feat: add bubblewrap to UDI 9 / 10

[ibuziuk]

https://github.com/containers/bubblewrap - Low-level unprivileged sandboxing tool used by Flatpak and similar projects

Summary by CodeRabbit

• New Features
  • Added bubblewrap (bwrap) sandboxing to the UBI 9 and UBI 10 container images, installed from a pinned release with integrity verification.
• Chores
  • Reduced image size by removing build dependencies and cleaning package manager metadata/caches after installing bubblewrap.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ibuziuk

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Walkthrough

Bubblewrap 0.11.2 is downloaded, checksum-verified, compiled with Meson and Ninja, and installed with setuid permissions in the universal UBI 9 and UBI 10 Dockerfiles. Build dependencies and DNF cache data are removed afterward.

Changes

Universal image bubblewrap builds

Layer / File(s)	Summary
Build and install bubblewrap universal/ubi9/Dockerfile, universal/ubi10/Dockerfile	Both image builds compile the pinned bubblewrap source release, verify its SHA256 checksum, install /usr/bin/bwrap with mode 4755, and clean up build dependencies and DNF state.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: svor, dkwon17, sdawley

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding bubblewrap to the UBI 9/10 images.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bubblewrap

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
• /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
• /che-ai-assistant help — Show this help message

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@universal/ubi9/Dockerfile`:
- Around line 583-584: Remove gcc from the dnf remove list in both bubblewrap
cleanup blocks, preserving removal of meson, ninja-build, and libcap-devel.
Update universal/ubi9/Dockerfile lines 583-584 and universal/ubi10/Dockerfile
lines 616-617; no other cleanup behavior should change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9a014407-478e-40ea-b04b-1efce9ecc203

📥 Commits

Reviewing files that changed from the base of the PR and between 5c3298c and 762ab14.

📒 Files selected for processing (2)

• universal/ubi10/Dockerfile
• universal/ubi9/Dockerfile

[coderabbitai]

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

dnf remove includes gcc in both Dockerfiles — breaks the C/C++ toolchain installed earlier. Both bubblewrap blocks remove gcc via dnf remove, but gcc was installed earlier for the C/C++ toolchain (gcc gcc-c++ at Line 131 in UBI 9, Line 133 in UBI 10). Removing gcc cascades to gcc-c++ (RPM dependency) and potentially php-devel and other -devel packages, breaking the image's developer-tool contract.

• universal/ubi9/Dockerfile#L583-L584: Remove gcc from the dnf remove list — change to dnf remove -y meson ninja-build libcap-devel.
• universal/ubi10/Dockerfile#L616-L617: Same fix — change to dnf remove -y meson ninja-build libcap-devel.

📍 Affects 2 files

• universal/ubi9/Dockerfile#L583-L584 (this comment)
• universal/ubi10/Dockerfile#L616-L617

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@universal/ubi9/Dockerfile` around lines 583 - 584, Remove gcc from the dnf
remove list in both bubblewrap cleanup blocks, preserving removal of meson,
ninja-build, and libcap-devel. Update universal/ubi9/Dockerfile lines 583-584
and universal/ubi10/Dockerfile lines 616-617; no other cleanup behavior should
change.

[github-actions]

Pull Request UBI 10 images published ✨

Base: quay.io/devfile/base-developer-image:ubi10-pr-262
UDI: quay.io/devfile/universal-developer-image:ubi10-pr-262

[github-actions]

Pull Request images published ✨

Base: quay.io/devfile/base-developer-image:pr-262
UDI: quay.io/devfile/universal-developer-image:pr-262