Skip to content

Third-Party Test Service Image Review

nats-sinks builds first-party runtime and test images from Oracle Linux 9 slim FIPS where the repository owns the Dockerfile. Some local workflows still start service images that are owned by upstream projects or external image maintainers. Those images are external test dependencies. They are useful for developer ergonomics, but they are not proof that every local service in the test topology uses the same Oracle Linux FIPS base-image policy.

This page records the current inventory and the decision for each retained external service image. It is an engineering review aid, not an accreditation claim.

Decision Rules

Use these rules when deciding whether to replace an external service image:

  • Prefer a first-party Oracle Linux 9 slim FIPS image when the repository can build and maintain it without repackaging a vendor product in an unsupported way.
  • Retain the upstream image when it is the vendor-documented developer path and rebuilding it would weaken licensing clarity, supportability, or test realism.
  • Keep heavyweight service tests opt-in for local or release validation.
  • Keep test data synthetic, generated credentials short-lived, and host exposure loopback-only where practical.
  • Open a narrower follow-up issue before implementing a replacement image.

Inventory

Service image Used by Current decision Follow-up
nats:2.10 Default local Docker smoke stack and standalone NATS Compose example. Retain as the broad developer default, but use the first-party Oracle Linux 9 slim FIPS NATS JetStream test-service image for controlled local release evidence when desired. Issue #379 adds the opt-in first-party image and smoke-test selector.
ghcr.io/oracle/nosql:latest-ce Oracle NoSQL Database KVLite smoke and sink e2e helpers. Retain as an external Oracle-provided developer image. It is the documented local KVLite path used by the Oracle NoSQL test backend. A custom rebuild is not planned under this review because it would require a separate supported Oracle NoSQL packaging strategy. No replacement issue created. Revisit only if a supported first-party build path becomes available or a controlled deployment requires a mirrored image.
gvenzl/oracle-free:23-slim Legacy Oracle Database Compose example for ad hoc local labs. Retain only as a legacy developer convenience, not as release evidence or controlled-environment support evidence. Oracle Database version support should move to an explicit container matrix that separates Oracle-supported images, operator-built images, licensing requirements, and excluded versions. Issue #377 tracks the Oracle Database compatibility matrix.

First-Party Images Already Covered

The following repository-built images already use Oracle Linux 9 slim FIPS and are outside the retained third-party service-image list:

  • root nats-sinks container image;
  • NATS JetStream FIPS test service;
  • Oracle MySQL Database test container;
  • Oracle Coherence Community Edition test backend;
  • HTTP sink NGINX FIPS test endpoint; and
  • local post-release PyPI validation image.

The first-party invariant is covered by focused unit tests and documented in Production Container Hardening.

Operator Guidance

For ordinary local development, the retained external images are acceptable when the tests remain local, synthetic, and disposable. For controlled environments, review each external service image before use:

  • approve or mirror the image in an internal registry;
  • pin tags or digests in controlled pipelines;
  • keep credentials and test data out of images and logs;
  • bind service ports only to local interfaces where practical;
  • preserve cleanup-by-default behavior; and
  • do not claim that a retained external image follows the repository's first-party Oracle Linux FIPS base-image policy.

If an external image becomes unsuitable for controlled testing, create a specific replacement issue with a focused test plan rather than changing the generic local workflow in place.