Hardened Images component

Build an application with Red Hat Hardened Images. Set the required type input to an application stack from the table below. There is no default stack. The table includes every language and runtime entry in the Red Hat catalog. The component generates a Containerfile with separate builder and runtime stages, then uses Buildah through the container component to publish, sign, and scan your application image. The build engine is fixed; there is no runtime selector.

Build a Node.js application

You need a CI Tools runner that can build containers and reach the Red Hat catalog, registry, and signing-key service. Your project needs a package.json with a start script. Use a lock file to make dependency installation reproducible. The selected context must not already contain a project-owned Containerfile.

1. Add this pipeline to .gitlab-ci.yml:

   include:
     - component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
     - component: $CI_SERVER_FQDN/xrow-public/ci-tools/hi@stable
       inputs:
         name: application
         type: nodejs
         version: "22"
         path: .

2. Run the pipeline. generate:hi-application resolves compatible bases from the catalog, verifies their Red Hat signatures, and writes Containerfile and hi-images.json into the context. The build consumes these artifacts.

3. Find your image at $CI_REGISTRY_IMAGE/application:$CI_COMMIT_SHA. The builder installs production dependencies and runs an optional build script. The fixed runtime command is npm start. Scanning is enabled by default.

Generation also runs in release pipelines. Generated files are artifacts, not commits pushed to your project. A failed version lookup or signature verification fails generation before the Containerfile is replaced or the build can start.

Select an image version

version selects the image version, not the CI Tools component version. Use a quoted major ("22"), minor ("22.23"), or patch ("22.23.4") number that exists in the catalog. A major or minor selects the highest compatible numeric version with both builder and runtime variants. A patch selects that version. The generated FROM references include the catalog's immutable SHA-256 digests. hi-images.json records the request and resolved references.

Each generation reads the live catalog, so a later run can select a newer patch or rebuilt digest. The selected digests remain fixed throughout that build. Deprecated catalog versions, missing pairs, ambiguous digests, and invalid signatures fail rather than falling back to a different version or unsigned base.

The generator verifies each selected digest with Cosign and the Red Hat public signing key. It follows Red Hat's verification procedure for non-Red Hat hosts, which does not require an online transparency-log lookup. Signature and image claim checks remain required. A signature proves origin, not the absence of vulnerabilities; the application image must still pass scanning.

Select a stack

Every stack has its own local template with separate builder and runtime sections. The public builder input can replace the upper section; the lower runtime section stays fixed. Runtime images run as user 65532 with group 0.

Type	Default version	Catalog repository	Fixed runtime behavior
nodejs	22	nodejs	Run npm start from /app.
php	8.5	php	Run PHP-FPM on port 9000; it needs a separate FastCGI web server.
html	1.28	nginx	Serve /usr/share/nginx/html over HTTP on port 8080.
python	3.15	python	Run python3 app.py with /app/.venv/bin on PATH.
java	21	openjdk	Run /app/app.jar with Java.
go	1.26	go	Run the static /app/app binary in the separate core-runtime:2.43 stream.
ruby	4.0	ruby	Run bundle exec ruby app.rb using the bundled application dependencies.
rust	1	rust	Run /app/app, built from the Cargo binary named app.
swift	6.4	swift	Run /app/app, built from the Swift executable product named app.
dotnet-sdk	10.0	dotnet-sdk	Publish and run /app/app.dll with the SDK image.
dotnet-runtime	10.0	dotnet-runtime	Publish with the SDK and run /app/app.dll in the .NET runtime image.
aspnet-runtime	10.0	aspnet-runtime	Publish with the SDK and run /app/app.dll; ASP.NET defaults to HTTP port 8080.

The PHP builder installs production Composer dependencies when composer.json exists. The Python builder creates a virtual environment and installs requirements.txt when present. Java expects an executable Maven wrapper and one target/*.jar. Go builds with CGO_ENABLED=0. Set path to your application context; HTML can use an already-built static directory.

Ruby requires a Gemfile and app.rb; bundle install installs dependencies under vendor/bundle. Rust and Swift expect the default executable product name app; use builder for another build convention. The .NET builder publishes with assembly name app into /app/publish.

For dotnet-runtime and aspnet-runtime, version selects the runtime version. Their SDK uses the same major/minor stream because SDK and runtime patch numbers differ. Both references are independently digest-pinned and signature-verified. For example, runtime 10.0.13 uses a compatible 10.0 SDK, not a nonexistent SDK with that same patch number.

Customize the builder

Use builder for a complete build-stage replacement. Keep the verified image variable and the builder stage name. The fixed lower section copies /app, or /app/publish for the .NET types. Only the two HI image variables are substituted. Other shell and Containerfile variables remain literal data until the container build interprets them.

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/hi@stable
    inputs:
      type: nodejs
      version: "22"
      path: service
      builder: |
        FROM ${HI_BUILD_IMAGE} AS builder
        USER 0
        WORKDIR /app
        COPY . .
        RUN npm ci && npm run build && npm prune --omit=dev && chmod -R g=u /app

Additional unsigned or unrelated base images are rejected. Keep compiled outputs compatible with the fixed runtime. For a different runtime or a project-owned Containerfile, use the container component instead. Do not place credentials in build commands, arguments, or sources. Use the inherited secrets input with build-stage secret mounts for private dependencies. Exclude credentials, local caches, and generated output with .containerignore.

Migrate from S2I

Keep name, type, path, dependencies, runner tags, and scanning settings. Replace the s2i include with hi, then choose an image version. HI does not provide S2I assemble/run scripts or consume .s2i/environment. Move assembly logic into builder and configure runtime environment variables in your deployment. Check the fixed commands and ports before deploying; PHP uses FastCGI rather than an HTTP server.

Inputs

Name	Description	Default	Type
---	---	---	---
builder	Replace the builder Containerfile section; the runtime stays fixed.		string
cache-enabled	Should registry-backed build cache be used?	false	boolean
dependencies	The dependencies that this job depends on.	[]	array
name	Name for the pipeline jobs and the container.	$CI_PROJECT_NAME	string
needs	The jobs that this job depends on.	[]	array
path	Path to the directory containing Container sources / context.	.	string
registry	Registry to store container image releases in	$CI_REGISTRY	string
repository-path	Repository to store container image releases in	$CI_REGISTRY_PROJECT_PATH	string
rules	The jobs that this job depends on.	[{"if":"$CI_PIPELINE_SOURCE == \"schedule\"","when":"never"},{"if":"$CI_PIPELINE_SOURCE == \"merge_request_event\"","when":"on_success"},{"when":"on_success"}]	array
scanners	Scanners to use. none, vuln, license, secret, misconfig	["vuln","secret","license","misconfig"]	array
scanning-allow-failure	Should the pipeline fail if scanning the built container image fails?	false	boolean
scanning-enabled	Should the built container image be scanned?	true	boolean
scanning-ignore-unfixed	Exclude vulnerabilities that do not have a fix available.	true	boolean
scanning-severity	What level of severity should cause scanning of the built container to fail?	CRITICAL	string
scanning-timeout	How long should the scanning process be allowed to run before timing out? Use format e.g. 5m0s	30m0s	string
secrets	Secrets to pass to the builder.		string
signing-enabled	Should the built container image be signed?	true	boolean
stage	The pipeline stage that the jobs belongs to.	build	string
tags	The runners that this job depends on.	[]	array
type	Application stack to build with Red Hat Hardened Images.		string
version	HI image version (major, minor or patch); empty uses the stack default.		string