mirror of
https://github.com/suitenumerique/messages.git
synced 2026-08-17 21:25:41 +02:00
Sylvain Zimmerandjbpenrath
f4d235825f
Notably, we try to reduce disk usage by standardizind on common base Docker images. We also improve node_modules by reducing duplicate dependencies and install speed.
42 lines
2.0 KiB
Bash
42 lines
2.0 KiB
Bash
#!/bin/sh
|
|
# Trim the uv-managed runtime for production images: remove tooling the app never
|
|
# uses at runtime — pip (scripts AND package), idle, pydoc, C headers,
|
|
# pkg-config, tkinter/tcl, tests — plus the uv/uvx build binaries themselves.
|
|
# We build and manage everything with uv, so none of this is needed to *run*.
|
|
#
|
|
# Baked into the shared python-uv image and invoked as `RUN strip-python` by the
|
|
# backend/pymta distroless builds and the slim runtime-prod stages, so the list
|
|
# lives in exactly one place.
|
|
#
|
|
# NOTE: this shrinks the running-container attack surface (files are whited-out),
|
|
# but it only shrinks image *size* for the distroless targets, which COPY an
|
|
# already-trimmed tree into a clean base. For the slim runtime-prod images the
|
|
# Python/uv sit in an inherited layer, so the bytes remain in the pull.
|
|
#
|
|
# Version-agnostic: the interpreter path comes from `uv python find`; stdlib
|
|
# paths glob python3.*. uv/uvx are removed LAST, after uv is used above.
|
|
set -eu
|
|
|
|
PYDIR=$(dirname "$(dirname "$(uv python find)")")
|
|
|
|
# shellcheck disable=SC2086 # deliberate globbing of the paths below
|
|
rm -rf \
|
|
"$PYDIR"/bin/idle* "$PYDIR"/bin/pip* "$PYDIR"/bin/pydoc* "$PYDIR"/bin/*-config \
|
|
"$PYDIR"/include "$PYDIR"/share \
|
|
"$PYDIR"/lib/pkgconfig "$PYDIR"/lib/itcl* "$PYDIR"/lib/libtcl* \
|
|
"$PYDIR"/lib/tcl* "$PYDIR"/lib/tk* "$PYDIR"/lib/thread* \
|
|
"$PYDIR"/lib/python3.*/idlelib \
|
|
"$PYDIR"/lib/python3.*/ensurepip \
|
|
"$PYDIR"/lib/python3.*/tkinter \
|
|
"$PYDIR"/lib/python3.*/turtledemo \
|
|
"$PYDIR"/lib/python3.*/lib-dynload/_tkinter* \
|
|
"$PYDIR"/lib/python3.*/lib-dynload/_ctypes_test* \
|
|
"$PYDIR"/lib/python3.*/site-packages/pip "$PYDIR"/lib/python3.*/site-packages/pip-*.dist-info \
|
|
"${UV_PYTHON_INSTALL_DIR:-/opt/python}"/.gitignore \
|
|
"${UV_PYTHON_INSTALL_DIR:-/opt/python}"/.lock \
|
|
"${UV_PYTHON_INSTALL_DIR:-/opt/python}"/.temp
|
|
|
|
# uv/uvx are build tools — never needed to run the app. Remove after the
|
|
# `uv python find` above.
|
|
rm -f /bin/uv /bin/uvx
|