Add a post-install minimization pass for RPM container images #1113
Add a post-install minimization pass for RPM container images #1113kartikjoshi21 wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR implements the first phase of the "post-build image minimization" work tracked in issue #965, focused on RPM-based container targets. After RPMs are installed into the container rootfs, it runs a new minimization pass that computes the runtime package closure (seeded from the built spec RPMs and DALEC base RPMs), then erases every package outside that closure directly via rpm --root ... -e --noscripts --notriggers --nodeps, keeping the rpmdb authoritative for scanners. Custom base images are intentionally excluded, and the rootfs is squashed afterward so removed files don't linger in image layers.
Changes:
- Added
minimize.gowith an embedded bash minimization script plusminimizeContainer/squashContainerLLB helpers. - Wired minimization and squashing into
BuildContainer, gated on!skipBaseso user-provided base images are not stripped. - Added unit tests asserting the minimize/squash steps run (and are skipped for custom bases) and that the script contains key commands.
Note: The core scriptlet-skipping behavior described in the PR is currently non-functional: the script queries requirement flags with
%{REQUIREFLAGS:depflags}, which only renders</>/=, sois_scriptlet_requirementnever matches. The correct formatter isdeptype. A unit test pins the brokendepflagsstring, so the gap is not caught.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| targets/linux/rpm/distro/minimize.go | New embedded RPM minimization bash script and minimizeContainer/squashContainer LLB helpers; uses wrong depflags formatter, breaking scriptlet detection. |
| targets/linux/rpm/distro/container.go | Invokes minimization and squash in BuildContainer, gated on !skipBase. |
| targets/linux/rpm/distro/container_test.go | Adds unit tests for the minimize/squash steps and a script-content assertion that pins the broken depflags format. |
| fi | ||
|
|
||
| add_requirement_providers "${req}" | ||
| done < <(rpm_root -q --qf '[%{REQUIRENAME}\t%{REQUIREFLAGS:depflags}\n]' "${pkg}" 2>/dev/null || true) |
| `rpm --root "${rootfs}" -e --noscripts --notriggers --nodeps`, | ||
| `ln -s ../../usr/lib/sysimage/rpm "${rootfs}/var/lib/rpm"`, | ||
| `rpm_root -qa >/dev/null`, | ||
| `%{REQUIREFLAGS:depflags}`, |
cpuguy83
left a comment
cpuguy83
left a comment
There was a problem hiding this comment.
For reference, AZL has a minimization script for distroless containers.
I haven't reviewed either this PR or their script yet, just putting it here for reference: https://github.com/microsoft/azurelinux/blob/4.0/base/images/container-base/config.sh
I know we can't take that directly since they do things like remove the rpm db (which we want to keep).
kartikjoshi21
force-pushed
the
kartik/rpm-image-minimization
branch
from
165bcf2 to
5350d7b
Compare
kartikjoshi21
changed the title
Add a post-install minimization pass for RPM container images assembled by DALEC. The pass seeds from the built spec RPMs, DALEC base RPMs, and packages owning essential identity files; follows runtime rpmdb requirements; skips scriptlet-only requirements; and erases packages outside the runtime closure with rpm --root using --noscripts, --notriggers, and --nodeps. Resolve RPM rich dependencies through the installed-package solver on both DNF4 and DNF5. Ordinary requirements remain on the direct rpmdb path, and unresolved requirements fail closed before package removal. This keeps rpmdb authoritative for scanners while removing package-manager and install-time leftovers. Custom base images are intentionally excluded so DALEC does not unexpectedly strip user-provided base image contents. Signed-off-by: Kartik Joshi <kartikjoshi@microsoft.com>
kartikjoshi21
force-pushed
the
kartik/rpm-image-minimization
branch
from
5350d7b to
0271542
Compare
✅ Deploy Preview for dalec ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Thanks for the reference @cpuguy83 . I reviewed the script; its package-closure approach is similar, but the remaining cleanup is specific to AZL’s controlled distroless images. DALEC must preserve the RPM database for scanners and cannot safely remove certificates, locales, licences, documentation, or systemd files by default. |
Add a post-install minimization pass for RPM container images assembled by DALEC. The pass seeds from the built spec RPMs and DALEC base RPMs, follows runtime rpmdb requirements, skips scriptlet-only requirements, and erases packages outside the runtime closure with rpm --root using --noscripts, --notriggers, and --nodeps.
This keeps rpmdb authoritative for scanners while removing package-manager and install-time leftovers. Custom base images are intentionally excluded so DALEC does not unexpectedly strip user-provided base image contents. The final rootfs is squashed after minimization so removed files do not remain in image layers.
This is a conservative RPM-first minimization step toward the image stripping work. It does not implement full file-level runtime reachability analysis or remove unused files from packages that remain installed.
Fixes #965