From a30a16c235490ff37d9ea2ab70669880c6f8d7f3 Mon Sep 17 00:00:00 2001 From: mhoennig Date: Tue, 1 Sep 2026 09:02:45 +0200 Subject: [PATCH] rootfs build: trim what a build environment never reads MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit openjdk-21-jdk-headless instead of the full JDK (drops the X11 and fontconfig library stack; headless AWT still works for tests), message catalogs except en/de removed, man pages, package docs, apt lists and cache cleared after install. Measured on the JDK+Go+Node image: 516 MB -> 351 MB compressed — smaller than the original JDK-only archive (375 MB). Co-Authored-By: Claude Fable 5 --- tools/build-bwrap-rootfs.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/tools/build-bwrap-rootfs.sh b/tools/build-bwrap-rootfs.sh index 264cb3a..b4ed45a 100755 --- a/tools/build-bwrap-rootfs.sh +++ b/tools/build-bwrap-rootfs.sh @@ -69,8 +69,10 @@ command -v docker >/dev/null 2>&1 || die "docker is required to build the rootfs # Rootfs content: Werkator's own build needs a JDK 21 toolchain (Gradle # toolchain resolution), git, ca-certificates for HTTPS, locales for git, and # curl/unzip/xz-utils/zstd for the Gradle wrapper and general build hygiene. +# The headless JDK on purpose: it skips the X11/fontconfig library stack +# (~200 MB) and still supports headless AWT, which is all a CI build needs. # Keep this list additive — project-specific tooling goes on top of this base. -PKGS="openjdk-21-jdk git ca-certificates locales procps file curl unzip xz-utils zstd" +PKGS="openjdk-21-jdk-headless git ca-certificates locales procps file curl unzip xz-utils zstd" [ -z "$pkgs_extra" ] || PKGS="$PKGS $pkgs_extra" # The chroot step runs inside the freshly debootstrapped rootfs; passed into @@ -84,6 +86,12 @@ apt-get clean rm -f /etc/localtime locale-gen en_US.UTF-8 de_DE.UTF-8 >/dev/null 2>&1 || true update-locale LANG=en_US.UTF-8 >/dev/null 2>&1 || true +# Trim what a build environment never reads: translated message catalogs +# except en/de (the generated locales in /usr/lib/locale stay untouched), +# man pages, package docs, and the apt package lists (apt still works after +# an apt-get update, should anyone ever need it inside the sandbox). +find /usr/share/locale -mindepth 1 -maxdepth 1 ! -name "en*" ! -name "de*" -exec rm -rf {} + +rm -rf /usr/share/man/* /usr/share/doc/* /var/lib/apt/lists/* /var/cache/apt ' | base64 -w0)" # The outer script runs inside the Debian container as root. Build noise goes