ROX-36081: remove curl, vim from scanner-db image

[janisz]

Expand rpm -e glob patterns to match curl-minimal/libcurl-minimal, vim-minimal, and python3 packages that are not needed at runtime and carry HIGH CVEs flagged in GovCloud compliance scans.

Mirrors the fix applied to central-db and scanner-v4-db in stackrox/stackrox#22269.

Partially generated by AI.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 30447278-5847-477b-8c45-636f698f8a7d

📥 Commits

Reviewing files that changed from the base of the PR and between aa8c3e1 and 42c1dac.

📒 Files selected for processing (3)

• image/db/rhel/Dockerfile
• image/db/rhel/Dockerfile.slim
• image/db/rhel/konflux.Dockerfile

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Reduced container image size by removing additional packages and tools, including curl, libcurl, Vim, and package-management components.
  • Python 3 remains available.

Walkthrough

The RHEL image cleanup commands now remove additional curl, libcurl, Vim, and package-management packages. Python 3 remains unaffected.

Changes

RHEL package cleanup

Layer / File(s)	Summary
Expand package cleanup image/db/rhel/Dockerfile, image/db/rhel/Dockerfile.slim, image/db/rhel/konflux.Dockerfile	The cleanup commands remove broader curl* and libcurl* patterns, Vim packages, and package-management components. The slim image retains explicit package exclusions and explanatory comments.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Mergeability Score: 🔵 Low · up to 42c1d

The image changes remove curl, vim, and Python packages from three scanner database variants; if a remaining runtime, startup, or upgrade path depends on them, the image could fail in use. The PR is mergeable with explicit owner verification of package consumers across all variants.

Suggested reviewers: crozzy, rhacs-bot, alkmim

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the removal of curl and Vim from the scanner-db image.
Description check	✅ Passed	The description explains the package-removal changes, CVE rationale, Python 3 retention, and related fixes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ROX-36081-remove-unused-pkgs

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

/retest scanner-on-push

[openshift-ci]

@github-actions[bot]: The /retest command does not accept any targets.
The following commands are available to trigger optional jobs:

/test e2e-tests

/test slim-e2e-tests

Use /test all to run all jobs.

Details

In response to this:

/retest scanner-on-push

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.