[202511] Backport docker-sonic-mgmt dependency and security updates from master#28537
Open
lunyue-ms wants to merge 2 commits into
Open
[202511] Backport docker-sonic-mgmt dependency and security updates from master#28537lunyue-ms wants to merge 2 commits into
lunyue-ms wants to merge 2 commits into
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
lunyue-ms
force-pushed
the
lunyue/backport-docker-sonic-mgmt-202511
branch
from
July 23, 2026 02:35
12351f5 to
bc4744f
Compare
Align the docker-sonic-mgmt image (Dockerfile.j2 and the ansible getattr patch) and its build pipeline (.azure-pipelines/docker-sonic-mgmt.yml) with master. SBOM generation/scan is intentionally left out because 202511 does not carry the SBOM build machinery (the SBOM feature sonic-net#27455 was never backported to this branch). The pr_test_template call drops INCLUDE_JOBS because sonic-mgmt@202511's pr_test_template.yml does not declare that parameter (job selection there is impacted-area driven). Branch-specific fields (schedule/pr branch filters and the sonic-mgmt resource ref) target 202511, and the published image is tagged with the branch name (docker-sonic-mgmt:202511 and :202511-lastbuild) instead of :latest/:lastbuild so it never overwrites master's published mgmt image. Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
lunyue-ms
force-pushed
the
lunyue/backport-docker-sonic-mgmt-202511
branch
from
July 23, 2026 02:47
bc4744f to
2cf905b
Compare
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Collaborator
|
This PR has backport request for branch(es): 202511. ---Powered by SONiC BuildBot
|
Collaborator
|
This PR has backport request label(s) for branch(es): 202511, but is missing required test information. Please make sure you tick the tested branch(es) in the Tested branch section and provide test evidence (e.g., 202511: <test result>) in the Test result section as well in your PR description. ---Powered by SONiC BuildBot
|
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
202511 does not carry the SBOM-based vulnerability scan (scripts/sbom_*.py are master-only). Reuse the branch's existing self-contained Trivy scan (already used by docker-ptf.yml on 202511) for docker-sonic-mgmt: a new optional trivy_scan job downloads the built image artifact, installs Trivy, and scans it for MEDIUM/HIGH/CRITICAL vulnerabilities. Only the pipeline YAML changes; no repo scripts are required. Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
lunyue-ms
force-pushed
the
lunyue/backport-docker-sonic-mgmt-202511
branch
from
July 23, 2026 08:49
5416bff to
d0ea30f
Compare
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
dockers/docker-sonic-mgmt/and.azure-pipelines/docker-sonic-mgmt.ymlon202511were behindmaster. This aligns the docker-sonic-mgmt image and its build pipeline on202511with master — without SBOM (see "Why no SBOM" below).Work item tracking
How I did it
Took master's version of the affected files directly (rather than per-commit cherry-picks) and adjusted the branch-specific bits, as a single signed-off commit:
dockers/docker-sonic-mgmt/Dockerfile.j2anddockers/docker-sonic-mgmt/0001-Fix-getattr-AttributeError-in-multi-thread-scenario.patchare taken frommaster(byte-identical to master)..azure-pipelines/docker-sonic-mgmt.ymlis aligned with master minus SBOM: the twoENABLE_SBOM=ybuild flags and thesbom_vuln_scanjob are removed. Vulnerability scanning is instead provided by a self-contained Trivytrivy_scanjob in a dedicated, non-gatingSecurityScanstage (runs in parallel withTest, does not blockPublish), mirroring the Trivy scan already used bydocker-ptf.ymlon 202511 — only the pipeline YAML is needed, no repo scripts. No changes toslave.mk/Makefile.work/rules/config.pr_test_template.yml@sonic-mgmtcall dropsINCLUDE_JOBS:sonic-mgmt@202511'spr_test_template.ymldoes not declare that parameter (job selection there is impacted-area driven), so passing it fails YAML compilation withUnexpected parameter 'INCLUDE_JOBS'. OnlyCHECKOUT_SONIC_MGMTandOVERRIDE_PARAMS(both supported by the 202511 template) are passed.schedules/prbranch filters and thesonic-mgmtresourceref→202511.docker-sonic-mgmt:202511anddocker-sonic-mgmt:202511-lastbuild— instead of:latest/:lastbuild, so a 202511 build never overwrites master's shareddocker-sonic-mgmt:latest/:lastbuildin the registry. (The local build image tagdocker-sonic-mgmt:latestis left unchanged.)Why no SBOM: the SBOM feature was introduced on master by #27455 (merged 2026-05-28).
202511was branched from master on 2025-11-19, ~6 months earlier, and #27455 was never backported to 202511, so this branch lacks theENABLE_SBOMbuild machinery +scripts/build_sbom.py+scripts/sbom_vuln_scan.py+vex/. Backporting the whole SBOM feature into 202511's build core is out of scope for this PR. Instead, 202511 does vulnerability scanning with Trivy, not SBOM — the pre-SBOM Trivy scan already present on this branch (e.g.docker-ptf.yml) is reused for docker-sonic-mgmt, needing only the pipeline YAML and none of thescripts/sbom_*.pymachinery.Squashed into one commit authored & signed off by me so DCO passes.
How to verify it
Build docker-sonic-mgmt on 202511; confirm the pip package versions match master and the ansible 13.6.0 patch (ansible-core 2.20.5) applies. The pipeline publishes
docker-sonic-mgmt:202511.Which release branch to backport (provide reason below if selected)
This PR is itself the backport to
202511.Tested branch
Test result
Pending a build; will update with the tested image version.
Description for the changelog
Align docker-sonic-mgmt image and build pipeline on 202511 with master (without SBOM); publish the image under a branch-qualified tag (
docker-sonic-mgmt:202511).Link to config_db schema for YANG module changes
N/A. No YANG or config_db schema changes.