Guided multi-stage builds

[jlorieau]

Thanks for sharing this great tool!

I discovered and played around with docker-slim today, so my following suggestion may already be available. For my workflow, and possibly the workflows of others, it would be helpful if the xray subcommand could be used to guide multi-staged docker builds. The json output is quite impressive, but I've found it a bit difficult to parse into a series of COPY --from=base commands that I could use to permanently slim down images. I realize that docker-slim build circumvents this need, but it would nevertheless be helpful to use this tool to permanently slim down images through multi-staged builds.

[kcq]

@jlorieau what kind of information from the xray command would you like to use? Do you mind sharing a multi-stage build you'd like to have?

[jlorieau]

Thanks @kcq for the response.

Here is an example multi-stage build that can build production and development images.

FROM python:3-slim as builder-base

# Setup environment variables
ENV PYTHONUNBUFFERED=1 \
    # pip
    PIP_NO_CACHE_DIR=off \
    PIP_DISABLE_PIP_VERSION_CHECK=on \
    PIP_DEFAULT_TIMEOUT=100 \
    # poetry
    POETRY_VERSION=1.1.0 \
    POETRY_HOME="/opt/poetry/" \
    POETRY_VIRTUALENVS_IN_PROJECT=true \
    POETRY_NO_INTERACTION=1 \
    # pip package location
    PYSETUP_PATH="/opt/pysetup" \
    VENV_PATH="/opt/pysetup/.venv"

ENV PATH="$POETRY_HOME/bin:$VENV_PATH/bin:$PATH"

# Install OS dependencies
RUN apt-get update -y \
    && apt-get install --no-install-recommends -y \
        # deps for installing poetry
        curl \
        # deps for building python deps
        build-essential \
        git-core \
        gosu

FROM builder-base as poetry-base

# Install poetry
RUN curl -sSL https://raw.githubusercontent.com/sdispater/poetry/master/get-poetry.py | python

# Copy required poetry files
WORKDIR $PYSETUP_PATH
COPY poetry.lock pyproject.toml ./

# Install dependencies - uses $POETRY_VIRTUALENVS_IN_PROJECT
RUN poetry install --no-dev

FROM poetry-base as poetry-dev

RUN poetry install

# `development` image
FROM builder-base as development
WORKDIR $PYSETUP_PATH

# Copy installed package (development version), not poetry
COPY --from=poetry-dev $PYSETUP_PATH $PYSETUP_PATH

# mountpoint for app
WORKDIR /app/src

# `production` image used for runtime and clean poetry
FROM builder-base as production

# Copy installed package, not poetry
COPY --from=poetry-base $PYSETUP_PATH $PYSETUP_PATH

COPY . /app/src
WORKDIR /app/src

The types of lines I'm interested in getting from Xray, specifically, are:

# Copy installed package, not poetry
COPY --from=poetry-base /opt/pysetup /opt/pysetup

(I substituted the $PYSETUP_PATH environment variable for clarity.)

In this case, my final image is about 400MB smaller because I don't include the poetry installer.

If I understand the xray function properly, I should be able to convert the xray output into a list of files to copy over from builder-base. For example,

FROM python:3-slim as builder-base
....

FROM python:3-slim as production

COPY --from=builder-base /bin/bash /bin/bash
COPY --from=builder-base /bin/echo /bin/echo
...
COPY --from=builder-base /usr/local/bin/python3 /usr/local/bin/python3
COPY --from=builder-base /usr/local/bin/python3.9 /usr/local/bin/python3.9
...

I would image that this approach would create thousands of COPY --from= lines, which wouldn't be helpful. This type of information would nevertheless be helpful in manually identifying core directories and files to include in the final image:

COPY --from=builder-base /bin /bin
COPY --from=builder-base /usr/local/bin /usr/local/bin

A possible enhancement to xray might report a combination of directories and files to COPY --from=, by including directories in which, say, more than 5 files are copied over while otherwise including individual files:

# 10 files under /bin included
COPY --from=builder-base /bin /bin 
# 8 files under /usr/local/bin included
COPY --from=builder-base /usr/local/bin /usr/local/bin

# 1 file from /etc included, so the file itself is copied over
COPY --from=builder-base /etc/hosts /etc/hosts

I realize that this approach might include additional files that are not needed, but the user could always run docker-slim build again to get the minimal image. Additionally, a Dockerfile inspector that modified an existing Dockerfile with multi-stage build COPY --from= instructions would be helpful--at least to novices like me.

Hopefully my understanding and description of your software isn't too obtuse. I was trained as a physical chemist ;)

Thanks!

[kcq]

Thank you @jlorieau for the details (and a lot of them)!

Sounds like you are looking for help addressing one of the main pain points with the multistage builds where you have to know what to copy. The multistage hello world examples alway look so simple and they assume you know exactly what needs to be copied :-)

If I understand you correctly you want to copy the new files from the builder-base intermediate image to your production image. One of the gotchas there is the apt-get update command, which might add a bit of extra stuff. If the apt-get update is in a separate RUN instruction then it'll be possible to select a subset of layers from builder-base.

There's an ability to select/inspect a subset of layers (using the --layer flag), but for this use case it'll need to be enhanced a little bit.

Also need to add extra output formatting flags, so you can get a list of file paths without any extra metadata printed to the screen.

It should be possible to generate a "compressed" list of paths that would be less verbose. For example, if a new directory is created and a bunch of files copied there it should be possible to have only one path (for that new directory). Need to think about a good place to do it. Alternatively it can be done as a post-processing step based on the full command json report.

An ability to rewrite or generate new Dockerfiles is on the todo list too.