mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-09-10 16:08:00 +00:00
e1c2e42d5d
* Dockerfile: bind-mount the wheel instead of COPYing it The runtime stage COPYs the built wheel out of the build stage and the RUN that installs it rm -rf's it again. A RUN cannot remove what an earlier instruction already committed -- it writes a whiteout on top -- so the COPY layer ships in every pull. Measured on ghcr.io/domainaware/parsedmarc:11.0.0: on amd64 layer 4 is 10,713,473 bytes of a 267,653,434-byte image (4.0%); on arm64 10,713,473 of 270,400,579 (3.96%). Layer 5 carries tmp/.wh.dist. The 10.5.0 and 10.0.0 tags carry the same layer. Bind mounts are not committed to layers, so the rm -rf /tmp/dist clause is no longer needed and is removed. A # syntax=docker/dockerfile:1 directive is added so RUN --mount is guaranteed available. * Add --no-cache-dir option to pip install Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Dockerfile: drop the syntax directive; document the size win `RUN --mount=type=bind,from=<stage>` has been stable in BuildKit's built-in Dockerfile frontend since 2020, and the Docker workflow builds through docker/setup-buildx-action + docker/build-push-action, so the mount works without `# syntax=docker/dockerfile:1`. The directive only adds an unpinned Docker Hub round trip before the Dockerfile can be read (`resolve image config for docker-image://docker.io/docker/dockerfile:1`), on a floating tag, and it does not help the legacy non-BuildKit builder, which rejects `RUN --mount` either way. Verified on linux/amd64 with BuildKit (buildx 0.37.0, Docker 29.8.0): building with and without the directive produced five layers totalling 163,757,439 and 163,757,152 compressed bytes respectively -- a 287-byte gzip nondeterminism, otherwise identical. The master baseline built six layers totalling 272,138,724 bytes, whose wheel layer of 10,713,475 bytes reproduces the published 11.0.0 image's 10,713,473 to within two bytes. The comment block is trimmed to state the invariant rather than narrate what the code used to do, and CHANGELOG.md gains an entry: the change is user-visible, and the ~40% reduction is mostly the pip download cache that --no-cache-dir removes, not the wheel layer the PR was opened for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Sean Whalen <44679+seanthegeek@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
50 lines
1.6 KiB
Docker
50 lines
1.6 KiB
Docker
ARG BASE_IMAGE=python:3.13-slim
|
|
ARG USERNAME=parsedmarc
|
|
ARG USER_UID=1000
|
|
ARG USER_GID=$USER_UID
|
|
|
|
## build
|
|
|
|
FROM $BASE_IMAGE AS build
|
|
|
|
WORKDIR /app
|
|
|
|
RUN pip install hatch
|
|
|
|
COPY parsedmarc/ parsedmarc/
|
|
COPY README.md pyproject.toml ./
|
|
|
|
RUN hatch build
|
|
|
|
## image
|
|
|
|
FROM $BASE_IMAGE
|
|
ARG USERNAME
|
|
ARG USER_UID
|
|
ARG USER_GID
|
|
|
|
# The wheel is bind-mounted from the `build` stage rather than copied in with
|
|
# COPY: a COPY commits the wheel to its own layer, which a later `rm` can only
|
|
# write a whiteout over, so the wheel would ship in every pull. A bind mount is
|
|
# never committed to a layer.
|
|
RUN --mount=type=bind,from=build,source=/app/dist,target=/tmp/dist \
|
|
set -ex; \
|
|
groupadd --gid ${USER_GID} ${USERNAME}; \
|
|
useradd --uid ${USER_UID} --gid ${USER_GID} -m ${USERNAME}; \
|
|
# Install the wheel with the [all] and [postgresql] extras so the prebuilt
|
|
# image ships every output and mailbox integration, including the
|
|
# PostgreSQL backend (psycopg). The image deliberately bundles everything:
|
|
# container users see no change across the packaging split that made
|
|
# `pip install parsedmarc` the parsing core plus the base CLI.
|
|
# Resolve the globbed wheel path into a variable first:
|
|
# `*.whl[all,postgresql]` would otherwise be parsed as a shell bracket
|
|
# glob rather than a pip extras spec. psycopg[binary] has prebuilt
|
|
# manylinux wheels for both amd64 and arm64, so this adds no source-build
|
|
# step on either platform.
|
|
whl="$(ls /tmp/dist/*.whl)"; \
|
|
pip install --no-cache-dir "${whl}[all,postgresql]"
|
|
|
|
USER $USERNAME
|
|
|
|
ENTRYPOINT ["parsedmarc"]
|