[SHOT-252] fix: Move MSSQL base to mcr.microsoft.com/mssql/rhel/server

[mimartin12]

🎟️ Tracking

SHOT-252

📔 Objective

Moves util/MsSql's base image from mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-22.04 to mcr.microsoft.com/mssql/rhel/server:2025-CU5-rhel-9.1. The RHEL/UBI9 base ships the OpenSSL FIPS provider in-image, so FIPS-enabled hosts load it instead of crash-looping on TLS init (the failure mode SHOT-251 patched by pinning to Ubuntu 22.04). Ubuntu 22.04 LTS support ends April 2027 and Microsoft can drop that tag on any future CU, so this replaces the pin with a base that doesn't need one.

Also:

• Drops the apt-get install gosu tzdata step. Both come preinstalled or replaced (setpriv) on the RHEL base.
• Swaps entrypoint.sh's two gosu calls for setpriv --reuid --regid --init-groups, with a HOME export added since setpriv (unlike gosu) doesn't reset it for the target user.
• Pins the MsSql CI build matrix to linux/amd64. It was silently inheriting a multi-arch default that doesn't apply to this base, or the Ubuntu one either.

Validated on a real FIPS-enabled RHEL 9 VM, three images back to back on the same host:

• ghcr.io/bitwarden/mssql:2026.7.2 (current release, Ubuntu 24.04): crash-loops, Internal error occurred initializing the TLS configuration.
• PR [SHOT-251] build: update Dockerfile to use Ubuntu 22.04 #8195's build (Ubuntu 22.04): passes, healthy, RestartCount=0.
• This branch's image (RHEL/UBI9): passes, healthy, RestartCount=0.

PR #8195 alone already fixes the crash. This is the longer-term fix so we're not relying on an EOL-bound Ubuntu tag.

📸 Screenshots

N/A

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the MSSQL image base swap from mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-22.04 to mcr.microsoft.com/mssql/rhel/server:2025-CU5-rhel-9.1, the gosu → setpriv privilege-drop replacement in util/MsSql/entrypoint.sh, and the linux/amd64 platform pin in the build matrix. The setpriv --reuid/--regid --init-groups calls are a faithful gosu equivalent (real, effective, and saved UIDs are all set, and supplementary groups are re-initialized rather than inherited from root), and the added export HOME=/home/$USERNAME correctly compensates for gosu having set $HOME on behalf of the target user. The platform pin is consumed correctly by the Set platforms step, and the Build Docker images (MsSql, ./util, linux/amd64) job passes, confirming the new base resolves and mssql-conf still lives at the expected path.

Code Review Details

No new findings this pass. The previously opened question below is still unresolved and remains the main open item, since CI validates only that the image builds — the entrypoint, healthcheck, and backup loop are never exercised on the new base.

• ❓ : Was tzdata confirmed present in the RHEL base? backup-db.sh exports TZ and uses date -d; a missing zoneinfo database silently falls back to UTC rather than failing (existing unresolved thread)
  • util/MsSql/Dockerfile:1

PR Metadata Assessment

• ❓ QUESTION: The description is the unmodified template — no objective or test plan.
  • Worth recording how the image was validated (non-root startup, healthcheck via /opt/mssql-tools18/bin/sqlcmd, backup loop) since CI covers none of it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.29%. Comparing base (b045928) to head (1b9e495).
⚠️ Report is 8 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (b045928) and HEAD (1b9e495). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (b045928)	HEAD (1b9e495)
	2	1

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8239      +/-   ##
==========================================
- Coverage   68.59%   63.29%   -5.30%     
==========================================
  Files        2383     2401      +18     
  Lines      103921   104043     +122     
  Branches     9403     9426      +23     
==========================================
- Hits        71286    65856    -5430     
- Misses      30294    35931    +5637     
+ Partials     2341     2256      -85     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[withinfocus]

Do we have any precedent for RHEL here? Would this be the only usage, anywhere?