(In reply to Raghavendra Talur from comment #0)
> Description of problem:
> RHEL 7 has released new nss packages and we should build container to get
> these.

rhgs-volmanager-docker:3.2.0-9 doesn't seem to have the latest nss packages as expected. See below:

#########
[root@dhcp46-35 ~]# docker ps |grep rhgs-vol
eec515aa1701        rhgs3/rhgs-volmanager-rhel7:3.2.0-9                          "/usr/sbin/heketi-sta"   10 minutes ago      Up 10 minutes                           k8s_heketi.5e67fda_heketi-1-v70x2_storage-project_90f388e3-28e3-11e7-b3e8-005056b3aa40_d921b424


[root@dhcp46-35 ~]# docker exec -ti eec515aa1701 /bin/bash

[root@heketi-1-v70x2 /]# cat /etc/redhat-storage-release 
Red Hat Gluster Volume Manager 3.2 ( Container)

[root@heketi-1-v70x2 /]# rpm -qa |grep heketi
heketi-4.0.0-8.el7rhgs.x86_64
python-heketi-4.0.0-8.el7rhgs.x86_64
heketi-client-4.0.0-8.el7rhgs.x86_64

[root@heketi-1-v70x2 /]# rpm -qa |grep nss-  
nss-sysinit-3.21.3-2.el7_3.x86_64
nss-tools-3.21.3-2.el7_3.x86_64
nss-softokn-freebl-3.16.2.3-14.4.el7.x86_64
nss-util-3.21.3-1.1.el7_3.x86_64
nss-softokn-3.16.2.3-14.4.el7.x86_64
nss-3.21.3-2.el7_3.x86_64

[root@heketi-1-v70x2 /]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.3 (Maipo)

[root@heketi-1-v70x2 /]# cat /etc/os-release     
NAME="Red Hat Enterprise Linux Server"
VERSION="7.3 (Maipo)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="7.3"
PRETTY_NAME="Red Hat Enterprise Linux Server 7.3 (Maipo)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:7.3:GA:server"
HOME_URL="https://www.redhat.com/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 7"
REDHAT_BUGZILLA_PRODUCT_VERSION=7.3
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="7.3"
#########

Reassigning this bug for providing a new image.

This seems to be because we don't do a update of packages in volmanager docker file but we do so in server dockerfile.

$ cat Code/rhpkg/rhgs-server-docker/Dockerfile | grep -e FROM -e update
FROM rhel7.3:7.3-released
RUN yum --nogpgcheck -y update; yum clean all;
{0} 17:36:10 rtalur@rastarpad2 [~]
$ cat Code/rhpkg/rhgs-volmanager-docker/Dockerfile | grep -e FROM -e update
FROM rhel7.3:7.3-released


Need to confirm.

(In reply to Raghavendra Talur from comment #4)
> This seems to be because we don't do a update of packages in volmanager
> docker file but we do so in server dockerfile.
> 
> $ cat Code/rhpkg/rhgs-server-docker/Dockerfile | grep -e FROM -e update
> FROM rhel7.3:7.3-released
> RUN yum --nogpgcheck -y update; yum clean all;
> {0} 17:36:10 rtalur@rastarpad2 [~]
> $ cat Code/rhpkg/rhgs-volmanager-docker/Dockerfile | grep -e FROM -e update
> FROM rhel7.3:7.3-released
> 
> 
> Need to confirm.

It was supposed to be there in the rhel base image. Yes, we do not update. It is better to yum update from container building too.

If I pull the latest rhel image from brew-pulp, I do get image which has latest nss packages. However, in our dockerfile, it is rhel7.3:7.3-released. Should check from where that gets images from.

[root@minsky ~]# docker run -it brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7:7.3 bash      
Unable to find image 'brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7:7.3' locally
Trying to pull repository brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7 ... 
7.3: Pulling from brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7

d69c699587ce: Pull complete 
efe5bcbf36e4: Pull complete 
Digest: sha256:f42016a64d4f3a402716874ae133cd440977a4e1e16583a1b336fdf73f4ae1c0
Status: Downloaded newer image for brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7:7.3
[root@106c7a283c7d /]# rpm -qa  | grep nss
nss-sysinit-3.28.4-1.0.el7_3.x86_64
nss-softokn-freebl-3.16.2.3-14.4.el7.x86_64
nss-util-3.28.4-1.0.el7_3.x86_64
nss-softokn-3.16.2.3-14.4.el7.x86_64
openssl-libs-1.0.1e-60.el7_3.1.x86_64
nss-3.28.4-1.0.el7_3.x86_64
nss-tools-3.28.4-1.0.el7_3.x86_64
[root@106c7a283c7d /]#

Also, this rhel image mentioned above is build on 23rd, we built on 21st.
https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=13064670

(In reply to Raghavendra Talur from comment #7)
> If I pull the latest rhel image from brew-pulp, I do get image which has
> latest nss packages. However, in our dockerfile, it is rhel7.3:7.3-released.
> Should check from where that gets images from.
> 
> [root@minsky ~]# docker run -it
> brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7:7.3 bash      
> Unable to find image
> 'brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7:7.3' locally
> Trying to pull repository
> brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7 ... 
> 7.3: Pulling from brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7
> 
> d69c699587ce: Pull complete 
> efe5bcbf36e4: Pull complete 
> Digest:
> sha256:f42016a64d4f3a402716874ae133cd440977a4e1e16583a1b336fdf73f4ae1c0
> Status: Downloaded newer image for
> brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhel7:7.3
> [root@106c7a283c7d /]# rpm -qa  | grep nss
> nss-sysinit-3.28.4-1.0.el7_3.x86_64
> nss-softokn-freebl-3.16.2.3-14.4.el7.x86_64
> nss-util-3.28.4-1.0.el7_3.x86_64
> nss-softokn-3.16.2.3-14.4.el7.x86_64
> openssl-libs-1.0.1e-60.el7_3.1.x86_64
> nss-3.28.4-1.0.el7_3.x86_64
> nss-tools-3.28.4-1.0.el7_3.x86_64
> [root@106c7a283c7d /]#

https://mojo.redhat.com/docs/DOC-1023066#jive_content_id_Parent_image

We have to use the released tag for using the rhel image which is pushed to live.

It is better to build with yum update. As the rhel image is about to release on 23rd May. 

Ref: https://errata.devel.redhat.com/errata/container/28202

Verified as fixed in  rhgs-volmanager-docker:3.2.0-10

####################
[root@dhcp46-36 ~]# docker images |grep rhgs-vol
brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/rhgs3/rhgs-volmanager-rhel7     3.2.0-10            513e5731ad69        15 hours ago        328.8 MB

[root@dhcp46-36 ~]# docker ps |grep rhgs-vol
51329a961937        rhgs3/rhgs-volmanager-rhel7:3.2.0-10     "/usr/sbin/heketi-sta"   About a minute ago   Up About a minute                       k8s_heketi.ed7d800f_heketi-1-2127l_storage-project_a206e659-2992-11e7-b3e8-005056b3aa40_641e9741

[root@dhcp46-36 ~]# docker exec -ti 51329a961937 /bin/bash
[root@heketi-1-2127l /]#
[root@heketi-1-2127l /]# cat /etc/redhat-storage-release 
Red Hat Gluster Volume Manager 3.2 ( Container)

[root@heketi-1-2127l /]# cat /etc/redhat-release         
Red Hat Enterprise Linux Server release 7.3 (Maipo)

[root@heketi-1-2127l /]# rpm -qa |grep heketi
heketi-4.0.0-9.el7rhgs.x86_64
python-heketi-4.0.0-9.el7rhgs.x86_64
heketi-client-4.0.0-9.el7rhgs.x86_64

[root@heketi-1-2127l /]# rpm -qa |grep nss-
nss-sysinit-3.28.4-1.0.el7_3.x86_64
nss-tools-3.28.4-1.0.el7_3.x86_64
nss-softokn-freebl-3.16.2.3-14.4.el7.x86_64
nss-softokn-3.16.2.3-14.4.el7.x86_64
nss-util-3.28.4-1.0.el7_3.x86_64
nss-3.28.4-1.0.el7_3.x86_64

[root@heketi-1-2127l /]# rpm -qa --qf='%{name}-%{version}-%{release} %{SIGPGP:pgpsig}\n' | grep -v fd431d51  
[root@heketi-1-2127l /]#
####################

Edited the doc text to include in the errata

doc text looks good.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1170