From 3f4edb7850b666c663a19b592ffb413ffbd0de00 Mon Sep 17 00:00:00 2001
From: Sachin Rathod <sachin.rathod@spotdraft.com>
Date: Wed, 5 Aug 2026 22:53:34 +0530
Subject: [PATCH] chore: migrate base images to Chainguard (amd64)

Replace public base images with Chainguard equivalents from cgr.dev/spotdraft.com.
- Uses -fips variants where available
- Build stages use :latest-dev (shell available)
- Runtime stages use :latest (minimal)
- Platform pinned to linux/amd64
---
 api-frontend/Dockerfile    | 3 +--
 cluster-manager/Dockerfile | 3 +--
 core-builder/Dockerfile    | 3 +--
 engine/Dockerfile          | 3 +--
 wrappers-docker/Dockerfile | 4 ++--
 5 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/api-frontend/Dockerfile b/api-frontend/Dockerfile
index a0045b48a3..8580da07d1 100644
--- a/api-frontend/Dockerfile
+++ b/api-frontend/Dockerfile
@@ -1,4 +1,4 @@
-FROM openjdk:8u171-jre-alpine3.7
+FROM --platform=linux/amd64 cgr.dev/spotdraft.com/jdk-fips:8
 
 ARG APP_VERSION=UNKOWN_VERSION
 
@@ -6,4 +6,3 @@ COPY /target/seldon-apife-${APP_VERSION}.jar app.jar
 COPY /target/generated-resources /licenses/
 
 ENTRYPOINT [ "sh", "-c", "java -Djava.security.egd=file:/dev/./urandom $JAVA_OPTS -jar app.jar $SPRING_OPTS" ]
-
diff --git a/cluster-manager/Dockerfile b/cluster-manager/Dockerfile
index 7e88d442b4..cd1a9289b6 100644
--- a/cluster-manager/Dockerfile
+++ b/cluster-manager/Dockerfile
@@ -1,4 +1,4 @@
-FROM openjdk:8u171-jre-alpine3.7
+FROM --platform=linux/amd64 cgr.dev/spotdraft.com/jdk-fips:8
 
 ARG APP_VERSION=UNKOWN_VERSION
 
@@ -6,4 +6,3 @@ COPY /target/seldon-cluster-manager-${APP_VERSION}.jar app.jar
 COPY /target/generated-resources /licenses/
 
 ENTRYPOINT [ "sh", "-c", "java -Djava.security.egd=file:/dev/./urandom $JAVA_OPTS -jar app.jar $SPRING_OPTS" ]
-
diff --git a/core-builder/Dockerfile b/core-builder/Dockerfile
index 812b2c4987..06558a077f 100644
--- a/core-builder/Dockerfile
+++ b/core-builder/Dockerfile
@@ -1,4 +1,4 @@
-FROM openjdk:8u141-jdk
+FROM --platform=linux/amd64 cgr.dev/spotdraft.com/jdk-fips:8-dev
 
 # install docker
 RUN \
@@ -37,4 +37,3 @@ WORKDIR /work
 
 # Define default command.
 CMD ["bash"]
-
diff --git a/engine/Dockerfile b/engine/Dockerfile
index 5bdfbb983f..89ab41dceb 100644
--- a/engine/Dockerfile
+++ b/engine/Dockerfile
@@ -1,4 +1,4 @@
-FROM openjdk:8u171-jre-alpine3.7
+FROM --platform=linux/amd64 cgr.dev/spotdraft.com/jdk-fips:8
 
 ARG APP_VERSION=UNKOWN_VERSION
 
@@ -8,4 +8,3 @@ COPY /target/seldon-engine-${APP_VERSION}.jar app.jar
 COPY /target/generated-resources /licenses/
 
 ENTRYPOINT [ "sh", "-c", "java -Djava.security.egd=file:/dev/./urandom $JAVA_OPTS -jar app.jar" ]
-
diff --git a/wrappers-docker/Dockerfile b/wrappers-docker/Dockerfile
index bd8754e908..0e443a9de1 100644
--- a/wrappers-docker/Dockerfile
+++ b/wrappers-docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:2.7.14-jessie
+FROM --platform=linux/amd64 cgr.dev/spotdraft.com/python-fips:2.7.14-dev
 
 COPY _wrappers /wrappers
 
@@ -33,4 +33,4 @@ RUN pip install numpy requests redis flask
 WORKDIR /wrappers/python
 
 ENTRYPOINT ["python","wrap_model.py"]
-CMD []
\ No newline at end of file
+CMD []