Repository: minio/minio (language: go)

Issue:
Docker image no longer works on older CPU (CPU does not support x86-64-v2)
After upgrading my Docker based minio installation from RELEASE.2023-10-25T06-33-25Z to RELEASE.2023-11-01T01-57-10Z the container refuses to start on [older CPU](https://ark.intel.com/content/www/us/en/ark/products/33927/intel-xeon-processor-e5420-12m-cache-2-50-ghz-1333-mhz-fsb.html).

## Expected Behavior

The minio container starts.

## Current Behavior

The minio container fails to start with the exit code 127 and the following error message: `Fatal glibc error: CPU does not support x86-64-v2`. No other output is provided.

## Steps to Reproduce (for bugs)

1. `docker run -it minio/minio:RELEASE.2023-11-01T01-57-10Z`

## Context

While I understand this is an old CPU, my understanding is that minio itself does not require these CPU instructions. Furthermore, the [binary](https://dl.min.io/server/minio/release/linux-amd64/minio.RELEASE.2023-11-01T01-57-10Z) used in the docker image works on the same machine so it seems the issue comes with the new base image. In fact, when trying to run the new base image I encounter the same error.

```sh
$ docker run registry.access.redhat.com/ubi9/ubi-minimal:9.2
Fatal glibc error: CPU does not support x86-64-v2
```

## Regression

Yes:
- [RELEASE.2023-11-01T01-57-10Z](https://github.com/minio/minio/releases/tag/RELEASE.2023-11-01T01-57-10Z)
- #18313
- #18329

## Your Environment

* Version used (`minio --version`):

```
minio version RELEASE.2023-11-01T01-57-10Z (commit-id=55e713db0a367f6cccee00af49f00c269e6ca619)
Runtime: go1.21.3 linux/amd64
License: GNU AGPLv3 <https://www.gnu.org/licenses/agpl-3.0.html>
Copyright: 2015-2023 MinIO, Inc.
```

* Server setup and configuration: N/A

* Operating System and version (`uname -a`):

`Linux mir 6.1.53-gentoo-x86_64-jmk-selinux #1 SMP PREEMPT_DYNAMIC Thu Sep 14 13:12:26 CEST 2023 x86_64 Intel(R) Xeon(R) CPU E5420 @ 2.50GHz GenuineIntel GNU/Linux`

* Hardware:

```
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 23
model name      : Intel(R) Xeon(R) CPU           E5420  @ 2.50GHz
stepping        : 6
microcode       : 0x60b
cpu MHz         : 2500.082
cache size      : 6144 KB
physical id     : 0
siblings        : 8
core id         : 0
cpu cores       : 8
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 10
wp              : yes
flags           : fpu de tsc msr pae mce cx8 apic sep mca cmov pat clflush acpi mmx fxsr sse sse2 ht syscall nx lm constant_tsc rep_good nopl cpuid tsc_known_freq pni est ssse3 cx16 sse4_1 hypervisor lahf_lm
bugs            : cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs itlb_multihit mmio_unknown
bogomips        : 5000.02
clflush size    : 64
cache_alignment : 64
address sizes   : 38 bits physical, 48 bits virtual
power management:
```


Discussion / hints:
Looks like this issue overall has affected others on ubi-minimal 9:

- https://github.com/keycloak/keycloak/issues/17290
- https://github.com/containers/podman/issues/15456

@kannappanr assuming we want to maintain RHEL9 as our baseline we can add to the docs that the container image uses `ubi-minimal` and may prevent launching on older CPUs. Not sure if there is a workaround by tweaking the container build.

Fix patch:
diff --git a/Dockerfile.hotfix b/Dockerfile.hotfix
index b15b575deebee..a8db05d01cf01 100644
--- a/Dockerfile.hotfix
+++ b/Dockerfile.hotfix
@@ -18,7 +18,8 @@ RUN curl -s -q https://dl.min.io/server/minio/hotfixes/linux-${TARGETARCH}/archi
 
 # Download mc binary and signature file
 RUN curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc -o /go/bin/mc && \
-    curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig
+    curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig && \
+    chmod +x /go/bin/mc
 
 # Verify binary signature using public key "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGavRUN"
 RUN minisign -Vqm /go/bin/minio -x /go/bin/minio.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav && \
diff --git a/Dockerfile.release b/Dockerfile.release
index 05252d3c9d874..c7209875121c6 100644
--- a/Dockerfile.release
+++ b/Dockerfile.release
@@ -18,13 +18,14 @@ RUN curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archiv
 
 # Download mc binary and signature file
 RUN curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc -o /go/bin/mc && \
-    curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig
+    curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig && \
+    chmod +x /go/bin/mc
 
 # Verify binary signature using public key "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGavRUN"
 RUN minisign -Vqm /go/bin/minio -x /go/bin/minio.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav && \
     minisign -Vqm /go/bin/mc -x /go/bin/mc.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav
 
-FROM registry.access.redhat.com/ubi9/ubi-micro:9.2
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest
 
 ARG RELEASE
 
diff --git a/Dockerfile.release.old_cpu b/Dockerfile.release.old_cpu
new file mode 100644
index 0000000000000..49d70725bc45a
--- /dev/null
+++ b/Dockerfile.release.old_cpu
@@ -0,0 +1,61 @@
+FROM golang:1.21-alpine as build
+
+ARG TARGETARCH
+ARG RELEASE
+
+ENV GOPATH /go
+ENV CGO_ENABLED 0
+
+# Install curl and minisign
+RUN apk add -U --no-cache ca-certificates && \
+    apk add -U --no-cache curl && \
+    go install aead.dev/minisign/cmd/minisign@v0.2.0
+
+# Download minio binary and signature file
+RUN curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE} -o /go/bin/minio && \
+    curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.minisig -o /go/bin/minio.minisig && \
+    chmod +x /go/bin/minio
+
+# Download mc binary and signature file
+RUN curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc -o /go/bin/mc && \
+    curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig && \
+    chmod +x /go/bin/mc
+
+# Verify binary signature using public key "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGavRUN"
+RUN minisign -Vqm /go/bin/minio -x /go/bin/minio.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav && \
+    minisign -Vqm /go/bin/mc -x /go/bin/mc.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav
+
+FROM registry.access.redhat.com/ubi8/ubi-micro:latest
+
+ARG RELEASE
+
+LABEL name="MinIO" \
+      vendor="MinIO Inc <dev@min.io>" \
+      maintainer="MinIO Inc <dev@min.io>" \
+      version="${RELEASE}" \
+      release="${RELEASE}" \
+      summary="MinIO is a High Performance Object Storage, API compatible with Amazon S3 cloud storage service." \
+      description="MinIO object storage is fundamentally different. Designed for performance and the S3 API, it is 100% open-source. MinIO is ideal for large, private cloud environments with stringent security requirements and delivers mission-critical availability across a diverse range of workloads."
+
+ENV MINIO_ACCESS_KEY_FILE=access_key \
+    MINIO_SECRET_KEY_FILE=secret_key \
+    MINIO_ROOT_USER_FILE=access_key \
+    MINIO_ROOT_PASSWORD_FILE=secret_key \
+    MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
+    MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
+    MINIO_CONFIG_ENV_FILE=config.env \
+    MC_CONFIG_DIR=/tmp/.mc
+
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=build /go/bin/minio /usr/bin/minio
+COPY --from=build /go/bin/mc /usr/bin/mc
+
+COPY CREDITS /licenses/CREDITS
+COPY LICENSE /licenses/LICENSE
+COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
+
+EXPOSE 9000
+VOLUME ["/data"]
+
+ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
+CMD ["minio"]
diff --git a/docker-buildx.sh b/docker-buildx.sh
index fb93c0f7a5175..2ebc98e6f71c9 100755
--- a/docker-buildx.sh
+++ b/docker-buildx.sh
@@ -15,6 +15,15 @@ docker buildx build --push --no-cache \
 
 docker buildx prune -f
 
+docker buildx build --push --no-cache \
+	--build-arg RELEASE="${release}" \
+	-t "minio/minio:${release}-cpuv1" \
+	-t "quay.io/minio/minio:${release}-cpuv1" \
+	--platform=linux/arm64,linux/amd64,linux/ppc64le,linux/s390x \
+	-f Dockerfile.release.old_cpu .
+
+docker buildx prune -f
+
 docker buildx build --push --no-cache \
 	--build-arg RELEASE="${release}" \
 	-t "minio/minio:${release}.fips" \


Test patch: