datopsis · joey-huckabee · Sep 11, 2026 · Sep 11, 2026
@@ -14,7 +14,7 @@ body:
     attributes:
       label: Image tag and digest
       description: Include both when available; do not report only `latest`.
-      placeholder: ghcr.io/datopsis/clickhouse-server-ubi9:v...@sha256:...
+      placeholder: ghcr.io/datopsis/clickhouse-ubi:v...@sha256:...
     validations:
       required: true
   - type: input

@@ -1,7 +1,7 @@
 blank_issues_enabled: true
 contact_links:
   - name: Report a vulnerability privately
-    url: https://github.com/datopsis/clickhouse-server-ubi9/security/advisories/new
+    url: https://github.com/datopsis/clickhouse-ubi/security/advisories/new
     about: Never disclose a suspected vulnerability in a public issue.
   - name: ClickHouse upstream support
     url: https://github.com/ClickHouse/ClickHouse/issues

@@ -76,8 +76,8 @@ jobs:
       contents: read
       security-events: write
     env:
-      TEST_IMAGE: ghcr.io/datopsis/clickhouse-server-ubi9:test-${{ matrix.architecture }}
-      SBOM_FILE: clickhouse-server-ubi9-${{ matrix.architecture }}.spdx.json
+      TEST_IMAGE: ghcr.io/datopsis/clickhouse-ubi:test-${{ matrix.architecture }}
+      SBOM_FILE: clickhouse-ubi-${{ matrix.architecture }}.spdx.json
       GRYPE_SARIF: grype-${{ matrix.architecture }}.sarif
       GRYPE_ALL: grype-all-${{ matrix.architecture }}.json
       SCAP_SCANNER_IMAGE: localhost/datopsis-openscap:0.1.82-${{ matrix.architecture }}

@@ -12,7 +12,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  IMAGE: ghcr.io/datopsis/clickhouse-server-ubi9
+  IMAGE: ghcr.io/datopsis/clickhouse-ubi
 
 jobs:
   release:

@@ -6,7 +6,7 @@
 .pre-commit-cache/
 .smoke-secrets.*/
 .tls-rehearsal.*/
-/clickhouse-server-ubi9.spdx.json
+/clickhouse-ubi.spdx.json
 /grype.sarif
 /grype-all.json
 /image.intoto.jsonl

@@ -33,4 +33,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
+- Renamed the source repository and planned GHCR image from
+  `clickhouse-server-ubi`/`clickhouse-server-ubi9` to `clickhouse-ubi`, aligning
+  the public identity with the `nginx-ubi` and `postgresql-ubi` projects.
 - The entrypoint now derives primary and additional writable directories from the effective ClickHouse configuration, rejects the misleading `CLICKHOUSE_DATA_DIR` variable, and reports non-root permission failures before server startup.
@@ -9,8 +9,8 @@ This repository builds a security-oriented ClickHouse Server container on Red Ha
 Build and test commands are documented in `README.md`. The primary local verification is:
 
 ```bash
-podman build --format docker --file Containerfile --tag ghcr.io/datopsis/clickhouse-server-ubi9:test .
-CONTAINER_RUNTIME=podman IMAGE=ghcr.io/datopsis/clickhouse-server-ubi9:test bash tests/smoke.sh
+podman build --format docker --file Containerfile --tag ghcr.io/datopsis/clickhouse-ubi:test .
+CONTAINER_RUNTIME=podman IMAGE=ghcr.io/datopsis/clickhouse-ubi:test bash tests/smoke.sh
 ```
 
 ## Git conventions

@@ -74,8 +74,8 @@ ARG CLICKHOUSE_VERSION="26.8.2.7"
 
 LABEL org.opencontainers.image.title="ClickHouse Server on Red Hat UBI 9" \
       org.opencontainers.image.description="A minimal, non-root ClickHouse Server image built on Red Hat UBI 9 Micro" \
-      org.opencontainers.image.source="https://github.com/datopsis/clickhouse-server-ubi9" \
-      org.opencontainers.image.documentation="https://github.com/datopsis/clickhouse-server-ubi9#readme" \
+      org.opencontainers.image.source="https://github.com/datopsis/clickhouse-ubi" \
+      org.opencontainers.image.documentation="https://github.com/datopsis/clickhouse-ubi#readme" \
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.vendor="Datopsis" \
       org.opencontainers.image.version="${CLICKHOUSE_VERSION}"

@@ -38,8 +38,8 @@ COPY --chmod=0755 scripts/scap-container.sh /usr/local/bin/scap-container
 COPY --chown=0:0 --chmod=0444 security/scap/datopsis-ubi9-micro-tailoring.xml /opt/scap/datopsis-ubi9-micro-tailoring.xml
 
 LABEL org.opencontainers.image.title="Datopsis OpenSCAP offline scanner" \
-      org.opencontainers.image.description="Pinned, isolated CI scanner for clickhouse-server-ubi9 exported filesystems" \
-      org.opencontainers.image.source="https://github.com/datopsis/clickhouse-server-ubi9"
+      org.opencontainers.image.description="Pinned, isolated CI scanner for clickhouse-ubi exported filesystems" \
+      org.opencontainers.image.source="https://github.com/datopsis/clickhouse-ubi"
 
 USER 65534:65534
 

@@ -1,10 +1,10 @@
 # ClickHouse Server on Red Hat UBI 9
 
-[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/datopsis/clickhouse-server-ubi9/badge)](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-server-ubi9)
-[![CI](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/ci.yml)
-[![CodeQL](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/codeql.yml)
-[![Latest release](https://img.shields.io/github/v/release/datopsis/clickhouse-server-ubi9?display_name=tag&sort=semver)](https://github.com/datopsis/clickhouse-server-ubi9/releases)
-[![License](https://img.shields.io/github/license/datopsis/clickhouse-server-ubi9)](LICENSE)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/datopsis/clickhouse-ubi/badge)](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-ubi)
+[![CI](https://github.com/datopsis/clickhouse-ubi/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/datopsis/clickhouse-ubi/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/datopsis/clickhouse-ubi/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/datopsis/clickhouse-ubi/actions/workflows/codeql.yml)
+[![Latest release](https://img.shields.io/github/v/release/datopsis/clickhouse-ubi?display_name=tag&sort=semver)](https://github.com/datopsis/clickhouse-ubi/releases)
+[![License](https://img.shields.io/github/license/datopsis/clickhouse-ubi)](LICENSE)
 [![Base: Red Hat UBI 9](https://img.shields.io/badge/base-Red%20Hat%20UBI%209-EE0000?logo=redhat&logoColor=white)](https://developers.redhat.com/products/rhel/ubi)
 [![SBOM: SPDX JSON](https://img.shields.io/badge/SBOM-SPDX%20JSON-2F80ED)](docs/CI.md#artifacts-and-retention)
 
@@ -48,7 +48,7 @@ podman run --detach \
   --cap-drop ALL \
   --security-opt no-new-privileges \
   --volume clickhouse-data:/var/lib/clickhouse \
-  ghcr.io/datopsis/clickhouse-server-ubi9:<release-tag>
+  ghcr.io/datopsis/clickhouse-ubi:<release-tag>
 ```
 
 Then query it with a ClickHouse client:
@@ -104,9 +104,9 @@ Podman is the primary documented local runtime. Podman uses OCI format by defaul
 
 ```console
 podman build --format docker --file Containerfile \
-  --tag ghcr.io/datopsis/clickhouse-server-ubi9:test .
+  --tag ghcr.io/datopsis/clickhouse-ubi:test .
 CONTAINER_RUNTIME=podman \
-  IMAGE=ghcr.io/datopsis/clickhouse-server-ubi9:test \
+  IMAGE=ghcr.io/datopsis/clickhouse-ubi:test \
   bash tests/smoke.sh
 ```
 
@@ -128,14 +128,14 @@ Verify a release with GitHub as the keyless identity provider:
 
 ```console
 cosign verify \
-  --certificate-identity-regexp='https://github.com/datopsis/clickhouse-server-ubi9/.github/workflows/release.yml@refs/tags/.*' \
+  --certificate-identity-regexp='https://github.com/datopsis/clickhouse-ubi/.github/workflows/release.yml@refs/tags/.*' \
   --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
-  ghcr.io/datopsis/clickhouse-server-ubi9@sha256:<digest>
+  ghcr.io/datopsis/clickhouse-ubi@sha256:<digest>
 
 cosign verify-attestation --type spdxjson \
-  --certificate-identity-regexp='https://github.com/datopsis/clickhouse-server-ubi9/.github/workflows/release.yml@refs/tags/.*' \
+  --certificate-identity-regexp='https://github.com/datopsis/clickhouse-ubi/.github/workflows/release.yml@refs/tags/.*' \
   --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
-  ghcr.io/datopsis/clickhouse-server-ubi9@sha256:<digest>
+  ghcr.io/datopsis/clickhouse-ubi@sha256:<digest>
 ```
 
 ## Operational notes

@@ -3,7 +3,7 @@ services:
     build:
       context: .
       dockerfile: Containerfile
-    image: ghcr.io/datopsis/clickhouse-server-ubi9:local
+    image: ghcr.io/datopsis/clickhouse-ubi:local
     environment:
       CLICKHOUSE_PASSWORD: change-me
     ports:

@@ -22,7 +22,7 @@ The canonical badge markup lives at the top of `README.md`. When changing it:
 
 1. use HTTPS for both the image and destination;
 2. link workflow badges to the workflow page, not to a single run;
-3. keep repository coordinates explicit as `datopsis/clickhouse-server-ubi9`;
+3. keep repository coordinates explicit as `datopsis/clickhouse-ubi`;
 4. URL-encode static badge labels and values;
 5. preview links while signed out so badges do not depend on private credentials; and
 6. update this inventory in the same pull request.

@@ -84,7 +84,7 @@ Trivy and Grype deliberately overlap. They use different databases and matching
 
 | Artifact | Location | Retention or lifecycle | Purpose |
 | --- | --- | --- | --- |
-| `clickhouse-server-ubi9-<architecture>.spdx.json` | CI artifact `image-security-<commit>-<architecture>` | 14 days | Package inventory for the exact native AMD64 or ARM64 test image. |
+| `clickhouse-ubi-<architecture>.spdx.json` | CI artifact `image-security-<commit>-<architecture>` | 14 days | Package inventory for the exact native AMD64 or ARM64 test image. |
 | `grype-<architecture>.sarif` | Same architecture-specific CI artifact and GitHub code scanning on non-PR runs | 14 days for the downloadable artifact | Machine-readable findings and architecture-specific review evidence. |
 | `grype-all-<architecture>.json` | Architecture-specific CI artifact | 14 days | Complete point-in-time inventory including unfixed Low and Medium matches for human triage. The release workflow separately retains `grype-all.json` for 30 days. |
 | `scap-results-<architecture>/` | Architecture-specific CI artifact | 14 days | Tailored ARF/XCCDF/HTML, full JSON rule inventory, exit code, data-stream and tailoring hashes, scanner version, and RPM versions for the exact target/scanner image IDs. |
@@ -106,11 +106,11 @@ ARCHITECTURE=amd64
 MACHINE=x86_64
 test "$(uname -m)" = "${MACHINE}"
 podman build --format docker --platform "linux/${ARCHITECTURE}" \
-  --file Containerfile --tag "clickhouse-server-ubi9:test-${ARCHITECTURE}" .
+  --file Containerfile --tag "clickhouse-ubi:test-${ARCHITECTURE}" .
 test "$(podman image inspect --format '{{.Architecture}}' \
-  "clickhouse-server-ubi9:test-${ARCHITECTURE}")" = "${ARCHITECTURE}"
+  "clickhouse-ubi:test-${ARCHITECTURE}")" = "${ARCHITECTURE}"
 CONTAINER_RUNTIME=podman \
-  IMAGE="clickhouse-server-ubi9:test-${ARCHITECTURE}" bash tests/smoke.sh
+  IMAGE="clickhouse-ubi:test-${ARCHITECTURE}" bash tests/smoke.sh
 ```
 
 Build and run the isolated tailored SCAP scanner with the Podman procedure in
@@ -123,21 +123,21 @@ For the scanner examples below, keep using the architecture-specific image name:
 
 ```console
 ARCHITECTURE=amd64
-IMAGE="clickhouse-server-ubi9:test-${ARCHITECTURE}"
+IMAGE="clickhouse-ubi:test-${ARCHITECTURE}"
 ```
 
 With Trivy, Syft 1.51.1, and Grype 0.118.0 installed from their official release instructions:
 
 ```console
 trivy config --severity HIGH,CRITICAL --exit-code 1 .
 trivy image --ignore-unfixed --severity HIGH,CRITICAL --exit-code 1 "${IMAGE}"
-syft "${IMAGE}" --output "spdx-json=clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json"
+syft "${IMAGE}" --output "spdx-json=clickhouse-ubi-${ARCHITECTURE}.spdx.json"
 python scripts/augment-spdx.py \
-  --input "clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json" \
-  --output "clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json"
-grype "sbom:clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json" \
+  --input "clickhouse-ubi-${ARCHITECTURE}.spdx.json" \
+  --output "clickhouse-ubi-${ARCHITECTURE}.spdx.json"
+grype "sbom:clickhouse-ubi-${ARCHITECTURE}.spdx.json" \
   --only-fixed --fail-on high --output table
-grype "sbom:clickhouse-server-ubi9-${ARCHITECTURE}.spdx.json" \
+grype "sbom:clickhouse-ubi-${ARCHITECTURE}.spdx.json" \
   --fail-on critical --output json > "grype-all-${ARCHITECTURE}.json"
 ```
 

@@ -68,7 +68,7 @@ Run the remaining commands in Bash or Git Bash from the repository root:
 
 ```console
 export PROJECT=clickhouse-qualification
-export IMAGE_REF='ghcr.io/datopsis/clickhouse-server-ubi9@sha256:<64-hex-digest>'
+export IMAGE_REF='ghcr.io/datopsis/clickhouse-ubi@sha256:<64-hex-digest>'
 export EVIDENCE_DIR="openshift-evidence-$(date -u +%Y%m%dT%H%M%SZ)"
 export SECRET_DIR="$(mktemp -d)"
 umask 077

@@ -17,7 +17,7 @@ The separate `CodeQL` workflow performs genuine static analysis of this reposito
 
 ## Where to view current results
 
-The current public score and per-check details are in the [OpenSSF Scorecard viewer](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-server-ubi9). The [OpenSSF Scorecard workflow history](https://github.com/datopsis/clickhouse-server-ubi9/actions/workflows/scorecard.yml) shows each run and exposes its downloadable SARIF artifact for five days. Uploaded findings are also available under the repository's **Security > Code scanning** page to users with the required GitHub access.
+The current public score and per-check details are in the [OpenSSF Scorecard viewer](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-ubi). The [OpenSSF Scorecard workflow history](https://github.com/datopsis/clickhouse-ubi/actions/workflows/scorecard.yml) shows each run and exposes its downloadable SARIF artifact for five days. Uploaded findings are also available under the repository's **Security > Code scanning** page to users with the required GitHub access.
 
 This file documents the repository's policy, controls, initial baseline, and expected score movement. It is not a copy of the live report; use the viewer or the latest workflow run for current results.
 
@@ -96,12 +96,12 @@ export GITHUB_AUTH_TOKEN="$(gh auth token)"
 podman run --rm \
   --env GITHUB_AUTH_TOKEN \
   ghcr.io/ossf/scorecard:v5.5.0@sha256:2ad2ced1cc8d080a589fac211944834c0da3dd82a4d7b0e70a642b6be76987d7 \
-  --repo=github.com/datopsis/clickhouse-server-ubi9 \
+  --repo=github.com/datopsis/clickhouse-ubi \
   --show-details
 unset GITHUB_AUTH_TOKEN
 ```
 
-For machine-readable output, add `--format=json`. The public result is available from the [Scorecard viewer](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-server-ubi9) after the publishing workflow completes.
+For machine-readable output, add `--format=json`. The public result is available from the [Scorecard viewer](https://securityscorecards.dev/viewer/?uri=github.com/datopsis/clickhouse-ubi) after the publishing workflow completes.
 
 ## Review cadence
 

@@ -19,9 +19,9 @@ Podman's default build format is OCI. Use Docker manifest format for local build
 
 ```console
 podman build --format docker --file Containerfile \
-  --tag ghcr.io/datopsis/clickhouse-server-ubi9:test .
+  --tag ghcr.io/datopsis/clickhouse-ubi:test .
 CONTAINER_RUNTIME=podman \
-  IMAGE=ghcr.io/datopsis/clickhouse-server-ubi9:test \
+  IMAGE=ghcr.io/datopsis/clickhouse-ubi:test \
   bash tests/smoke.sh
 ```
 
@@ -38,7 +38,7 @@ podman run --detach --name clickhouse \
   --read-only --tmpfs /tmp:size=256m,mode=1777 \
   --cap-drop ALL --security-opt no-new-privileges \
   --volume clickhouse-data:/var/lib/clickhouse \
-  ghcr.io/datopsis/clickhouse-server-ubi9@sha256:<digest>
+  ghcr.io/datopsis/clickhouse-ubi@sha256:<digest>
 ```
 
 For a Linux bind mount, use `podman unshare chown 101:0 <path>` to express the image identity through the rootless user namespace. Do not assume that container UID `101` must appear as host UID `101`. Podman's `:U` volume option is an alternative, but it recursively changes the host tree and can be slow. Follow [rootless storage and permissions](ROOTLESS.md) for complete named-volume, bind-mount, SELinux, additional-disk, and OpenShift procedures.

@@ -7,7 +7,7 @@ Production readiness is a property of a tested deployment, not an image label. C
 - Decide whether one node is sufficient. A single node has no database-service high availability; use ClickHouse replication and Keeper only after designing failure domains, quorum, inter-server authentication, and recovery.
 - Use a ClickHouse LTS line when long maintenance windows matter, and document the supported UBI/ClickHouse combinations and end-of-support date.
 - Assign owners for the image, database, storage, certificates, backups, vulnerability triage, and incident response.
-- Pin `ghcr.io/datopsis/clickhouse-server-ubi9@sha256:<digest>`. Verify the release signature, SBOM, and provenance before promotion. Never deploy a failed or unsigned candidate tag.
+- Pin `ghcr.io/datopsis/clickhouse-ubi@sha256:<digest>`. Verify the release signature, SBOM, and provenance before promotion. Never deploy a failed or unsigned candidate tag.
 
 ## 2. Prepare identity and secrets
 

@@ -4,15 +4,15 @@ This file records durable links and concise results for first-release gates. Dow
 
 ## Native AMD64 and ARM64 CI — 2026-09-07
 
-- Pull request: [#5](https://github.com/datopsis/clickhouse-server-ubi9/pull/5)
+- Pull request: [#5](https://github.com/datopsis/clickhouse-ubi/pull/5)
 - Head commit: `2e2b07045990c31acbab32c59f53e2979efbedd5`
 - Pull-request merge commit tested by CI: `523ae3754ef8aa81bd8a3f765ec2591dcb8f2182`
-- Workflow: [CI run 34125673268](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268)
+- Workflow: [CI run 34125673268](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268)
 - Aggregate `image` gate: passed after both native jobs completed.
 
 | Evidence | AMD64 | ARM64 |
 | --- | --- | --- |
-| Native job | [image (amd64)](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268/job/101753657567) | [image (arm64)](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268/job/101753657581) |
+| Native job | [image (amd64)](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268/job/101753657567) | [image (arm64)](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268/job/101753657581) |
 | Runner architecture | `x86_64` | `aarch64` |
 | Loaded image architecture | `amd64` | `arm64` |
 | ClickHouse smoke result | 26.8.2.7 passed | 26.8.2.7 passed |
@@ -21,7 +21,7 @@ This file records durable links and concise results for first-release gates. Dow
 | Augmented SPDX/Grype inventory | 37 packages | 37 packages |
 | Blocking Grype result | Passed; all 24 matches were excluded by the fixed High/Critical gate | Passed; all 24 matches were excluded by the fixed High/Critical gate |
 | Full Grype inventory | Retained; 24 unfixed matches require release triage | Retained; 24 unfixed matches require release triage |
-| Security artifact | [AMD64 artifact 10020245728](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268/artifacts/10020245728) | [ARM64 artifact 10020200009](https://github.com/datopsis/clickhouse-server-ubi9/actions/runs/34125673268/artifacts/10020200009) |
+| Security artifact | [AMD64 artifact 10020245728](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268/artifacts/10020245728) | [ARM64 artifact 10020200009](https://github.com/datopsis/clickhouse-ubi/actions/runs/34125673268/artifacts/10020200009) |
 
 This is successful architecture and fixed-vulnerability-gate evidence, not acceptance of the 24 unfixed Grype matches. Those findings remain subject to the documented release triage, ownership, compensating-control, and expiry process.
 

@@ -1,7 +1,7 @@
 # First-release roadmap
 
 This roadmap is the release gate for the first supported
-`clickhouse-server-ubi9` image. Work is organized in small, reviewable packages
+`clickhouse-ubi` image. Work is organized in small, reviewable packages
 whose order follows technical dependencies. Evidence is expected to be
 regenerated as the candidate changes; preserving an older artifact must never
 delay a necessary implementation or security change.