From 6de1224a65aef2083f77dfffb33448fd6b135759 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Tue, 29 Sep 2026 18:51:17 +0300 Subject: [PATCH] fix(docker): drop unneeded packages from the image stages The final stage installed libssl-dev and libjemalloc-dev, which are build-time packages. The binary needs only the OpenSSL shared library and CA certificates; jemalloc is linked statically. Install just libssl3 and ca-certificates there, skip recommended packages and remove the apt lists to shrink the image and its attack surface. The builder stage does not need libjemalloc-dev either, because tikv-jemalloc-sys builds jemalloc from source. Drop it and use apt-get consistently, as apt is not meant for scripts. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin --- Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 5069554..5298382 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ FROM rust:1.98-bookworm AS builder -RUN apt update && apt-get install -y pkg-config libjemalloc-dev libssl-dev && apt-get clean +RUN apt-get update && apt-get install -y pkg-config libssl-dev && apt-get clean WORKDIR /app @@ -12,7 +12,9 @@ RUN cargo build --release FROM debian:bookworm AS base -RUN apt-get update && apt install -y libssl-dev ca-certificates libjemalloc-dev && apt-get clean +RUN apt-get update \ + && apt-get install --yes --no-install-recommends libssl3 ca-certificates \ + && rm -rf /var/lib/apt/lists/* COPY --from=builder /app/target/release/robotlb /usr/local/bin/ ENV PATH=/usr/local/bin:$PATH