Conversation
The final stage installed libssl-dev and libjemalloc-dev, which are build-time packages. The binary needs only the OpenSSL shared library and CA certificates; jemalloc is linked statically. Install just libssl3 and ca-certificates there, skip recommended packages and remove the apt lists to shrink the image and its attack surface. The builder stage does not need libjemalloc-dev either, because tikv-jemalloc-sys builds jemalloc from source. Drop it and use apt-get consistently, as apt is not meant for scripts. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The image no longer carries build packages it does not need, in either stage.
The final stage installs
libssl3andca-certificatesinstead oflibssl-devandlibjemalloc-dev. Apart from the C runtime the Debian base already has, OpenSSL is the only shared library the binary loads. jemalloc is built into the binary statically, solddshows no jemalloc library. The install also skips recommended packages and removes the apt lists in the same layer.The builder stage drops
libjemalloc-devtoo, becausetikv-jemalloc-syscompiles jemalloc from source. It also usesapt-getconsistently.I built it for linux/arm64 with both changes.
--helpruns, and every library in thelddoutput inside the image resolves.The runtime base is still
debian:bookworm.debian:bookworm-slimwould make the image smaller, but changing the base is out of scope here.Stacked on #52.
Closes #51