shrink image about golang

[proppy]

I think cgo might require gcc, so I'm not sure if it's "safe" to remove in all cases.

[cpuguy83]

Aah, you are right.

If we leave libc6 and gcc in there image shrinks to 406.7MB
Not a huge gain... but also nice to be explicit about the build-deps instead of installing build-essential.

[yosifkit]

That sounds good to me.

I got it to 385MB by adding rm -r /var/lib/apt/lists/* after the apt-get install lines. I can have a PR shortly, if you would like. The only drawback I see is that all the golang versions had a common layer and now will all be different, but your proposed changes are what we have been doing in the other images.

FROM debian:wheezy

ENV GOLANG_VERSION 1.3.1
# Go building deps and SCMs for "go get"
RUN apt-get update && apt-get install -y \
        ca-certificates curl gcc libc6-dev \
        bzr git mercurial \
        --no-install-recommends \
    && rm -rf /var/lib/apt/lists/* \
    && curl -sSL http://golang.org/dl/go$GOLANG_VERSION.src.tar.gz \
        | tar -v -C /usr/src -xz \
    && cd /usr/src/go/src && ./make.bash --no-clean 2>&1 \
    && apt-get purge -y curl \
    && apt-get autoremove -y

ENV PATH /usr/src/go/bin:$PATH

RUN mkdir -p /go/src
ENV GOPATH /go
ENV PATH /go/bin:$PATH
WORKDIR /go

[proppy]

Maybe instead of combining all the command with &&, we could have a script in the context that does the same w/ set -e.

[tianon]

What benefit would that provide except less predictable cache behavior and
now two places to look to see how the image was built?

Also, what affect (if any) does this refactor have on our cross builds?

[proppy]

@tianon how does that make it less predictable?

My understanding is that:
In one case, if the .sh change the layer is invalidated.
In the other, if the line change the layer is invalidated.

[tianon]

It's less predictable because "mtime" is included in the "if the .sh is
changed" calculation, which is changed on every fresh "git clone" (which is
exactly how these images are built). It's predictable for individual users
on their own systems, but not for the official image build system, is what
I meant.

[yosifkit]

I am testing the cross builds and have one more adjustment (for packages that are not uninstalled).

FROM debian:wheezy

RUN apt-get update && apt-get install -y \
        ca-certificates gcc libc6-dev \
        bzr git mercurial \
        --no-install-recommends \
    && rm -rf /var/lib/apt/lists/*

ENV GOLANG_VERSION 1.3.1

# Go building deps and SCMs for "go get"
RUN apt-get update && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/* \
    && curl -sSL http://golang.org/dl/go$GOLANG_VERSION.src.tar.gz \
        | tar -v -C /usr/src -xz \
    && cd /usr/src/go/src && ./make.bash --no-clean 2>&1 \
    && apt-get purge -y curl \
    && apt-get autoremove -y

ENV PATH /usr/src/go/bin:$PATH

RUN mkdir -p /go/src
ENV GOPATH /go
ENV PATH /go/bin:$PATH
WORKDIR /go

[proppy]

@tianon: got it, and that's not true for the Dockerfile where each line is actually considered even if mtime has changed.

I didn't realize that the "official build system" was leveraging caching, I just assumed it was using --no-cache.

[proppy]

@yosifkit I'm confused why there is 2x apt-get update. Can't we have one big shell expression and remove /var/lib/apt/lists at the end?

[yosifkit]

They are in separate RUN's because I was trying to optimize the docker cache so that all the go versions can depend on the same layer (since we were not removing any of those packages).

[proppy]

@yosifkit oh, make sense sorry for the noise, but this does come at the expense of 1 additional apt-get update, right?

Maybe the size of curl is negligible enough that you could leave it in the image and get read of the apt- stuff in the second case?

[yosifkit]

Yes there is one additional apt-get update. Even though the size or curl itself is minimal (~1MB), by cleaning up build dependencies after install we will set precedent for further official images to keep them as tidy as possible.

Semi-unrelated question: is ca-certificates necessary, or can we clean it up with curl?

[tianon]

Go does use it if your app hits SSL, so I think we need to keep that one.

[yosifkit]

I have a PR for the changes discussed here. I decided to leave the curl since it made a smaller amount of changes.

[tianon]

Yeah, I think that's fair, especially at only 1MB (and since curl is so
useful).