build: migrate to hardened/hummingbird base image

[platex-rehor-bot]

Description

Migrate the Dockerfile to use hardened/hummingbird FIPS-compliant container base images, aligning with the organizational standard already adopted by other RedHatInsights Go services (insights-ingress-go, export-service-go, chrome-service-backend, scheduler).

RHCLOUD-48962

---

How to test locally

1. Build the Docker image: docker build -t quickstarts:test .
2. Verify the image runs: docker run --rm quickstarts:test --help
3. Confirm the binary is FIPS-compliant by checking linked crypto libraries

---

Anything reviewers should know?

Key changes:

• Builder stage: ubi9/go-toolset:1.26.2 → hi/go:latest-fips-builder with USER 0, WORKDIR /workspace
• Runtime stage: ubi9-minimal:latest → hi/go:latest-fips
• CGO: Switched from CGO_ENABLED=0 to CGO_ENABLED=1 (required for FIPS-compliant crypto via BoringSSL)
• Deps: Replaced deprecated go get -d -v with go mod download for dependency caching
• Build flags: Added -ldflags "-w -s" for smaller binaries
• Removed: GO111MODULE=on (default since Go 1.16), GOTOOLCHAIN=go1.26.3 (hummingbird manages its own Go toolchain)
• Paths: All COPY --from=builder paths updated from $GOPATH to /workspace/

Renovate is already configured and will handle base image tag pinning automatically.

---

Checklist

• Tests: new/updated tests cover the change
• API: spec updated if endpoints changed (or N/A)
• Migrations: backwards compatible if schema changed (or N/A)
• Dependencies: no known impact to dependent services
• Security: reviewed against secure coding checklist (or N/A)

AI disclosure

Assisted by: Claude Code (Anthropic)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: ce3a2f30-cf7a-4c7f-80fb-85261d51cda3

📥 Commits

Reviewing files that changed from the base of the PR and between 441594b and 6f76c78.

📒 Files selected for processing (1)

• Dockerfile

---

Summary by CodeRabbit

• New Features

  • Updated the container image build to use a new runtime and builder base, with improved dependency caching and build steps.
  • Added a default startup command and exposed port 8000 for the application container.

• Bug Fixes

  • Adjusted the build process to produce runtime binaries in the final image more reliably.
  • Enabled CGO during compilation to better match the new container environment.

Walkthrough

The Dockerfile's multi-stage build was reworked: the builder stage now uses a FIPS-compliant base image with a /workspace directory and go mod download caching, the build/test command sequence and binary output paths changed, and the runtime stage uses a new base image with updated artifact paths plus added CMD and EXPOSE directives.

Changes

Dockerfile Build Rework

Layer / File(s)	Summary
Builder base image and dependency caching Dockerfile	Builder base image switched to a FIPS builder image, user set to 0, working directory changed to /workspace, and dependency caching updated to copy go.mod/go.sum and run go mod download before copying the rest of the source.
Build/test sequence, binary compilation, and runtime stage Dockerfile	Reordered/trimmed make and go commands, changed CGO_ENABLED to 1 with new binary output names/locations, switched the runtime base image, updated artifact copy paths from the builder /workspace, and added CMD and EXPOSE directives.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: migrating the build to hardened/hummingbird base images.
Description check	✅ Passed	The description includes all required template sections, a tracking issue, testing steps, checklist items, and AI disclosure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[florkbr]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.