Merged in ubi-tags (pull request #152)

DCCLIP-874: Build and push UBI tags for Confluence

* Support UBI tags


Approved-by: Yifei Zhang
Approved-by: Minh Tran

.hadolint.yaml

@@ -1,9 +1,12 @@
 ignored:
+  - DL3002 # root user in UBI Dockerfile
   - DL3005 # Package upgrades
   - DL3017 # Package upgrades
   - DL3006 # Version tagging
   - DL3008 # Pinning
   - DL3018 # Pinning
+  - DL3041 # dnf install latest packages
   - DL4006 # Pipefail
   - SC2006 # Quoting
   - SC2016 # Quoting
+  - SC2086 # Quoting

Dockerfile.ubi

@@ -0,0 +1,66 @@
+ARG BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17
+FROM ubuntu:22.04 as fonts
+RUN apt-get upgrade -y && apt-get update -y \
+    && apt-get install fonts-noto -y --no-install-recommends
+
+FROM $BASE_IMAGE
+USER root
+
+LABEL maintainer="dc-deployments@atlassian.com"
+LABEL securitytxt="https://www.atlassian.com/.well-known/security.txt"
+
+ENV APP_NAME                                        confluence
+ENV RUN_USER                                        confluence
+ENV RUN_GROUP                                       confluence
+ENV RUN_UID                                         2002
+ENV RUN_GID                                         2002
+ENV CONFLUENCE_HOME                                 /var/atlassian/application-data/confluence
+ENV CONFLUENCE_INSTALL_DIR                          /opt/atlassian/confluence
+ENV CONFLUENCE_LOG_STDOUT                           false
+ARG CONFLUENCE_VERSION
+ARG DOWNLOAD_URL=https://product-downloads.atlassian.com/software/confluence/downloads/atlassian-confluence-${CONFLUENCE_VERSION}.tar.gz
+ENV CONFLUENCE_VERSION                              ${CONFLUENCE_VERSION}
+
+WORKDIR $CONFLUENCE_HOME
+
+COPY entrypoint.py shutdown-wait.sh shared-components/image/entrypoint_helpers.py  /
+COPY shared-components/support /opt/atlassian/support
+COPY config/*                 /opt/atlassian/etc/
+COPY --from=fonts            /usr/share/fonts/truetype/noto/ /usr/share/fonts/truetype/noto
+
+RUN microdnf upgrade -y \
+             --refresh \
+             --best \
+             --nodocs \
+             --noplugins \
+             --setopt=install_weak_deps=0 \
+    && microdnf update -y \
+    && microdnf install -y --setopt=install_weak_deps=0 fontconfig python3 python3-jinja2 gzip procps-ng util-linux which \
+    && microdnf clean all
+
+RUN groupadd --gid ${RUN_GID} ${RUN_GROUP} \
+    && useradd --uid ${RUN_UID} --gid ${RUN_GID} --home-dir ${CONFLUENCE_HOME} --shell /bin/bash ${RUN_USER} \
+    && echo PATH=$PATH > /etc/environment \
+    && mkdir -p                                     ${CONFLUENCE_INSTALL_DIR} \
+    && curl -L --silent                             ${DOWNLOAD_URL} | tar -xz --strip-components=1 -C "${CONFLUENCE_INSTALL_DIR}" \
+    && chmod -R 550                                 ${CONFLUENCE_INSTALL_DIR}/ \
+    && chown -R ${RUN_USER}:root                    ${CONFLUENCE_INSTALL_DIR}/ \
+    && for dir in logs temp work; do \
+         chmod -R 770 ${CONFLUENCE_INSTALL_DIR}/${dir}; \
+       done \
+    && chown -R ${RUN_USER}:${RUN_GROUP} ${CONFLUENCE_HOME} \
+    && for file in "/opt/atlassian/support /entrypoint.py /entrypoint_helpers.py /shutdown-wait.sh"; do \
+       chmod -R "u=rwX,g=rX,o=rX" ${file} && \
+       chown -R root ${file}; done \
+    && sed -i -e 's/-Xms\([0-9]\+[kmg]\) -Xmx\([0-9]\+[kmg]\)/-Xms\${JVM_MINIMUM_MEMORY:=\1} -Xmx\${JVM_MAXIMUM_MEMORY:=\2} -Dconfluence.home=\${CONFLUENCE_HOME}/g' ${CONFLUENCE_INSTALL_DIR}/bin/setenv.sh \
+    && sed -i -e 's/-XX:ReservedCodeCacheSize=\([0-9]\+[kmg]\)/-XX:ReservedCodeCacheSize=${JVM_RESERVED_CODE_CACHE_SIZE:=\1}/g' ${CONFLUENCE_INSTALL_DIR}/bin/setenv.sh \
+    && sed -i -e 's/export CATALINA_OPTS/CATALINA_OPTS="\${CATALINA_OPTS} \${JVM_SUPPORT_RECOMMENDED_ARGS} -DConfluenceHomeLogAppender.disabled=${CONFLUENCE_LOG_STDOUT}"\n\nexport CATALINA_OPTS/g' ${CONFLUENCE_INSTALL_DIR}/bin/setenv.sh \
+    && mkdir -p ${JAVA_HOME}/lib/fonts/fallback/ \
+    && ln -sf /usr/share/fonts/truetype/noto/* ${JAVA_HOME}/lib/fonts/fallback/
+
+VOLUME ["${CONFLUENCE_HOME}"]
+
+EXPOSE 8090
+EXPOSE 8091
+
+ENTRYPOINT ["/entrypoint.py"]

README.md

@@ -482,13 +482,16 @@ For example to get the `7.8.0-beta1` EAP release, use `atlassian/confluence:7.8.
 For example, `atlassian/confluence:7.13-ubuntu-jdk11` will
 install the latest 7.13.x version with Eclipse Temurin OpenJDK 11.
 
-# Supported JDK versions
+# Supported JDK versions and base images
 
 All the Atlassian Docker images are generated from the
 [official Eclipse Temurin OpenJDK Docker images](https://hub.docker.com/_/eclipse-temurin).
 
+Starting from 8.5.6 [UBI based](https://catalog.redhat.com/software/containers/ubi9/openjdk-17/61ee7c26ed74b2ffb22b07f6?architecture=amd64) tags are published as well.
+Tags are available in 2 formats: `<version>-ubi9` and `<version>-ubi9-jdk17`.
+
 The build pipeline pushes both JDK11 and JDK17 tags for Confluence versions ranging from 7.19 to 8.9.
-Starting from 9.0 only JDK17 tags are published.
+Starting from 9.0 only JDK17 tags are published. UBI based tags are JDK17 only.
 
 The Docker images follow the [Atlassian Support end-of-life
 policy](https://confluence.atlassian.com/support/atlassian-support-end-of-life-policy-201851003.html);
@@ -503,6 +506,13 @@ updates or fixes.
 If for some reason you need a different version, see "Building your own image"
 above.
 
+# Migration to UBI
+
+If you have been mounting any files to `${JAVA_HOME}` directory in `eclipse-temurin` based container, `JAVA_HOME` in UBI JDK17 container is set to `/usr/lib/jvm/java-17`.
+
+Also, if you have been mounting and running any custom scripts in the container, UBI-based images may lack some tools and utilities that are available out of the box in eclipse-temurin tags. If that's the case, see "Building your own image".
+
+
 # Supported architectures
 
 Currently the Atlassian Docker images are built for the `linux/amd64` target

bitbucket-pipelines.yml

@@ -435,6 +435,206 @@ pipelines:
                   --push
 
 
+        - step:
+            name: JDK 17-ubi - Batch 1
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python  /usr/src/app/make-releases.py \
+                  --update \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='0' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 2
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python  /usr/src/app/make-releases.py \
+                  --update \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='1' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 3
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python  /usr/src/app/make-releases.py \
+                  --update \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='2' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 4
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python  /usr/src/app/make-releases.py \
+                  --update \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='3' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 5
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python  /usr/src/app/make-releases.py \
+                  --update \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='4' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 6
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python  /usr/src/app/make-releases.py \
+                  --update \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='5' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 7
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python  /usr/src/app/make-releases.py \
+                  --update \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='6' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 8
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python  /usr/src/app/make-releases.py \
+                  --update \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='7' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
 
     ######################################################################
     # All other branches & PRs; run unit tests & functional tests
@@ -463,6 +663,21 @@ pipelines:
               - py.test -v tests/
               - py.test -v shared-components/tests/
 
+        - step:
+            name: Run unit tests - UBI
+            image: python:3.7-alpine3.9
+            services:
+              - docker
+            script:
+              - apk add --no-cache git
+              - git submodule update --init --recursive
+              - pip install -q -r shared-components/tests/requirements.txt
+              - export PYTHONPATH=./shared-components/tests:$PYTHONPATH
+              - export DOCKERFILE='Dockerfile.ubi'
+              - export DOCKERFILE_VERSION_ARG='CONFLUENCE_VERSION'
+              - export MAC_PRODUCT_KEY='confluence'
+              - py.test -v tests/
+
         - step:
             name: Run integration tests
             services:
@@ -475,6 +690,18 @@ pipelines:
               - export IS_RELEASE=false
               - /usr/src/app/post_build.sh test-image $IS_RELEASE
 
+        - step:
+            name: Run integration tests - UBI
+            services:
+              - docker
+            script:
+              - apk add --no-cache git docker-compose jq curl
+              - git submodule update --init --recursive
+              - export CONFLUENCE_VERSION=`curl -s https://marketplace.atlassian.com/rest/2/products/key/confluence/versions | jq -r '._embedded.versions | .[0].name'`
+              - docker build --build-arg CONFLUENCE_VERSION=${CONFLUENCE_VERSION} -t test-image-ubi . -f Dockerfile.ubi
+              - export IS_RELEASE=false
+              - /usr/src/app/post_build.sh test-image-ubi $IS_RELEASE
+
   custom:
     ######################################################################
     # Custom: Do full release for each image flavour
@@ -892,6 +1119,206 @@ pipelines:
                   --push
 
 
+        - step:
+            name: JDK 17-ubi - Batch 1
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='0' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 2
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='1' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 3
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='2' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 4
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='3' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 5
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='4' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 6
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='5' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 7
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='6' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: JDK 17-ubi - Batch 8
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='7' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
 
         - step:
             name: EAP JDK 11 - Batch 1
@@ -1301,6 +1728,206 @@ pipelines:
                   --push
 
 
+        - step:
+            name: EAP JDK 17-ubi - Batch 1
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create-eap \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='0' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: EAP JDK 17-ubi - Batch 2
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create-eap \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='1' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: EAP JDK 17-ubi - Batch 3
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create-eap \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='2' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: EAP JDK 17-ubi - Batch 4
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create-eap \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='3' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: EAP JDK 17-ubi - Batch 5
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create-eap \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='4' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: EAP JDK 17-ubi - Batch 6
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create-eap \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='5' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: EAP JDK 17-ubi - Batch 7
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create-eap \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='6' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
+        - step:
+            name: EAP JDK 17-ubi - Batch 8
+            services:
+              - docker
+            script:
+              - git submodule update --init --recursive
+              - echo ${DOCKER_BOT_PASSWORD} | docker login ${DOCKER_REGISTRY} --username ${DOCKER_BOT_USERNAME} --password-stdin
+              - >
+                python /usr/src/app/make-releases.py \
+                  --create-eap \
+                  --start-version='8.5.6' \
+                  --default-release \
+                  --default-eap \
+                  --dockerfile='Dockerfile.ubi' \
+                  --dockerfile-buildargs='BASE_IMAGE=registry.access.redhat.com/ubi9/openjdk-17' \
+                  --dockerfile-version-arg='CONFLUENCE_VERSION' \
+                  --mac-product-key='confluence' \
+                  --tag-suffixes='ubi9,ubi9-jdk17' \
+                  --concurrent-builds='1' \
+                  --job-offset='7' \
+                  --jobs-total='8' \
+                  --docker-repos='atlassian/confluence' \
+                  --push
+
+
     custom-release:
       - variables:
           - name: CONFLUENCE_VERSION

bitbucket-pipelines.yml.j2

@@ -91,6 +91,21 @@ pipelines:
               - py.test -v tests/
               - py.test -v shared-components/tests/
 
+        - step:
+            name: Run unit tests - UBI
+            image: python:3.7-alpine3.9
+            services:
+              - docker
+            script:
+              - apk add --no-cache git
+              - git submodule update --init --recursive
+              - pip install -q -r shared-components/tests/requirements.txt
+              - export PYTHONPATH=./shared-components/tests:$PYTHONPATH
+              - export DOCKERFILE='Dockerfile.ubi'
+              - export DOCKERFILE_VERSION_ARG='CONFLUENCE_VERSION'
+              - export MAC_PRODUCT_KEY='confluence'
+              - py.test -v tests/
+
         - step:
             name: Run integration tests
             services:
@@ -103,6 +118,18 @@ pipelines:
               - export IS_RELEASE=false
               - /usr/src/app/post_build.sh test-image $IS_RELEASE
 
+        - step:
+            name: Run integration tests - UBI
+            services:
+              - docker
+            script:
+              - apk add --no-cache git docker-compose jq curl
+              - git submodule update --init --recursive
+              - export CONFLUENCE_VERSION=`curl -s https://marketplace.atlassian.com/rest/2/products/key/confluence/versions | jq -r '._embedded.versions | .[0].name'`
+              - docker build --build-arg CONFLUENCE_VERSION=${CONFLUENCE_VERSION} -t test-image-ubi . -f Dockerfile.ubi
+              - export IS_RELEASE=false
+              - /usr/src/app/post_build.sh test-image-ubi $IS_RELEASE
+
   custom:
     ######################################################################
     # Custom: Do full release for each image flavour

pipelines-generator.py

@@ -24,6 +24,14 @@ images = {
             'tag_suffixes': ['jdk17','ubuntu-jdk17'],
             'dockerfile': 'Dockerfile',
             'docker_repos': REPOS,
+        },
+        "17-ubi": {
+            'start_version': '8.5.6',
+            'default_release': True,
+            'base_image': 'registry.access.redhat.com/ubi9/openjdk-17',
+            'tag_suffixes': ['ubi9','ubi9-jdk17'],
+            'dockerfile': 'Dockerfile.ubi',
+            'docker_repos': REPOS,
         }
     },
 }

tests/test_image.py

@@ -484,15 +484,6 @@ def test_non_root_user(docker_cli, image):
     _jvm = wait_for_proc(container, get_bootstrap_proc(container))
 
 
-def test_jvm_fallback_fonts(docker_cli, image):
-    container = run_image(docker_cli, image)
-    _jvm = wait_for_proc(container, get_bootstrap_proc(container))
-
-    font = container.file("/opt/java/openjdk/lib/fonts/fallback/NotoSansGujarati-Regular.ttf")
-    assert font.exists
-    assert font.is_symlink
-
-
 def test_confluence_xml_snapshot_properties(docker_cli, image, run_user):
     environment = {
         'ATL_SETUP_STEP': 'complete',