From 5c3298cd5aa84563a5524f968659209124f9ed06 Mon Sep 17 00:00:00 2001
From: Ilya Buziuk <ibuziuk@redhat.com>
Date: Mon, 13 Jul 2026 12:47:05 +0200
Subject: [PATCH 1/2] feat: add bubblewrap to UDI 9 / 10

Signed-off-by: Ilya Buziuk <ibuziuk@redhat.com>
---
 universal/ubi10/Dockerfile | 3 +++
 universal/ubi9/Dockerfile  | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/universal/ubi10/Dockerfile b/universal/ubi10/Dockerfile
index f2a8751b..ec2afbd8 100644
--- a/universal/ubi10/Dockerfile
+++ b/universal/ubi10/Dockerfile
@@ -588,6 +588,9 @@ cd -
 rm -rf "${TEMP_DIR}"
 EOF
 
+## bubblewrap - unprivileged sandboxing tool (https://github.com/containers/bubblewrap)
+RUN dnf install -y --enablerepo=crb bubblewrap && dnf clean all && rm -rf /var/cache/dnf
+
 RUN <<EOF
 oc completion bash > /usr/share/bash-completion/completions/oc
 tkn completion bash > /usr/share/bash-completion/completions/tkn
diff --git a/universal/ubi9/Dockerfile b/universal/ubi9/Dockerfile
index d818db07..ca437777 100644
--- a/universal/ubi9/Dockerfile
+++ b/universal/ubi9/Dockerfile
@@ -555,6 +555,9 @@ cd -
 rm -rf "${TEMP_DIR}"
 EOF
 
+## bubblewrap - unprivileged sandboxing tool (https://github.com/containers/bubblewrap)
+RUN dnf install -y --enablerepo=crb bubblewrap && dnf clean all && rm -rf /var/cache/dnf
+
 RUN <<EOF
 oc completion bash > /usr/share/bash-completion/completions/oc
 tkn completion bash > /usr/share/bash-completion/completions/tkn

From 762ab140f599c451d659fc0798d69338f3305f47 Mon Sep 17 00:00:00 2001
From: Ilya Buziuk <ibuziuk@redhat.com>
Date: Mon, 13 Jul 2026 15:42:43 +0200
Subject: [PATCH 2/2] fix: bubblewrap from source

Signed-off-by: Ilya Buziuk <ibuziuk@redhat.com>
---
 universal/ubi10/Dockerfile | 28 +++++++++++++++++++++++++++-
 universal/ubi9/Dockerfile  | 28 +++++++++++++++++++++++++++-
 2 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/universal/ubi10/Dockerfile b/universal/ubi10/Dockerfile
index ec2afbd8..51c38eb4 100644
--- a/universal/ubi10/Dockerfile
+++ b/universal/ubi10/Dockerfile
@@ -589,7 +589,33 @@ rm -rf "${TEMP_DIR}"
 EOF
 
 ## bubblewrap - unprivileged sandboxing tool (https://github.com/containers/bubblewrap)
-RUN dnf install -y --enablerepo=crb bubblewrap && dnf clean all && rm -rf /var/cache/dnf
+## Building from source as the package requires the crb repo which needs a RHEL subscription (not available in UBI)
+RUN <<'EOF'
+set -euf -o pipefail
+
+BWRAP_VERSION="0.11.2"
+TEMP_DIR="$(mktemp -d)"
+cd "${TEMP_DIR}"
+
+dnf install -y meson ninja-build gcc libcap-devel
+
+BWRAP_TGZ="bubblewrap-${BWRAP_VERSION}.tar.xz"
+BWRAP_URL="https://github.com/containers/bubblewrap/releases/download/v${BWRAP_VERSION}"
+curl -sSLO "${BWRAP_URL}/${BWRAP_TGZ}"
+curl -sSLO "${BWRAP_URL}/${BWRAP_TGZ}.sha256sum"
+sha256sum -c "${BWRAP_TGZ}.sha256sum"
+
+tar -xf "${BWRAP_TGZ}"
+cd "bubblewrap-${BWRAP_VERSION}"
+meson setup build
+ninja -C build
+install -m 4755 build/bwrap /usr/bin/bwrap
+
+cd /
+rm -rf "${TEMP_DIR}"
+dnf remove -y meson ninja-build gcc libcap-devel
+dnf clean all && rm -rf /var/cache/dnf
+EOF
 
 RUN <<EOF
 oc completion bash > /usr/share/bash-completion/completions/oc
diff --git a/universal/ubi9/Dockerfile b/universal/ubi9/Dockerfile
index ca437777..23c29896 100644
--- a/universal/ubi9/Dockerfile
+++ b/universal/ubi9/Dockerfile
@@ -556,7 +556,33 @@ rm -rf "${TEMP_DIR}"
 EOF
 
 ## bubblewrap - unprivileged sandboxing tool (https://github.com/containers/bubblewrap)
-RUN dnf install -y --enablerepo=crb bubblewrap && dnf clean all && rm -rf /var/cache/dnf
+## Building from source as the package requires the crb repo which needs a RHEL subscription (not available in UBI)
+RUN <<'EOF'
+set -euf -o pipefail
+
+BWRAP_VERSION="0.11.2"
+TEMP_DIR="$(mktemp -d)"
+cd "${TEMP_DIR}"
+
+dnf install -y meson ninja-build gcc libcap-devel
+
+BWRAP_TGZ="bubblewrap-${BWRAP_VERSION}.tar.xz"
+BWRAP_URL="https://github.com/containers/bubblewrap/releases/download/v${BWRAP_VERSION}"
+curl -sSLO "${BWRAP_URL}/${BWRAP_TGZ}"
+curl -sSLO "${BWRAP_URL}/${BWRAP_TGZ}.sha256sum"
+sha256sum -c "${BWRAP_TGZ}.sha256sum"
+
+tar -xf "${BWRAP_TGZ}"
+cd "bubblewrap-${BWRAP_VERSION}"
+meson setup build
+ninja -C build
+install -m 4755 build/bwrap /usr/bin/bwrap
+
+cd /
+rm -rf "${TEMP_DIR}"
+dnf remove -y meson ninja-build gcc libcap-devel
+dnf clean all && rm -rf /var/cache/dnf
+EOF
 
 RUN <<EOF
 oc completion bash > /usr/share/bash-completion/completions/oc