In order to ship images in the payload, we will need to be able to build container images in ART for the following projects:

• assisted-service
• assisted-installer-agent
• assisted-installer
• assisted-installer controller

(The latter two are in the same repo and could potentially be combined into a single image. However this would likely require code changes to override the entrypoint for one or the other.)

We also need a postgres database image. Probably it would be best to dnf install postgres into the assisted-service image so we can run two containers with different entry points from the same image. (In future we can hopefully replace postgres with SQLite.)

The ART build system has no access to the Internet. It can only access the repo itself, and dnf install packages. This means that in particular, all go libraries will have to be vendored and checked in, which they are currently not. We should add the relevant CI job to verify this.

These containers must also use the standard OpenShift base images.

Existing Dockerfiles for RHACM exist in dist-git, and go quite a long way to avoiding Internet access (e.g. no pip install):

• https://pkgs.devel.redhat.com/cgit/containers/agent-service/tree/Dockerfile?h=rhacm-2.5-rhel-8 (note that the container name is agent-service)
• https://pkgs.devel.redhat.com/cgit/containers/assisted-installer-agent/tree/Dockerfile?h=rhacm-2.5-rhel-8
• https://pkgs.devel.redhat.com/cgit/containers/assisted-installer/tree/Dockerfile?h=rhacm-2.5-rhel-8
• https://pkgs.devel.redhat.com/cgit/containers/assisted-installer-reporter/tree/Dockerfile?h=rhacm-2.5-rhel-8 (note that the container name is assisted-installer-reporter)

Probably we should add a Dockerfile.ocp to each repo as we do for other OpenShift repos.

We should test these image builds in OpenShift CI and add them to promotion. Note that the PR to openshift/releases to add them to promotion needs personal sign-off from either Clayton Coleman or Ben Parees to approve the naming. This should be done before creating downstream builds in ART in case the names need to change.