Vulnerabilities when building images for MQ 9.3.x.x based on Ubi8 (advice for using Ubi9)

[ad186gh]

We have been trying to build an MQ 9.3.x.x based image, for which the Dockerfiles in mq-container use Ubi8 as base image. Unfortunately, Ubi8 is flagging High/Critical vulnerabilities - which apparently stem from the version of OpenSSL that is installed as standard on Ubi8 (OpenSSL v1.1.1k), which we haven't been able to overcome.

We have therefore been looking for a 9.3.x.x branch/tag in the mq-container repo that supports Ubi9, but have found that, while many 9.3.x.x versions of MQ officially support RHEL 9/Ubi9, the mq-container's various 9.3.x.x. tags only use Ubi8.

Does anyone have any experience with building a 9.3.x.x Docker container based on Ubi9? Are there any official or unofficial recommendations for which tag to base this on and likely issues that will need addressing?

[arthurbarr]

IBM MQ is supported on RHEL 9 from MQ 9.3.0.2 (see System Requirements. The latest UBI 9 image is 9.6-1751286687, which is also tagged latest. The 9.3.x.x branch is no longer updated, but if you're building your own image, you could just update to the latest UBI 9 image, and it should work fine.

[ad186gh]

Hi @arthurbarr , much appreciate your quick response and helpful feedback!
My colleague has tried using a 9.3.x.x branch in the mq-container repo, swapping out the Ubi8 image for the latest Ubi9 image. Unfortunately he found numerous issues related to microdnf updates, though it wasn't clear why these would be different given the base image was Ubi9 in both cases.
So instead, he has used the tag 9.4.3.0-r1, swapping in a 9.3.x.x version of MQ, and this seems to have built successfully. Does this sound like a reasonable approach from your perspective?