Strip build-only tooling from the finished image#180
Open
eiriksm wants to merge 6 commits into
Open
Conversation
Split apk installs into a runtime set (CLI tools + libs kept explicit) and a virtual .build-deps group holding compilers, headers and -dev packages needed only to compile the PHP extensions. After all extensions are built, scan the compiled .so files with scanelf to detect the shared libraries they actually link against, install those explicitly, then delete .build-deps. Also run docker-php-source delete to drop the extracted PHP source tree, and dedupe a couple of packages that were listed twice. This follows the same pattern the official PHP Docker images use to keep gcc/make/*-dev packages and the PHP source tree out of the final image. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013HSR8gEQwdQK7LfdNsDRfk
apk add --virtual NAME replaces an existing virtual package's dependency list rather than merging into it. Reusing .build-deps for the mid-script oniguruma-dev/krb5-dev installs redefined it down to just that one package, immediately purging everything from the original .build-deps set (including zlib-dev, pulled in transitively) before gd's configure step needed it - which is why the PHP 8.6 build failed with "Package 'zlib' not found". Install those two as plain packages instead, same as before this cleanup. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013HSR8gEQwdQK7LfdNsDRfk
scanelf only sees libraries linked into a compiled .so's ELF NEEDED list, not ones loaded by path/config at runtime. LDAP's SASL bind mechanisms (libsasl2) and unixODBC's driver manager (used by sqlsrv/pdo_sqlsrv) are loaded that way, so they weren't guaranteed to survive the .build-deps removal. file is a generally useful CLI tool that happened to only be present as a side effect of $PHPIZE_DEPS. Keep all three explicit alongside the other runtime packages. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013HSR8gEQwdQK7LfdNsDRfk
oniguruma-dev (gd, PHP 7.4/8.x) and krb5-dev (imap, PHP 8.4/8.5) were plain apk add calls, made that way to work around .build-deps getting redefined instead of merged when reused mid-script. They lingered in every final image instead of being cleaned up like the rest. Give each its own uniquely-named virtual group and delete all of them in the same final scanelf-based cleanup step - the scanelf scan runs after gd/imap are fully built regardless of which named group provided their build-time headers, so it still correctly re-pins whatever those extensions actually link against. Since .build-deps-gd/-imap are only created on some PHP versions (7.3 skips gd's, most versions skip imap's), check apk info -e before deleting them - `set -eu` would abort the whole build on `apk del` failing for a nonexistent virtual package. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013HSR8gEQwdQK7LfdNsDRfk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.