fix(docker): improve Dockerfile for cache efficiency and image size - #537
fix(docker): improve Dockerfile for cache efficiency and image size#537Patrick-Ehimen wants to merge 2 commits into
Conversation
Cache mounts are not persisted by `cache-to: type=gha` (it stores layers only), so on ephemeral runners every CI build recompiled all dependencies. Remove the mounts so cooked deps land in a cacheable image layer, and declare the per-commit ARG/ENV after the cook step so they no longer invalidate it. Slim the per-commit layer with `rm -rf target`, cook only the pluto-cli dep closure to match the final build's feature unification, and refresh the base image pins.
![emlautarom1-agent[bot]](https://avatars.githubusercontent.com/u/31224949?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approving — with amendments pushed on top (99ae71e3).
The PR's structure (cargo-chef + distroless + digest pins) was right, but two issues prevented the CI dependency cache from ever hitting:
-
--mount=type=cachedoesn't compose withcache-to: type=gha— the gha backend persists image layers, not BuildKit mount contents, and CI runners are ephemeral. So all ~770 deps recompiled on every run. Fixed by dropping the mounts socargo chef cookwrites into a real, gha-cacheable layer. -
Per-commit
ARG/ENV(GIT_COMMIT_HASH_SHORT,SOURCE_DATE_EPOCH) were declared above the cook step, so even with layer caching working, their new values would invalidate the dependency layer on every commit. Moved below the cook.
Smaller amendments: rm -rf /build/target after the final build keeps the per-commit exported layer at ~binary size instead of shipping the whole target dir to the gha cache under mode=max; cook --package pluto-cli cooks only the CLI's dep closure, with feature unification matching the final build; base-image digests re-pinned to today's slim-bookworm / cc-debian13:latest (both verified multi-arch amd64+arm64).
No workflow changes needed. Expectations: the first run on main stays cold (~10 min, same as today); after that, source-only merges reuse the dep layer, while Cargo.lock-touching merges still re-cook (bounded at today's baseline).
emlautarom1
left a comment
emlautarom1
left a comment
There was a problem hiding this comment.
Guided the agent to validate and improve the PR. LGTM.
2 participants
Closes #351
Changes
cargo-chefplanner/builder stages to cache dependency compilation separately from sourcerust:slim-bookworm,distroless/cc-debian13)rust-toolchain.tomlas single source of truth for the Rust toolchain versionprotobuf-compilerto exact version and clean apt lists to reduce image size--no-install-recommendsto avoid pulling unnecessary packages