-
Notifications
You must be signed in to change notification settings - Fork 336
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adjust scanelf to properly remove "ruby-libs" in the "2.4-alpine3.6" image #161
Conversation
…image This saves ~11MB of final image size (~79.4MB down to ~68.5MB).
Other images which could benefit from a similar change:
|
- `bash`: `scanelf` improvements (tianon/docker-bash#8) - `docker`: update `Dockerfile` with `arm32v6` and `arm64v8` (still blocked on gliderlabs/docker-alpine#304) - `drupal`: `scanelf` improvements (docker-library/drupal#93) - `ghost`: 1.9.0 - `haproxy`: `scanelf` improvements (docker-library/haproxy#45) - `httpd`: `scanelf` improvements (docker-library/httpd#74) - `irssi`: `scanelf` improvements (jessfraz/irssi#18) - `memcached`: `scanelf` improvements (docker-library/memcached#27) - `php`: `scanelf` improvements (docker-library/php#500), `libressl` in Alpine 3.6+/PHP 7.2+ (docker-library/php#499) - `postgres`: `scanelf` improvements (docker-library/postgres#344) - `rabbitmq`: update cookie file permissions (docker-library/rabbitmq#193), consume upstream artifacts from GitHub (docker-library/rabbitmq#195), set `total_memory_available_override_value` (docker-library/rabbitmq#196) - `ruby`: `scanelf` improvements (docker-library/ruby#161) - `tomcat`: `scanelf` improvements (docker-library/tomcat#85) - `wordpress`: `scanelf` improvements (docker-library/wordpress#240)
| sort -u \ | ||
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
May I know what's the purpose of the spaces surrounding $1
?
system("[ -e /usr/local/lib/" $1 " ]")
Anyway, shouldn't we do
system("[ -e /usr/local/lib/**/" $1 " ]")
to match libraries in subdirectories too?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
May I know what's the purpose of the spaces surrounding
$1
?
Just syntax -- makes it more readable. awk
will concatenate the strings directly anyhow.
to match libraries in subdirectories too?
No, because [ -e /usr/local/lib/**/libxyz.so ]
doesn't work properly in a shell (it could partially work if we enabled globstar
in the subshell that awk
spawns, but that's a bit heavy, and will still break completely if there's more than one result). If we needed that sort of check, we'd have to make that string a lot more complex.
In the case of Ruby, we know it's only installing .so
files directly in /usr/local/lib
, so those are all we need to filter out (so that we don't accidentally keep packages that provide .so
files with the same basename, since apk
's .so
dependencies work based on the file basenames).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm asking because it's relevant for docker-library/official-images#4404, specifically for Varnish 4.1 😄
I did not enable the globstar
option but it seems to work? (For both /usr/local/lib/*.so
in the case of Varnish 6.0 and /usr/local/lib/varnish/*.so
in the case of Varnish 4.1)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Huh, that's strange -- I would imagine that without globstar
enabled it's acting just like a single glob, but then it wouldn't match /usr/local/lib/xxx.so
, so that's interesting. I wonder what adding set -x; [ ...
ala system("set -x; [ -e /usr/local/lib/" $1 " ]")
would show (since that should show the exact path that's getting matched).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hmm... Can't say I understand what's going on:
+ scanelf --needed --nobanner+ --format '%n#p' --recursivetr /usr/local ,
'\n'
+ sort -u
+ awk 'system("set -x; [ -e /usr/local/lib/**/" $1 " ]") == 0 { next } { print "so:" $1 }'
+ '[' -e '/usr/local/lib/**/libc.musl-x86_64.so.1' ]
+ '[' -e '/usr/local/lib/**/libedit.so.0' ]
+ '[' -e '/usr/local/lib/**/libexecinfo.so.1' ]
+ '[' -e '/usr/local/lib/**/libncursesw.so.6' ]
+ '[' -e '/usr/local/lib/**/libpcre.so.1' ]
+ '[' -e /usr/local/lib/varnish/libvarnish.so ]
+ '[' -e '/usr/local/lib/**/libvarnishapi.so.1' ]
+ '[' -e /usr/local/lib/varnish/libvcc.so ]
+ '[' -e /usr/local/lib/varnish/libvgz.so ]
+ runDeps='so:libc.musl-x86_64.so.1
so:libedit.so.0
so:libexecinfo.so.1
so:libncursesw.so.6
so:libpcre.so.1
so:libvarnishapi.so.1'
This saves ~11MB of final image size (~79.4MB down to ~68.5MB).
Fixes #131