhat-lsb-core to the main microdnf install line so it is present for all ML versions on UBI8. The ML10 conditional block is retained for libstdc++.i686 only.
…c-host-api-changes MLE-27788 add tests for dynamic host api changes
* review lib for stack trace and enable gdp for rootless * Update dockerFiles/add mising microdnf clean Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix tzdata install * fix TZ issue * fix gliches * new fix for tzdata * fix test --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
MLE-28295: restore redhat-lsb-core for UBI8 images
…om-develop PDP-1182: Remove per-repo pr-workflow.yaml
Replace hardcoded emailList and emailSecList global variables with a loadEmailConfig() helper that reads both values from the KUBE_NINJAS_PIPELINE_EMAILS Jenkins secret file credential at runtime. The emailList pipeline parameter is kept as an optional override at the bottom of the parameter list; when left blank the credential value is used, preserving the existing override behaviour for ad-hoc build runs.
MLE-28391: Update Docker base UBI images to the latest
…in-secret MLE-3247: Load pipeline notification emails from Jenkins secret file
MLE-29711: Upgrade Docker UBI9 base image from 9.7 to 9.8
…pyright-symbol MLE-28426: Copyright validator fails due to mismatch in (c) symbol
* update hardening section
MLE-32285 remove duplicate commands
…op-level agent Holding a top-level cld-docker agent for the whole pipeline while SCAP-Scan/Structure-Tests/Docker-Run-Tests still declared their own agent caused two nodes of the same scarce label pool to be held at once (and left the x86 executor idle during graviton stages), risking queue deadlock under load. Reverted to agent none and grouped the always-cld-docker stages that never overlap with the graviton stages into two nested-stage blocks (Prepare-Build-Lint-Scan, Publish-And-Scan), each with its own agent scoped to just that group and released before the next stage needs a different node.
Resolves the base image from the matching marklogic-deps Dockerfile's FROM line (so it always matches whatever is currently pinned) and passes it as BASE_IMAGE_TO_EXCLUDE, enabling the downstream pipeline's additional filtered scan that excludes base image components.
contains('ubi9-arm') doesn't match 'ubi9-rootless-arm' since it's not a
contiguous substring, so that variant incorrectly fell back to the non-arm
ubi9 deps Dockerfile. Check ubi9 and arm independently instead.
…ents MLE-32297: Consolidate Jenkins pipeline stage agents
…lackduck-scan MLE-32332: pass pinned UBI base image to BlackDuck scan job
…sion MLE-32187 Increment Docker version
MLE-32368 Update NOTICE.txt
MLE-32187 Add SBOM file for each image type
vitalykorolev
requested review from
barkhachoithani,
pengzhouml,
rwinieski and
sumanthravipati
and
a lite review from Copilot
September 9, 2026 20:10
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
It introduces multiple CI/doc correctness issues (broken make docker-tests helper path, copy/paste-breaking README examples, invalid compose YAML referenced by tests, and a Jenkinsfile env-var reference risk) that are likely to fail automation or mislead users.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Release PR for MarkLogic Docker 2.3.0, updating image build/test infrastructure (including ARM variants), expanding debug/stack-trace support (gdb/python/ptrace guidance), and refreshing the Robot/structure tests and documentation to match the new release.
Changes:
- Add ARM build support and update CI pipeline/build logic (Makefile + Jenkinsfile) including platform selection and artifact handling.
- Update images/tests/docs for improved crash diagnostics (gdb/python availability, SYS_PTRACE documentation) and refresh dependency base images (UBI8/UBI9).
- Rework/expand Robot test suite and compose-based scenarios for this release (IDs, new cluster/dynamic-host coverage, updated image/version defaults).
File summaries
| File | Description |
|---|---|
test/structure-test.yaml |
Adds structure assertions for gdb/python3 presence and fixes gid indentation. |
test/keywords.resource |
Updates test defaults for 2.3.0/11.3.7, improves latency tooling install logic, and adds dynamic-host/cluster helper keywords. |
test/docker-tests.robot |
Renames tests with IDs/tags, updates compose scenario references, and adds new coupled-cluster API tests. |
test/compose-test-2.yaml |
Removes obsolete compose-test scenario file. |
test/compose-test-12.yaml |
Removes obsolete compose-test scenario file. |
test/compose-test-14.yaml |
Removes obsolete compose-test scenario file. |
test/compose-test-15.yaml |
Removes obsolete compose-test scenario file. |
test/compose-3core-11dynamic-hosts.yaml |
Updates header/comments for dynamic-host compose topology used by tests. |
test/compose-2x2node-clusters-secrets.yaml |
Adds new compose scenario for coupled-cluster tests (needs YAML indentation fix). |
test/compose-2node-second-uninitialized.yaml |
Updates header/comments for compose scenario referenced by tests. |
test/compose-2node-second-uncoupled.yaml |
Updates header/comments for compose scenario referenced by tests. |
test/compose-2node-join-https-secrets.yaml |
Updates header/comments for HTTPS join scenario referenced by tests. |
test/compose-2node-join-https-missing-cacert.yaml |
Updates header/comments for negative HTTPS join scenario referenced by tests. |
test/compose-2node-join-https-invalid-tls.yaml |
Updates header/comments for negative HTTPS join scenario referenced by tests. |
test/compose-2node-join-enode-secrets.yaml |
Updates header/comments for join-to-enode scenario referenced by tests. |
test/compose-2node-invalid-bootstrap-host.yaml |
Updates header/comments for invalid bootstrap scenario referenced by tests. |
test/compose-2node-cluster-env-creds.yaml |
Updates header/comments for env-creds cluster scenario referenced by tests. |
test/compose-2node-bootstrap-only.yaml |
Updates header/comments for bootstrap-only scenario referenced by tests. |
test/compose-1node-self-join.yaml |
Updates header/comments for self-join negative scenario referenced by tests. |
test/compose-1node-bootstrap-env-creds.yaml |
Updates header/comments for single-node bootstrap scenario referenced by tests. |
src/scripts/start-marklogic.sh |
Adds new env vars to persist into marklogic.conf. |
src/scripts/start-marklogic-rootless.sh |
Adds new env vars to persist into marklogic.conf (rootless). |
README.md |
Adds SYS_PTRACE documentation and updates examples/compose snippets (some examples are currently not copy/paste safe). |
NOTICE.txt |
Updates NOTICE content/versioning for 2.3.0 and expands third-party notices. |
Makefile |
Adds platform selection + ARM emulation, improves SCAP handling, and introduces docker test ID helper (currently broken path resolution). |
LICENSE.txt |
Updates copyright header format. |
Jenkinsfile |
Major CI updates: ARM support, agent restructuring, secure email config loading, build-branch normalization, publishing/scanning workflow changes. |
dockerFiles/marklogic-server-ubi9-arm:base |
Adds new ARM server image Dockerfile. |
dockerFiles/marklogic-server-ubi:base |
Adds new env vars and adjusts package removal list to retain debug deps. |
dockerFiles/marklogic-server-ubi-rootless:base |
ARM-aware tini fetch; adds gdb capability setup; adjusts package removal list. |
dockerFiles/marklogic-deps-ubi9:base |
Updates UBI9 base version, pins libnsl from Rocky, and installs debug/runtime deps. |
dockerFiles/marklogic-deps-ubi9-arm:base |
Adds new ARM deps image Dockerfile. |
dockerFiles/marklogic-deps-ubi:base |
Updates UBI8 base version, pins libnsl from Rocky, and installs debug/runtime deps. |
docker-compose/marklogic-single-node.yaml |
Updates copyright header. |
docker-compose/marklogic-multi-node.yaml |
Updates copyright header. |
.github/PULL_REQUEST_TEMPLATE.md |
Minor formatting/indent fix. |
.github/copilot-instructions.md |
Adds guidance for external RPM pinning and dependency image validation. |
.copyrightconfig |
Adds copyright validation configuration + exclusion list. |
Review details
- Files reviewed: 37/44 changed files
- Comments generated: 5
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
rwinieski
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This is the release PR for Docker 2.3.0
Checklist:
Owner:
JIRA_ID as part of branch/PR name
Rebase the branch with upstream
Squashed all commits into a single commit
Added Tests
Reviewer:
Reviewed Tests
Added to Release Wiki/Jira