Trimming the size of the Docker image

[jamietanna]

I was looking into some container scans against this image - raised by a vendor tool we use to scan all our images - and noticed that there were several findings for things like Go and Java, which I was surprised as I wouldn't expect Java to be installed in the image.

Digging into whitesource/renovate:2.6.0, I noticed that:

du -sh /opt/buildpack/*
12K	/opt/buildpack/env.d
168K	/opt/buildpack/ssl
2.4G	/opt/buildpack/tools
64K	/opt/buildpack/versions
du -sh /opt/buildpack/tools/*
2.7M	/opt/buildpack/tools/composer
493M	/opt/buildpack/tools/dotnet
12M	/opt/buildpack/tools/elixir
160M	/opt/buildpack/tools/erlang
477M	/opt/buildpack/tools/golang
129M	/opt/buildpack/tools/gradle
43M	/opt/buildpack/tools/helm
308M	/opt/buildpack/tools/java
150M	/opt/buildpack/tools/lerna
104M	/opt/buildpack/tools/node
17M	/opt/buildpack/tools/npm
147M	/opt/buildpack/tools/php
15M	/opt/buildpack/tools/pnpm
315M	/opt/buildpack/tools/python
5.2M	/opt/buildpack/tools/yarn

It may be possible to trim this considerably to remove the CVEs raised by this, as well as drastically trim the size of the built image, if we were to remove some of the tools in there that we don't use?

[jamietanna]

Interestingly though, these changes:

FROM whitesource/renovate:2.6.0 as renovate

USER root

# https://github.com/mend/renovate-on-prem/issues/243
RUN rm -rf /opt/buildpack/tools/{composer,dotnet,elixir,erlang,golang,gradle,helm,java,lerna,npm,php,pnpm,python,yarn} && rm -rf /opt/buildpack/versions/{composer,dotnet,elixir,erlang,golang,gradle,helm,java,lerna,npm,php,pnpm,python,yarn}

USER ubuntu

# ...

Don't appear to make any difference to the image size 🤔

[jamietanna]

Oh actually, these are probably needed to i.e. bundle install after updating dependencies right? So removing these would break Renovate making changes? 😁

[rarkins]

The reason you're not seeing space savings is due to the way Docker layers work.

But yes if you remove those tools then you're possibly breaking yourself if you need them

[rarkins]

Please prefer discussions in future unless you have a bug