Skip to content

perf(image): trim the images, swap in wormhole-rs, add install-dockerd and a MOTD - #22

Open
obeone wants to merge 5 commits into
mainfrom
perf/slim-images
Open

obeone wants to merge 5 commits into
mainfrom
perf/slim-images

Conversation

@obeone

@obeone obeone commented Oct 13, 2026 •

Copy link
Copy Markdown
Owner

The images carried a lot of weight nobody uses in a debug container. This cuts about 290 MB from the full images and 220 MB from slim, and adds two small things on top: an on-demand Docker engine and a message of the day.

Size

Image main this branch
base 1.17 GB 880 MB
docker 1.32 GB 1.03 GB
slim 730 MB 507 MB

Local arm64 builds of main and of this branch.

  • mtr was the GTK build, so it pulled GTK3, the Adwaita icon theme and the whole X/cairo/pango stack into a headless image. mtr-tiny ships the same mtr binary without any of it.
  • The base is now debian:trixie-slim, which already leaves docs, man pages and translations out of its own layer (about 50 MB). The man page guard had to learn its space-separated path-exclude /usr/share/man/* form, otherwise man would have been empty. Pages for bash, coreutils and the rest of the base layer are gone, everything we install keeps them.
  • configs/dpkg-excludes keeps /usr/share/doc and /usr/share/locale out of every package we install. Copyright files and man pages stay.
  • magic-wormhole (Python plus Twisted) is replaced by wormhole-rs from trixie. Same protocol, so it still talks to any other wormhole client, and wormhole keeps working through a link. Only send and receive are guaranteed to look the same: anyone scripting the Python CLI flags may need to adjust. I did not mark it as breaking for that reason, open to discussion.

install-dockerd

The docker variant is CLI only. install-dockerd installs docker-ce and containerd.io from the Docker repo already configured in the image, and --start launches dockerd and waits until it answers. It needs --privileged, obviously.

Message of the day

Every variant now prints a short message when an interactive zsh starts on a terminal: a few example commands, then notes for that variant (host socket, install-dockerd, --privileged). It is printed before the p10k instant prompt, once per docker run or docker exec. An exported guard keeps nested shells, tmux panes and omz reload quiet. -e NETSHOOT_NO_MOTD=1 hides it.

Tests

tests/smoke.sh passes locally on base (110), slim (60) and docker (117). The new checks (no GTK, no docs, wormhole-rs, MOTD shown once, hidden by the env var, absent without a tty, install-dockerd) fail on main, as they should. I did not build podman, nerdctl or containerd locally, and the intermediate commits were not built one by one, so CI gets the last word there.

The GTK build of mtr pulled GTK3, the Adwaita icon theme and the X/cairo/pango stack into a headless image. mtr-tiny ships the same mtr binary without them.

A dpkg path-exclude file keeps /usr/share/doc (except copyright files) and /usr/share/locale out of every package installed after it, in both Dockerfiles. Man pages are still installed.

Measured on arm64: slim 730 MB -> 562 MB from this change alone; base 1.17 GB -> 930 MB together with the wormhole-rs switch. Smoke tests now fail if GTK or package docs come back.
The Python magic-wormhole dragged in Twisted and its dependency tree. wormhole-rs (packaged in trixie) speaks the same protocol, so it interoperates with any other wormhole client. A /usr/local/bin/wormhole link keeps the usual command name for send and receive.
The docker variant ships the CLI only. install-dockerd installs docker-ce and containerd.io from the Docker apt repository already configured in the image; --start launches dockerd and waits for it to answer. Running the engine needs a privileged container.

Shellcheck now covers tools/*.sh instead of listing transfer.sh alone.
Interactive zsh sessions on a terminal print the fragments in /etc/netshoot/motd.d: a few example commands, then notes specific to the variant (how to reach the host engine, install-dockerd, --privileged needs). It prints before the Powerlevel10k instant prompt, once per docker run or docker exec: an exported guard keeps nested shells, tmux panes and omz reload quiet. NETSHOOT_NO_MOTD=1 hides it.
The slim variant of the Debian image leaves docs, man pages and translations out of the base layer. The man page guard now matches its space-separated path-exclude rule too (dpkg accepts both forms), so every package installed on top still gets its pages; only the base layer's own packages (bash, coreutils...) lose theirs.

Measured on arm64: base 930 MB -> 880 MB, docker 1.08 GB -> 1.03 GB, slim 562 MB -> 507 MB.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant