Universal Base Images (UBI): Images, repositories, packages, and source code

Updated -

Using Red Hat Universal Base Images (UBI) offers a way to build your container images on a foundation of Red Hat Enterprise Linux software. See Characteristics of UBI images for details on using Red Hat UBI container images.

This article identifies:

  • Images: Information on how to find available Red Hat UBI container images
  • Repositories: Available software repositories for updating and adding to UBI container images with RPM packages that can be freely redistributed
  • RPM packages: Descriptions of how to find all the packages in and available to UBI container images
  • Source code images: Descriptions of how to get source container images for each published UBI container image

If you have problems or enhancement requests for UBI, enter a bug at the Red Hat Bugzilla site (under the distribution BZ component and UBI7, UBI8 or UBI9). See the UBI Weekly bug list for the current set of bugs. Red Hat customers can enter a Red Hat Support Case.

NOTE: Although we make a best effort to keep this article up to date, the only true way to obtain the latest list of Red Hat UBI images, repositories, and RPM packages is to check the source of that information directly. Each section below describes how to obtain that information.

Red Hat UBI Images

For the latest list of images and details about each image, refer to the Red Hat Universal Base Image section of the Red Hat Ecosystem Catalog. Red Hat UBI images are available from both authenticated (registry.redhat.io) and unauthenticated (registry.access.redhat.com) registries.

Red Hat UBI repositories

Each Red Hat UBI image is pre-configured to point to UBI yum repositories that contain the latest versions of UBI RPM packages.
No subscription is needed to update Red Hat UBI images from packages in those repositories.

The /etc/yum.repos.d/ubi.repo file inside each UBI container contains entries for available UBI repositories.
Those set to enabled = 1 are currently enabled. Refer to the baseurl for each repository to see the location of those packages. Type yum repolist to see the list of enabled repositories (yum is not available in the minimal and micro UBI images).

The following Red Hat UBI repositories are enabled by default within RHEL 7, RHEL 8, and RHEL 9 UBI images.

RHEL 7 UBI repositories

repository id repository name
ubi-7/x86_64 Red Hat Universal Base Image 7 Server (RPMs)
ubi-7-rhah/x86_64 Red Hat Universal Base Image Atomic Host (RPMs)
ubi-7-server-devtools-rpms/x86_64 Red Hat Developer Tools RPMs for Red Hat Universal Base Image 7 Server
ubi-7-server-extras-rpms/x86_64 Red Hat Universal Base Image 7 Server - Extras (RPMs)
ubi-7-server-optional-rpms/x86_64 Red Hat Universal Base Image 7 Server - Optional (RPMs)
ubi-server-rhscl-7-rpms/x86_64 Red Hat Software Collections RPMs for Red Hat Universal Base Image 7 Server

RHEL 8 UBI repositories

repository id repository name
ubi-8-appstream-rpms Red Hat Universal Base Image 8 (RPMs) - AppStream
ubi-8-baseos-rpms Red Hat Universal Base Image 8 (RPMs) - BaseOS

RHEL 9 UBI repositories

repository id repository name
ubi-9-appstream-rpms Red Hat Universal Base Image 9 (RPMs) - AppStream
ubi-9-baseos-rpms Red Hat Universal Base Image 9 (RPMs) - BaseOS

Red Hat UBI RPM packages

To see a list of RPM packages installed inside a Red Hat UBI container, type: rpm -qa

To see all available RPM packages from inside a Red Hat UBI container, type: yum list all
Note that the yum command is not available in the minimal and micro images.

Another way to find the RPM packages available to all UBI images is to browse the UBI repositories. As noted earlier, all UBI repositories are listed in the /etc/yum.repos.d/ubi.repo file within each UBI container.

The URL to each repository is listed with the repository name. Replace $basearch with your computer architecture, such as x86_64, as shown in the examples:

Red Hat UBI source container images

Red Hat now produces source container images, containing all source code associated with each Universal Base Image (UBI) that it publishes. To read about UBI source container images and how to obtain them, refer to Getting UBI Container Image Source Code.

38 Comments

The rhel8/ namespace seem out-of-scope for this article since they're not UBI images, despite being built on UBI.

We removed the rhel8/ namespace, as you suggested.

The documentation at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/building_running_and_managing_containers/index/#get_ubi_images also lists images in the rhel8/ namespace. I guess that's a documentation error too then. Can you resolve that?

We fixed it according to your suggestions.

The packages "rpm-build" or "subversion" cannot be installed in the UBI-8 images. Is there a way to install them?

# yum install -y subversion
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Red Hat Universal Base Image 8 (RPMs) - AppStream                                                                                                                                                             370 kB/s | 1.9 MB     00:05
Red Hat Universal Base Image 8 (RPMs) - BaseOS                                                                                                                                                                143 kB/s | 745 kB     00:05
Last metadata expiration check: 0:00:01 ago on Mon Sep  2 20:41:05 2019.
No match for argument: subversion
Error: Unable to find a match

I believe that Adding Software Inside a UBI Container describes what you are looking for. By default, UBI images are only configured to access a subset of the total set of RHEL packages. That document describes how to add other repos to gain access to more packages.

How do I use a recent developer toolset with UBI 7? I.e. can I build code for UBI 7 with a newer gcc than 4.8.5?

Please add Swig to AppStream , it is in Centos Appstream http://mirror.centos.org/centos/8/AppStream/x86_64/os/Packages/swig-3.0.12-18.module_el8.0.0+8+90b9a8be.x86_64.rpm , where is it in RHEL8 repos certainly not available in the 3 available repos.

Using the UBI8 container this fails

RUN dnf install --enablerepo=ubi-8-codeready-builder swig -y

Workaround

RUN dnf install http://mirror.centos.org/centos/8/AppStream/x86_64/os/Packages/swig-3.0.12-18.module_el8.0.0+8+90b9a8be.x86_64.rpm

Swig is required for M2Crypto python pip compile amongst other things

Hi Stuart, please see the Universal Base Images FAQ, under "How to request new features in UBI?" for instructions on how to file UBI requests.

I need Swig too, so I requested it at https://bugzilla.redhat.com/show_bug.cgi?id=2051602

i m facing the issue that openssl-libs-1.1.1c-2.el8_1.1.x86_64 is installed on ubi8-minimal image but when i want to install openssl from ubi8 repo then i getting an error because release 2.el8_1.1 is not there. i find this release only in the rhel 8 base os repo. i m facing such issues very often in the past two or three times with the package systemd and systemd-libs therefore i perform downgrade for systemd and systemd-libs. Can you please take care that your repos are in sync and the same versions are in all related repos?

Expecting the same issue.

I am trying to install fsevents package using yarn on my nodeJS UBI8 image, it fails.someone already faced this?

"Unsupported platform for fsevents@1.2.11: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})"

Hello,

I did not see any image for s390 platform (IBM Z). Will Redhat make it available ? Also, can this document be updated?

Thank you

Information about the UBI8 for s390x container image can be see at https://catalog.redhat.com/software/containers/detail/5c647760bed8bd28d0e38f9f?architecture=s390x

Hello,

Question about those who code in ansible and want to test their code with molecule.

While Ubi is nice to provide a product on container, this is not possible to reproduce a real RHEL system to write and test integration code on it (repositories name different, tooling different, not all packages available).

What are the best options ?

-deleted-

Trying to find out how to install telnet; however, the suggested manner (use yum) has the warning not available in minimal; which I think is UBI. So I have installed yum temporarily, but still cannot find telnet. I found ping in iputils, but not telnet. Is this not available under ubi8? Thanks

Hello Andrew,

if you are using the ubi-minimal image, then you can use the microdnf utility (scaled-down version of dnf).

# podman run --name=ubimin -it registry.access.redhat.com/ubi8/ubi-minimal 
# microdnf -y install telnet
...
Installing: telnet;1:0.17-76.el8;x86_64;rhel-8-for-x86_64-appstream-rpms
Complete.

[root@611ff454bd51 /]# telnet
telnet> 

Does that help? :)

It appears that the container repositories should have a manual. I'm attempting to configure a container and running into admin issues saying permission denied, but tried and true syntax on redhat linux OS systems.

Hello Rob,

Please, can you send us the commands you used to find out the problem? Thank you in advance.

Unable to run find or locate command

Hello Kunal, Please, can you send us the commands you used to find out the problem? Thank you in advance.

We have use below command to install find and locate command

microdnf update && microdnf install mlocate && microdnf install find

Please, can you provide more information about the issue you are experiencing? What is your goal? Thank you in advance.

Our goal is to install find or locate in UBI images. We are unable to install find or locate commands using below commands

RUN microdnf update && microdnf install mlocate && microdnf install find

Below error is observed while installation

error: No package matches 'mlocate'

Kunal, The mlocate package is not available in the UBI repositories. You would have to pull this package from RHEL on a subscribed system. The package for find is findutils. You would need to run your commands running in a ubi-minimal container on a RHEL host, and it will automatically pull the packages from the RHEL channels.

Here's what I got when testing: [root@d7b1465a5e24 /]# yum install findutils mlocate Updating Subscription Management repositories. Unable to read consumer identity Subscription Manager is operating in container mode. This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register. Last metadata expiration check: 0:00:36 ago on Tue Jul 13 15:37:19 2021. Package findutils-1:4.6.0-20.el8.x86_64 is already installed.

Dependencies resolved. Package Architecture Version Repository Size

Installing: mlocate x86_64 0.26-20.el8 rhel-8-for-x86_64-baseos-rpms 121 k

Transaction Summary

Install 1 Package

Total download size: 121 k Installed size: 390 k Is this ok [y/N]:

Thanks Scott McCarty for you help.

I was trying to see if there is a way we can build ubi8 base images locally. There are official instructions on how to pull the source code of the ubi8 images and inspect it. But could not find any instruction on how to build it in our environment. Could someone here help me with that?

Just curious, why would you need to ever rebuild them from scratch? Do you mean building on top of UBI, or rebuilding the base images themselves (standard, minimal, micro, init).

We don't really support "rebuilding" per se because they are built by booting Virtual Machines, and pulling the important parts out. This articles explains the process of how we build them if you were to want to rebuild them yourself: http://crunchtools.com/ubi-build/

I am trying to install nodejs 12 in the latest ubi8 minimal image (ubi-minimal:8.4-212).

There is a version of nodejs 12 in the ubi-8-appstream repository link given in this article (nodejs-12.22.5-1.module+el8.4.0+12242+af52a4c7.x86_64.rpm), but inside the container I can't install it and repoquery only shows the nodejs 10 package:

[root@5febba00e521 /]# microdnf install nodejs-12.22.5-1.module+el8.4.0+12242+af52a4c7.x86_64

(microdnf:12): librhsm-WARNING **: 16:14:41.084: Found 0 entitlement certificates

(microdnf:12): librhsm-WARNING **: 16:14:41.085: Found 0 entitlement certificates
Downloading metadata...
Downloading metadata...
Downloading metadata...
error: No package matches 'nodejs-12.22.5-1.module+el8.4.0+12242+af52a4c7.x86_64'
[root@5febba00e521 /]# microdnf repoquery nodejs

(microdnf:60): librhsm-WARNING **: 16:14:50.080: Found 0 entitlement certificates

(microdnf:60): librhsm-WARNING **: 16:14:50.081: Found 0 entitlement certificates
nodejs-1:10.24.0-1.module+el8.3.0+10166+b07ac28e.x86_64
[root@5febba00e521 /]#

How can I install node 12 in this image?

Hello!

The nodejs:10 module stream is the default for the RHEL/UBI 8 release. To install nodejs-12, you can first "enable" that module stream:

[root@53a87abfc817 /]# microdnf module enable nodejs:12

(microdnf:11): librhsm-WARNING **: 17:01:18.512: Found 0 entitlement certificates

(microdnf:11): librhsm-WARNING **: 17:01:18.513: Found 0 entitlement certificates
Downloading metadata...
Downloading metadata...
Downloading metadata...
Enabling module streams:
    nodejs:12


Running transaction test...
[root@53a87abfc817 /]# microdnf install nodejs

(microdnf:59): librhsm-WARNING **: 17:01:27.793: Found 0 entitlement certificates

(microdnf:59): librhsm-WARNING **: 17:01:27.794: Found 0 entitlement certificates
Package                                                                                                                              Repository                                          Size
Installing:                                                                                                                                                                                  
 nodejs-1:12.22.5-1.module+el8.4.0+12242+af52a4c7.x86_64                                                                             ubi-8-appstream                                  10.6 MB
 nodejs-docs-1:12.22.5-1.module+el8.4.0+12242+af52a4c7.noarch                                                                        ubi-8-appstream                                   4.3 MB
 nodejs-full-i18n-1:12.22.5-1.module+el8.4.0+12242+af52a4c7.x86_64                                                                   ubi-8-appstream                                   7.9 MB
 npm-1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7.x86_64                                                                      ubi-8-appstream                                   3.8 MB
Transaction Summary:
 Installing:        4 packages
 Reinstalling:      0 packages
 Upgrading:         0 packages
 Obsoleting:        0 packages
 Removing:          0 packages
 Downgrading:       0 packages
Downloading packages...
Running transaction test...
Installing: nodejs-docs;1:12.22.5-1.module+el8.4.0+12242+af52a4c7;noarch;ubi-8-appstream
Installing: nodejs-full-i18n;1:12.22.5-1.module+el8.4.0+12242+af52a4c7;x86_64;ubi-8-appstream
Installing: nodejs;1:12.22.5-1.module+el8.4.0+12242+af52a4c7;x86_64;ubi-8-appstream
Installing: npm;1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7;x86_64;ubi-8-appstream
Complete.
[root@53a87abfc817 /]# rpm -q nodejs
nodejs-12.22.5-1.module+el8.4.0+12242+af52a4c7.x86_64

Please see the following for more details:

Chapter 4. Installing RHEL 8 content Red Hat Enterprise Linux 8 | Red Hat Customer Portal

Thank you Kyle, that works great!

With the RHEL8 UBI images, specifically registry.access.redhat.com/ubi8/ubi:8.4, I'm seeing that certain tool versions (nginx & ruby) are found in the ubi-8-appstream yum-repo pre-packaged into that image. The versions of those apps however, are old (ruby 2.5.9) and triggering security warnings like this:

``` CVE-2021-32066

Policy Status Active

Summary Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327) * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799) * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810) * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vendor Security Notice IDs Official Notice
RHSA-2021:3020 https://access.redhat.com/errata/RHSA-2021:3020

Affected Packages Policy Status How to Resolve Security Notice
ruby-libs Active Upgrade ruby-libs to >= 2.7.4-137.module+el8.4.0+12025+f744ca41 RHSA-2021:3020
rubygem-io-console Active Upgrade rubygem-io-console to >= RHSA-2021:3020
0.5.6-137.module+el8.4.0+12025+f744ca41
rubygem-bigdecimal Active Upgrade rubygem-bigdecimal to >= RHSA-2021:3020
2.0.0-137.module+el8.4.0+12025+f744ca41
ruby Active Upgrade ruby to >= 2.7.4-137.module+el8.4.0+12025+f744ca41 RHSA-2021:3020
rubygem-psych Active Upgrade rubygem-psych to >= 3.1.0-137.module+el8.4.0+12025+f744ca41 RHSA-2021:3020
rubygem-openssl Active Upgrade rubygem-openssl to >= 2.1.2-137.module+el8.4.0+12025+f744ca41 RHSA-2021:3020
rubygem-json Active Upgrade rubygem-json to >= 2.3.0-137.module+el8.4.0+12025+f744ca41 RHSA-2021:3020
```

How is the UBI-based Dockerfile supposed to be picking up these later versions if they are not part of the "ubi-8-appstream" repo?

why is the clear command not made available inside the ubi8 container images?

Hello Ben, We do not include the clear command because of size. The clear command is part of the ncurses library which is another 600K.

Kind regards Gabi

Apparently, there was a recent reponame switch to "ubi-8-appstream-rpms" from "ubi-8-appstream" so all our Dockerfiles that used to do: microdnf install --enablerepo ubi-8-appstream python3 now fail and we have to change all our various Dockerfiles to do: microdnf install --enablerepo ubi-8-appstream-rpms python3

.NET images for .NET Core 6 are only generated for 6.0.100* - https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi8/8/x86_64/appstream/os/Packages/d but there are more base images for .NET. According to https://learn.microsoft.com/en-us/dotnet/core/porting/versioning-sdk-msbuild-vs#targeting-and-support-rules there is package for each VS. So for now we have only 6.0.109 and we are missing 6.0.401 and 6.0.304 - https://dotnet.microsoft.com/en-us/download/dotnet/6.0