opt(orion): reduce image size by optimizing build stages by slow2342 · Pull Request #1954 · gitmono-dev/mega

slow2342 · 2026-02-24T09:40:23Z

优化了orion客户端+scorpio端镜像的体积大小，镜像从 1g 缩减至 321mb 大小

github-actions · 2026-02-24T09:40:41Z

Claude finished @slowslow32's task in 2m 39s —— View job

Code Review

PR: opt(orion): reduce image size by optimizing build stages

Gather context and read changed files
Review Dockerfile changes
Review build scripts and docker-compose changes
Review workflow changes
Post comprehensive feedback

Summary

This PR significantly reduces the orion-client image from ~1GB to 321MB through a well-structured multi-stage Dockerfile rewrite. The optimization approach is sound and the code quality is generally high. A few issues are worth addressing.

Dockerfile (`orion/Dockerfile`) — Excellent overall

What works well:

Multi-stage build (6 stages) correctly discards the Rust toolchain from the final image
cargo-chef usage is idiomatic — dependency layer is cached separately from source code
BuildKit cache mounts (--mount=type=cache) on Cargo registry/git/target prevent re-downloads on each build
Binary stripping (strip) is included before copying into the runtime image
CARGO_PROFILE_RELEASE_DEBUG=0 and CARGO_INCREMENTAL=0 reduce binary size and build artifacts
debian:bookworm-slim as runtime base is the right choice
--no-install-recommends + apt list cleanup are properly applied

Issues:

[Security] No checksum verification for Buck2 binary download — orion/Dockerfile:139-141

curl -fsSL -o buck2.zst "${BUCK2_URL}"; \
zstd -d buck2.zst -o buck2; \
chmod +x buck2; \

The downloaded binary is trusted without verification. If the GitHub release or CDN is compromised, a malicious binary would be silently injected. A SHA256 checksum should be verified post-download. Buck2 releases publish .sha256 files that can be fetched and compared.

Fix this →

[Minor] sharing=locked may bottleneck parallel builds — orion/Dockerfile:92-94

sharing=locked prevents concurrent reads of the Cargo cache. For local development with multiple parallel buildx workers, sharing=shared (read-only parallel, write exclusive) would be more performant. locked is the safest choice but worth noting.

CI Workflow (`orion-client-image-deploy.yml`) — Potential failure

[Bug] Manifest creation references arm64 but matrix only builds amd64 — lines 37, 105-108

The build matrix:

matrix:
  platform: [linux/amd64]

The manifest step:

docker manifest create "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}" \
  "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-amd64" \
  "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-arm64"

If there is no pre-existing arm64 image in ECR from a previous build, docker manifest create will fail. This PR adds 2 lines to the workflow — it's unclear if arm64 was intentionally removed from the matrix. The manifest step should be updated to match the actual set of built architectures, or arm64 should be added back to the matrix.

Fix this →

Note: I cannot modify workflow files directly, but please verify this is intentional before merging.

`docker-compose.yml` — Clean

The removal of 30 lines appears to clean up legacy or duplicate service definitions. The resulting compose file is well-organized with proper profiles (fuse, worker), sensible environment defaults, and network configuration. No issues.

One suggestion: consider adding a healthcheck to the scorpio service since it exposes an HTTP API and other services depend on it being ready.

`entrypoint.sh` — Good

The 3 removed lines simplify the script without losing functionality. The script is well-structured with:

FUSE availability check before starting Scorpio
Graceful cleanup trap for embedded Scorpio process
Environment variable defaults using ${VAR:=default} pattern (correct for envsubst compatibility)
Service readiness wait via nc before starting the worker

No issues.

Build Scripts — Minor duplicated logic

Both build-demo-images-local.sh and build-dev-images-for-local.sh share substantial duplicated code for setup_buildx, check_prerequisites, platform detection, and cache management. This is not a blocker for this PR, but worth noting for future cleanup.

One subtle issue in both scripts — --cache-to is specified twice:

build_args+=(--cache-to "type=local,dest=${cache_dir},mode=max")
build_args+=(--cache-to type=inline)

Multiple --cache-to flags are valid for buildx but type=inline is ineffective when using --load (inline cache cannot be embedded in locally loaded images). This causes a harmless warning but adds noise to build output. Removing --cache-to type=inline when using --load would be cleaner.

`.dockerignore` — Verified

The root .dockerignore correctly excludes target/, moon/, scripts/, tests/, .git/, .github/ etc. This keeps the build context tight and avoids sending unnecessary files to the daemon.

Verdict

The core optimization is well-executed and the size reduction is substantial. The two items worth addressing before merge are:

CI workflow mismatch between the build matrix (amd64 only) and the manifest step (references amd64 + arm64) — this could cause CI failures.
Buck2 download integrity — checksum verification should be added for supply chain safety.

github-actions · 2026-02-24T09:47:23Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

Copilot

Pull request overview

This PR reduces the Orion client + Scorpio container image size by simplifying the Docker build to a slim runtime-only target and improving build caching.

Changes:

Refactors orion/Dockerfile to use cargo-chef, strip binaries, and remove dev/nocache targets and extra runtime packages.
Adds persistent BuildKit cache exports for local build scripts, and GHA cache for the image deploy workflow.
Removes the docker-compose “dev shell” profile/service and related docs snippets.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
scripts/dev/build-dev-images-for-local.sh	Persists local BuildKit cache between rebuilds via `type=local` cache.
scripts/demo/build-demo-images-local.sh	Same local BuildKit cache persistence for demo image builds.
orion/entrypoint.sh	Removes interactive dev example from help text.
orion/docker-compose.yml	Drops `dev` profile/service and its cache volumes.
orion/Dockerfile	Reworks build stages for smaller runtime image (cargo-chef + strip; runtime-only target).
.github/workflows/orion-client-image-deploy.yml	Adds `type=gha` BuildKit caching to speed up CI builds.

Copilot · 2026-02-24T09:51:49Z

+COPY Cargo.toml ./
+COPY Cargo.lock ./
+COPY api-model/Cargo.toml api-model/
+COPY ceres/Cargo.toml ceres/
+COPY common/Cargo.toml common/
+COPY context/Cargo.toml context/
+COPY extensions/rag/chat/Cargo.toml extensions/rag/chat/
+COPY extensions/rag/index/Cargo.toml extensions/rag/index/
+COPY extensions/observatory/Cargo.toml extensions/observatory/
+COPY io-orbit/Cargo.toml io-orbit/
+COPY jupiter/Cargo.toml jupiter/
+COPY jupiter/callisto/Cargo.toml jupiter/callisto/
+COPY mono/Cargo.toml mono/
+COPY orion/Cargo.toml orion/
+COPY orion/audit/Cargo.toml orion/audit/
+COPY orion/td_util/Cargo.toml orion/td_util/
+COPY orion/buck/Cargo.toml orion/buck/
+COPY orion-server/Cargo.toml orion-server/
+COPY orion-server/bellatrix/Cargo.toml orion-server/bellatrix/
+COPY saturn/Cargo.toml saturn/
+COPY scorpio/Cargo.toml scorpio/
+COPY vault/Cargo.toml vault/
+


The planner stage manually enumerates many COPY <crate>/Cargo.toml ... entries. This is easy to get out of sync with workspace members and path dependencies, which will break cargo chef prepare during image builds. Consider adding a brief comment here calling out that new crates/workspace members must be added to this list, or switching to a pattern that copies manifests via .dockerignore to reduce maintenance overhead.

Copilot · 2026-02-24T09:51:49Z

    local image_tag_with_arch="${image_tag}-${arch_suffix}"
    local image_base="${REPOSITORY}"
    local latest_tag="${image_tag%-${GIT_HASH}}-latest"
+    local cache_dir="${REPO_ROOT}/.buildx-cache/${image_name}-${arch_suffix}"


This introduces a persistent BuildKit cache under ${REPO_ROOT}/.buildx-cache/..., but the repo's .gitignore currently doesn't ignore .buildx-cache. That will show up as untracked files and can be accidentally committed; consider either writing caches under a user cache dir (e.g. $XDG_CACHE_HOME/~/.cache) or add .buildx-cache/ to .gitignore.

Suggested change

local cache_dir="${REPO_ROOT}/.buildx-cache/${image_name}-${arch_suffix}"

# Use a user cache directory for BuildKit cache to avoid polluting the repo.

# Prefer XDG_CACHE_HOME, then HOME-based cache, then /tmp as a last resort.

local cache_root

if [ -n "${XDG_CACHE_HOME:-}" ]; then

cache_root="${XDG_CACHE_HOME}"

elif [ -n "${HOME:-}" ]; then

cache_root="${HOME}/.cache"

else

cache_root="/tmp/.cache"

fi

local cache_dir="${cache_root}/mega-buildx/${image_name}-${arch_suffix}"

Copilot · 2026-02-24T09:51:50Z

+    mkdir -p "${cache_dir}"
+    build_args+=(--cache-from "type=local,src=${cache_dir}")
+    build_args+=(--cache-to "type=local,dest=${cache_dir},mode=max")


--cache-to type=local,...,mode=max can grow very large over time and is always enabled now. Consider making this opt-in (env flag), or at least printing the cache path + adding a simple clean target (e.g. --no-cache / --clean-cache) so local disk usage doesn't become a surprise.

Suggested change

mkdir -p "${cache_dir}"

build_args+=(--cache-from "type=local,src=${cache_dir}")

build_args+=(--cache-to "type=local,dest=${cache_dir},mode=max")

# This can grow large over time, so it can be disabled via NO_LOCAL_CACHE=1.

if [ -z "${NO_LOCAL_CACHE:-}" ]; then

mkdir -p "${cache_dir}"

log_info "Using local BuildKit cache at: ${cache_dir}"

build_args+=(--cache-from "type=local,src=${cache_dir}")

build_args+=(--cache-to "type=local,dest=${cache_dir},mode=max")

else

log_info "Local BuildKit cache (type=local,mode=max) disabled via NO_LOCAL_CACHE"

fi

Copilot · 2026-02-24T09:51:50Z

    fi
    local image_tag_with_arch="${image_tag}-${arch_suffix}"
    local image_base="${REGISTRY}/${REGISTRY_ALIAS}/${REPOSITORY}"
+    local cache_dir="${REPO_ROOT}/.buildx-cache/${image_name}-${arch_suffix}"


Same as in the dev build script: this creates ${REPO_ROOT}/.buildx-cache/... but .gitignore doesn't ignore .buildx-cache. Consider moving the cache outside the repo or adding it to .gitignore to avoid noisy git status / accidental commits.

Suggested change

local cache_dir="${REPO_ROOT}/.buildx-cache/${image_name}-${arch_suffix}"

# Use a per-user cache directory outside the repo to avoid polluting git status.

local cache_root="${XDG_CACHE_HOME:-${HOME}/.cache}/mega/buildx"

local cache_dir="${cache_root}/${image_name}-${arch_suffix}"

Copilot · 2026-02-24T09:51:50Z

+    # Persist BuildKit cache across builder recreation to speed up local rebuilds.
+    mkdir -p "${cache_dir}"
+    build_args+=(--cache-from "type=local,src=${cache_dir}")
+    build_args+=(--cache-to "type=local,dest=${cache_dir},mode=max")
+


The local BuildKit cache export (mode=max) is always enabled now and can grow significantly on developer machines. Consider gating this behind an env var / flag or documenting a cleanup path to prevent unexpected disk usage.

Copilot · 2026-02-24T09:51:50Z

-# Copy entire project
-COPY . .
+# Install cargo-chef for dependency layer caching
+RUN cargo install cargo-chef --version 0.1.73


For reproducible Docker builds, prefer cargo install --locked when installing cargo-chef. Without --locked, dependency resolution can change over time and cause non-deterministic or broken image builds.

Suggested change

RUN cargo install cargo-chef --version 0.1.73

RUN cargo install cargo-chef --locked --version 0.1.73

Signed-off-by: MYUU <1405758738@qq.com>

github-actions · 2026-02-24T10:25:49Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

genedna requested review from benjamin-747 and Copilot February 24, 2026 09:43

Copilot started reviewing on behalf of genedna February 24, 2026 09:44 View session

Copilot AI reviewed Feb 24, 2026

View reviewed changes

benjamin-747 requested changes Feb 24, 2026

View reviewed changes

Comment thread orion/Dockerfile Outdated

opt(orion): reduce image size by optimizing build stages

d7dd83b

Signed-off-by: MYUU <1405758738@qq.com>

slow2342 force-pushed the opt/dockerfile-size branch from a6ad678 to d7dd83b Compare February 24, 2026 10:25

benjamin-747 approved these changes Feb 24, 2026

View reviewed changes

benjamin-747 added this pull request to the merge queue Feb 24, 2026

Merged via the queue into gitmono-dev:main with commit 07a9d61 Feb 24, 2026
12 of 13 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

opt(orion): reduce image size by optimizing build stages#1954

opt(orion): reduce image size by optimizing build stages#1954
benjamin-747 merged 1 commit into
gitmono-dev:mainfrom
slow2342:opt/dockerfile-size

slow2342 commented Feb 24, 2026

Uh oh!

github-actions Bot commented Feb 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 24, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

Copilot AI Feb 24, 2026

Uh oh!

Uh oh!

github-actions Bot commented Feb 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-    local cache_dir="${REPO_ROOT}/.buildx-cache/${image_name}-${arch_suffix}"
+    # Use a user cache directory for BuildKit cache to avoid polluting the repo.
+    # Prefer XDG_CACHE_HOME, then HOME-based cache, then /tmp as a last resort.
+    local cache_root
+    if [ -n "${XDG_CACHE_HOME:-}" ]; then
+        cache_root="${XDG_CACHE_HOME}"
+    elif [ -n "${HOME:-}" ]; then
+        cache_root="${HOME}/.cache"
+    else
+        cache_root="/tmp/.cache"
+    fi
+    local cache_dir="${cache_root}/mega-buildx/${image_name}-${arch_suffix}"

-    local cache_dir="${REPO_ROOT}/.buildx-cache/${image_name}-${arch_suffix}"
+    # Use a per-user cache directory outside the repo to avoid polluting git status.
+    local cache_root="${XDG_CACHE_HOME:-${HOME}/.cache}/mega/buildx"
+    local cache_dir="${cache_root}/${image_name}-${arch_suffix}"

	RUN cargo install cargo-chef --version 0.1.73
	RUN cargo install cargo-chef --locked --version 0.1.73

Uh oh!

Conversation

slow2342 commented Feb 24, 2026

Uh oh!

github-actions Bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review

Summary

Dockerfile (orion/Dockerfile) — Excellent overall

CI Workflow (orion-client-image-deploy.yml) — Potential failure

docker-compose.yml — Clean

entrypoint.sh — Good

Build Scripts — Minor duplicated logic

.dockerignore — Verified

Verdict

Uh oh!

github-actions Bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Feb 24, 2026 •

edited

Loading

Dockerfile (`orion/Dockerfile`) — Excellent overall

CI Workflow (`orion-client-image-deploy.yml`) — Potential failure

`docker-compose.yml` — Clean

`entrypoint.sh` — Good

`.dockerignore` — Verified

github-actions Bot commented Feb 24, 2026 •

edited

Loading

github-actions Bot commented Feb 24, 2026 •

edited

Loading