projectcalico · hjiawei · Dec 8, 2025 · Jan 26, 2026
diff --git a/Makefile.common b/Makefile.common
@@ -75,7 +75,7 @@ endif
 # This is only needed when running non-native binaries.
 register:
 ifneq ($(BUILDARCH),$(ARCH))
-	docker run --privileged --rm tonistiigi/binfmt --install all || true
+	docker run --privileged --rm calico/binfmt:qemu-v10.1.3 --install all || true
 endif
 
 # If this is a release, also tag and push additional images.

diff --git a/README.md b/README.md
@@ -50,12 +50,6 @@ For example, if you registered the `s390x` emulator at `/usr/bin/qemu-s390x-stat
 
 To register emulators, we run:
 
-```bash
-docker run --privileged --rm tonistiigi/binfmt --install all
-```
-
-or simply
-
 ```bash
 make register
 ```
@@ -69,7 +63,8 @@ To _run_ a binary from a different architecture, you need to use `binfmt` and `q
 Register `qemu-*-static` for all supported processors except the current one using the following command:
 
 ```bash
-docker run --privileged --rm tonistiigi/binfmt --install all
+# Replace qemu-vx.y.z with the latest tag from https://hub.docker.com/r/calico/binfmt/tags
+docker run --privileged --rm calico/binfmt:qemu-vx.y.z --install all
 ```
 
 If a cross built binary is executed in the go-build container qemu-static will automatically be used.
diff --git a/images/Makefile b/images/Makefile
@@ -35,15 +35,14 @@ else ifeq ($(ARCH),s390)
 	override LDSONAME=ld64.so.1
 endif
 
-UBI_VERSIONS ?= ubi8 ubi9 ubi10
+UBI_VERSIONS ?= ubi9 ubi10
 
 .PHONY: calico-base-image
 calico-base-image: $(addprefix calico-base-image-,$(UBI_VERSIONS))
 
 .PHONY: calico-base-image-%
 calico-base-image-%: register
-	$(eval DOCKERFILE := $(if $(filter ubi8,$*),Dockerfile.ubi8,Dockerfile))
-	$(DOCKER_BUILD) --build-arg LDSONAME=$(LDSONAME) --build-arg=UBI_VERSION=$* -t $(CALICO_BASE):$*-latest-$(ARCH) -f calico-base/$(DOCKERFILE) calico-base/
+	$(DOCKER_BUILD) --build-arg LDSONAME=$(LDSONAME) --build-arg=UBI_VERSION=$* -t $(CALICO_BASE):$*-latest-$(ARCH) -f calico-base/Dockerfile calico-base/
 	$(MAKE) BUILD_IMAGES=$(CALICO_BASE) retag-build-images-with-registries VALIDARCHES=$(ARCH) LATEST_IMAGE_TAG=$*-latest IMAGETAG=$*-latest
 
 .PHONY: calico-base-image-all

diff --git a/images/calico-base/Dockerfile.ubi8 b/images/calico-base/Dockerfile.ubi8
diff --git a/images/calico-go-build/Dockerfile b/images/calico-go-build/Dockerfile
@@ -2,7 +2,7 @@ ARG TARGETARCH=${TARGETARCH}
 
 FROM calico/bpftool:v7.4.0 AS bpftool
 
-FROM registry.access.redhat.com/ubi8/ubi:latest AS ubi
+FROM registry.access.redhat.com/ubi9/ubi:latest AS ubi
 
 ARG TARGETARCH
 
@@ -37,18 +37,20 @@ RUN dnf upgrade -y && dnf install -y \
     xz \
     zip
 
-# Install yq and copy versions.yaml
-RUN curl -sfL https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${TARGETARCH} -o /usr/local/bin/yq && chmod +x /usr/local/bin/yq
+# Install system dependencies that are not in UBI repos
+COPY almalinux/RPM-GPG-KEY-AlmaLinux-9 /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
+COPY almalinux/almalinux*.repo /etc/yum.repos.d/
 
+# Install yq and copy versions.yaml
 COPY versions.yaml /etc/versions.yaml
 
-# Install system dependencies that are not in UBI repos
-COPY almalinux/RPM-GPG-KEY-AlmaLinux /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
-COPY almalinux/almalinux*.repo /etc/yum.repos.d/
+RUN set -eux; \
+    dnf --enablerepo=extras install -y epel-release && \
+    dnf install -y yq
 
 RUN set -eux; \
     llvm_version=$(yq -r .llvm.version /etc/versions.yaml); \
-    dnf --enablerepo=baseos,powertools,appstream install -y \
+    dnf --enablerepo=appstream,baseos,crb install -y \
     clang-${llvm_version} \
     elfutils-libelf-devel \
     iproute-devel \
@@ -58,7 +60,7 @@ RUN set -eux; \
 
 RUN set -eux; \
     if [ "${TARGETARCH}" = "amd64" ]; then \
-        dnf --enablerepo=powertools install -y \
+        dnf --enablerepo=appstream,baseos,crb install -y \
             mingw64-gcc; \
     fi
 

diff --git a/images/calico-go-build/almalinux/RPM-GPG-KEY-AlmaLinux b/images/calico-go-build/almalinux/RPM-GPG-KEY-AlmaLinux
diff --git a/images/calico-go-build/almalinux/RPM-GPG-KEY-AlmaLinux-9 b/images/calico-go-build/almalinux/RPM-GPG-KEY-AlmaLinux-9
@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGHmnykBEACuIcqcNYTmu2q58XI5NRZowdJGAxxs+6ExX7qsa4vbPp6St7lB
+JmLpwf5p6czIBhLL4b8E7zJpu57tVDo7Ejw6Hv584rbI8vw7pnMTe6XUFhMTL8FT
+lyAmn8xAIlcyM+SzshnxAc5b8E0p/egMonr3J1QnvMSfixMQ59GrmLVyece7Vv3J
+4fREh6k31kg7eQdEkzRQhRdO2KyxWYLR0A6haXSXVaiBOjFF7iUs7anlJSfeD3FO
+afPq0Ix8oWi+mUc4txkABMdsGpdkE/MHOwN90FB8EG5XVrdv3emm3yzKMMzb53Yd
+jcf0fovIeRloQyl9+CrVCnkBjFcIFBZZddsB43kM7eTflmAQ+tanOZ8OKBRPMtmI
+56b/vk31ozHUoST/NmjbEI5tu+QYCuFSZ++mC06qJg0Bkw821DTAsM7Kynuj7K2f
+WWQjlDL9ZsFifLqDXRymL+sn6g142hHQOa5KSHtT7cAcrm6L48gEL3fPntVSOU/H
+BlTnODiSSTIsIRNA7kBkbSP3wWoYC1JQPmNYbUtZ7va2uXNb9dGT2k7Ae0465WND
+wqRQJDxsr6TLYFpti+JRaOpSMNclXz4kRSP263Y4ZzQvkMGgSgwqg7JU00Uahk2p
+KTlJAA8AiaMBdShlo/QXvL29Lyg0Y5klq2HCNziJDupWhXto5j5pjixrpwARAQAB
+tCdBbG1hTGludXggT1MgOSA8cGFja2FnZXJAYWxtYWxpbnV4Lm9yZz6JAk4EEwEI
+ADgWIQS/GKwodheJCNbnEmfTbLhsuGs3FgUCYeafKQIbAwULCQgHAgYVCgkICwIE
+FgIDAQIeAQIXgAAKCRDTbLhsuGs3FrvnD/9X1wDM/C214t3UVsMVjTLdIJDGG+iU
+E7Uk7QGeyeNif19rRatzXUHBBGjiAwpxe2rkveWBHCHPSUKqsAR9Arv3nMKiaGfA
+0nomzDndLEDIgv35xzaU6OhX95mZzvj+9PThuxDxUnsNoA+7vGkaiRw+cyyDdTJQ
+bKwum8bx1gS8Kbqo9mqrMekQ4NHCodq9bb2hI6pAxlYa472QuwFAXFAzbE3LIMIK
+hzLkew7nxwP0txP/zzqPw4lYN38fg9AlHL2qgf0twCFO4N/ftkw25qwoiBhiwaWT
+Ca8Z9wUJx35Z/ufscbNrtRrIGYNXTDFJdGY/WxKDp7QsyOx/sclcsSksKoC/52tL
+2yFLQrMXsqnLjAQajA6adaeCAAwvp2/8VP8R65O4KMuKghMneCGwXVlVVYyRUXJD
+Kjg7EvmmMGuh/Lj2A/vj+mQMmlS2kAl0qOsK9DtUIA7Z9m98zI3UmN/5BMb/HdqW
+KADagOW9IPyo6IaSIT+A+7npTN1Y7m1aIrL1vsAKrus4MrCvAs1vYqzqIikv88Di
+EWYVFCWTsTWf7jxBCVTLn1Lr7Mj08i+7OgRgguQGpcnvKsbwq1v2whQrs+YKR9hP
+vVaW5DmGJ5brPykJUaQS6p5Esp1q3HBk0HbBxiiGIwGsKbLp0pKsk5TLzMIJwIG/
+lEolCV+fJ0P4nLkCDQRh5p8pARAAvXTL29arJ5Dl9FXVpE4Km1jJLaK2WfbQARJz
+ygQKps9QNqS1yz7C7mYdTtgRxeK2eqcX5oA83w3ppJ0DTsxfAkY3nqAXS8+QRORU
+ffSFvhdsU1G/qpvhX0Aq62gr4y1bkIMr9GlLq86uVKIQrNdmto4NDfQc1bDD5e4j
+KaNMmNLXxq/s67AxFW/yLchYYZ7cMqQd6Ab4lacqpGdYFIAkBkVMmj3GUSo+FLpl
++4c50AZ8O0aB+xkrjch+4PoVyIpIC1IuqNYBYn2wMYFB414QY2iDopzpZXUhpCqx
+NP4Zyhl1noUcOtH/wUfH1JsIcYRn0ixWF6JnE9KmjpkqBuM2/4Ot/bl67iPiN/if
+vf3Z1kYjNPaszoMW3kmJj8MlBCSH9w6nQRG/eikihbeUDBB6rh2O7Dz8ltFqlt8N
+asbngRoNZMnWMnItRV67Fo0pfn/DZA8VvI029apE21sNp6l7MUa8Z2/I/PNq10E8
+rPMQM//k9y2kgxz52i6iCyesobPvun6UC4xuFoYKUTQMgKQgqOhyZ4evkepFhmHg
+Gzx+F8EmwN1FtxfNxfLtQZSUT3kxuUDizwpaH/LkSkRXpJOQyHJL6VBINNTjB4j1
+3+0jD+lCV6xIt88NYkGJL9rtKwZLQHSDPiI0ooCJ69GKy8SmSx04AwSsY67In1q8
++FQjT20AEQEAAYkCNgQYAQgAIBYhBL8YrCh2F4kI1ucSZ9NsuGy4azcWBQJh5p8p
+AhsMAAoJENNsuGy4azcW0KkP/i0YLRv+pDiSC4034oboczAnNrzJnBhqTi9cUEGn
+Xpqvf/Zz3opqvRQiqZAgVcCtxfW+P9J3Vb/mBJ6OkR/jywAlY5il2dzK08YfVXmP
+cEf6RF4M0KNtlYJmPlnQCZjMJaisrPmYD3Yy8ER1qJ5JQZ7n0REHZCbBCqH8w+5r
+j4ohEHY7xXbd7+tvWTCk2MkHaide/UV/04WiO064AoZSUze/vaAx8Ll4AyFpxuIk
+ktXZXbq7MaVzqYYJptiRB6TljzMwIbblLm9A7T7YTA/1rNe12OhDT8VoR3gG2C/l
+Mtf37EmYq3QVqFlbj4+ouQWIiQmp5dQenH5ugf+Bob7IiENpxzF1cIu6wd4p5Y64
+3cdYUoxrjhsCM6W1lSqECoN8yXJnRTxpBwwm65SVk477KS2h77aJfa+v5UnBhpSt
+eVlAhs0A8Qp/hX3o7qMO1jWca3zdJwXppLlFEYTVaFUOUrc4Lhlbi0gAnn8aBwSx
+xF1r5GhPGIBzHtRgulwZkmS6VwtDMuC6KlrASu9f93D5gLZqVk22Oar9LpgCEACd
+8Gw/+BFbdANqo9IKmDrWf7k/YuEqZ3h+eoyKI/2z7dKh/fcVEydMTn3LB4nFRvSD
+AZ27tvC0IUXCUNx7iJdrD5kDsMhZRl5/dXbe539G4y2W00QYuJC0DpUvGdtOuaFx
+1WKL
+=jk2t
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/images/calico-go-build/almalinux/almalinux-appstream.repo b/images/calico-go-build/almalinux/almalinux-appstream.repo
@@ -1,10 +1,10 @@
-# almalinux-appstream.repo
-
 [appstream]
 name=AlmaLinux $releasever - AppStream
 mirrorlist=https://mirrors.almalinux.org/mirrorlist/$releasever/appstream
 # baseurl=https://repo.almalinux.org/almalinux/$releasever/AppStream/$basearch/os/
 enabled=0
 gpgcheck=1
 countme=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
+metadata_expire=86400
+enabled_metadata=1
diff --git a/.../calico-go-build/almalinux/almalinux.repo → ...-go-build/almalinux/almalinux-baseos.repo b/.../calico-go-build/almalinux/almalinux.repo → ...-go-build/almalinux/almalinux-baseos.repo
@@ -1,10 +1,10 @@
-# almalinux.repo
-
 [baseos]
 name=AlmaLinux $releasever - BaseOS
 mirrorlist=https://mirrors.almalinux.org/mirrorlist/$releasever/baseos
 # baseurl=https://repo.almalinux.org/almalinux/$releasever/BaseOS/$basearch/os/
 enabled=0
 gpgcheck=1
 countme=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
+metadata_expire=86400
+enabled_metadata=1
diff --git a/images/calico-go-build/almalinux/almalinux-crb.repo b/images/calico-go-build/almalinux/almalinux-crb.repo
@@ -0,0 +1,10 @@
+[crb]
+name=AlmaLinux $releasever - CRB
+mirrorlist=https://mirrors.almalinux.org/mirrorlist/$releasever/crb
+# baseurl=https://repo.almalinux.org/almalinux/$releasever/CRB/$basearch/os/
+enabled=0
+gpgcheck=1
+countme=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
+metadata_expire=86400
+enabled_metadata=0
diff --git a/images/calico-go-build/almalinux/almalinux-extras.repo b/images/calico-go-build/almalinux/almalinux-extras.repo
@@ -0,0 +1,10 @@
+[extras]
+name=AlmaLinux $releasever - Extras
+mirrorlist=https://mirrors.almalinux.org/mirrorlist/$releasever/extras
+# baseurl=https://repo.almalinux.org/almalinux/$releasever/extras/$basearch/os/
+enabled=0
+gpgcheck=1
+countme=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
+metadata_expire=86400
+enabled_metadata=0
diff --git a/images/calico-go-build/almalinux/almalinux-powertools.repo b/images/calico-go-build/almalinux/almalinux-powertools.repo
diff --git a/images/calico-go-build/versions.yaml b/images/calico-go-build/versions.yaml
@@ -9,4 +9,4 @@ golang:
 kubernetes:
   version: 1.34.3
 llvm:
-  version: 18.1.8
+  version: 20.1.8