Shrink Docker image: remove node/bun from runtime, exclude test/dev gems, strip bundle cache/doc/build_info
All checks were successful
Build and Push Docker Image / build-and-push-image (push) Successful in 8m58s

This commit is contained in:
Christoph Haas 2026-05-27 23:14:16 +02:00
parent 7472b737e5
commit a58adf8149

View file

@ -22,20 +22,11 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
apt-get install --no-install-recommends -y \ apt-get install --no-install-recommends -y \
curl libjemalloc2 libvips libpq-dev telnet imagemagick curl libjemalloc2 libvips libpq-dev telnet imagemagick
# "Heist" Node.js and npm from the node_source stage
COPY --from=node_source /usr/local/bin/node /usr/local/bin/node
COPY --from=node_source /usr/local/lib/node_modules /usr/local/lib/node_modules
# Re-link npm and install Bun (Instantly available)
RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
npm install -g bun@${BUN_VERSION}
# Set production environment # Set production environment
ENV RAILS_ENV="production" \ ENV RAILS_ENV="production" \
BUNDLE_DEPLOYMENT="1" \ BUNDLE_DEPLOYMENT="1" \
BUNDLE_PATH="/usr/local/bundle" \ BUNDLE_PATH="/usr/local/bundle" \
BUNDLE_WITHOUT="development" \ BUNDLE_WITHOUT="development:test:doc"
BUNDLE_CACHE=true
# --- Stage 3: Build (Compilation & Assets) --- # --- Stage 3: Build (Compilation & Assets) ---
FROM base AS build FROM base AS build
@ -47,6 +38,14 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
apt-get install --no-install-recommends -y \ apt-get install --no-install-recommends -y \
build-essential git libyaml-dev node-gyp pkg-config python-is-python3 build-essential git libyaml-dev node-gyp pkg-config python-is-python3
# "Heist" Node.js and npm from the node_source stage (build-time only)
COPY --from=node_source /usr/local/bin/node /usr/local/bin/node
COPY --from=node_source /usr/local/lib/node_modules /usr/local/lib/node_modules
# Re-link npm and install Bun (build-time only)
RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
npm install -g bun@${BUN_VERSION}
# 1. Install Gems (Separate COPY for maximum caching) # 1. Install Gems (Separate COPY for maximum caching)
COPY Gemfile Gemfile.lock ./ COPY Gemfile Gemfile.lock ./
RUN --mount=type=cache,target=/usr/local/bundle/cache \ RUN --mount=type=cache,target=/usr/local/bundle/cache \
@ -73,6 +72,9 @@ FROM base
COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}" COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
COPY --from=build /rails /rails COPY --from=build /rails /rails
# Strip unnecessary bundle artifacts (gem cache, docs, build_info)
RUN rm -rf /usr/local/bundle/ruby/*/cache /usr/local/bundle/ruby/*/doc /usr/local/bundle/ruby/*/build_info /usr/local/bundle/ruby/*/plugins
# Security: Run as non-root user # Security: Run as non-root user
RUN groupadd --system --gid 1000 rails && \ RUN groupadd --system --gid 1000 rails && \
useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \ useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \