Skip to content

Switch to multi-stage build#70

Merged
roshkhatri merged 2 commits intovalkey-io:mainlinefrom
alaviss:push-owrpptpynskv
May 27, 2025
Merged

Switch to multi-stage build#70
roshkhatri merged 2 commits intovalkey-io:mainlinefrom
alaviss:push-owrpptpynskv

Conversation

@alaviss
Copy link
Contributor

@alaviss alaviss commented May 18, 2025

This simplifies the build pipeline, as no "cleanup" stage has to be done, and allow precise description of the runtime libraries required to use Valkey.

The result reduces Debian (uncompressed) image size from 140MB to 116MB (a 17% improvement), and allow certain tools like wget to be removed from the build by using native ADD instructions. The number of vulnerabilities (as reported by trivy) in the Debian image also drops from 693 to 77, where the main contributors are left-over build dependencies.

The Alpine image did not see any noticeable improvement, however

Closes #57.

@alaviss alaviss force-pushed the push-owrpptpynskv branch from 1572414 to 89ff8a7 Compare May 18, 2025 02:47
This simplifies the build pipeline, as no "cleanup" stage has to be
done, and allow precise description of the runtime libraries required
to use Valkey.

The result reduces Debian (uncompressed) image size from 140MB to 116MB
(a 17% improvement), and allow certain tools like wget to be removed
from the build by using native `ADD` instructions. The number of
vulnerabilities (as reported by trivy) in the Debian image also drops
from 693 to 77, where the main contributors are left-over build
dependencies.

The Alpine image did not see any improvement, however.

Signed-off-by: Leorize <[email protected]>
@alaviss alaviss force-pushed the push-owrpptpynskv branch from 89ff8a7 to 37f2cb0 Compare May 18, 2025 02:48
@roshkhatri
Copy link
Member

Hey @alaviss can you please take a look at the failure?
fatal: /usr/local: '/usr/local' is outside repository at '/home/runner/work/valkey-container/valkey-container'

I see that these workflow do not run on your fork.

* dirCommit now skip `COPY` lines with `--from`, since they are files
  copied from other containers and not the repository.
* `FROM` processors will now only process tagged references that does
  not point to the current image.

Signed-off-by: Leorize <[email protected]>
@alaviss alaviss force-pushed the push-owrpptpynskv branch from dfe75c0 to 0586ccf Compare May 23, 2025 00:12
@alaviss
Copy link
Contributor Author

alaviss commented May 23, 2025

stackbrew-library generator needed some small patches to handle COPY --from and FROM base. I just pushed a fix for this.

@alaviss
Copy link
Contributor Author

alaviss commented May 23, 2025

I don't think musl-libc supports ifunc, so valkey-io/valkey#2099 might have broken unstable on alpine.

@alaviss
Copy link
Contributor Author

alaviss commented May 26, 2025

valkey-io/valkey#2133 has been merged so alpine CI should pass now, please re-run.

@ptsneves
Copy link

Great PR. When can it be merged, and could we have a simpler template generator? It is very hard to read the template generator and this PR

Copy link
Member

@roshkhatri roshkhatri left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work! Thanks! This looks good to me, we can add more comments in the template for what the stages are for, but I am good to merge this now.

Thanks for working on this.

@roshkhatri roshkhatri merged commit 7553770 into valkey-io:mainline May 27, 2025
13 checks passed
@alaviss alaviss deleted the push-owrpptpynskv branch May 27, 2025 21:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Tons of detected vulnerabilities, no multi-stage build

3 participants