Shrink Docker images with scratch runtimes and stripped binaries - #330
Open
mxschmitt wants to merge 4 commits into
Open
Shrink Docker images with scratch runtimes and stripped binaries#330mxschmitt wants to merge 4 commits into
mxschmitt wants to merge 4 commits into
Conversation
Go services ship from scratch with CA certs instead of Alpine, and all Go binaries are built with -trimpath -ldflags=-s -w. Workers skip a second Playwright browser download, drop unused packages, and flatten so those deletions actually leave the image. Frontend serves the Vite build with the static Caddy binary on scratch. Co-authored-by: Max Schmitt <max@schmitt.mx>
Classic docker build on some hosts rejects COPY --chmod. The entrypoint is already executable in git, so a normal COPY is enough. Co-authored-by: Max Schmitt <max@schmitt.mx>
mxschmitt
marked this pull request as ready for review
September 4, 2026 05:34
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Replace the 3.4GB official Playwright Ubuntu image with node:24-bookworm-slim and install only chromium-headless-shell, Firefox, WebKit, and ffmpeg. Headed Chromium and WebKit GTK are unused in this headless playground. Invoke the Playwright test runner from PATH instead of a hard-coded global node_modules path. Co-authored-by: Max Schmitt <max@schmitt.mx>
node:bookworm-slim already has the node user at uid 1000, so a hardcoded pwuser uid fails useradd. Co-authored-by: Max Schmitt <max@schmitt.mx>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Each Dockerfile was reviewed independently for size. Runtime behavior is unchanged: workers still include Chromium, Firefox, and WebKit; Caddy still reverse-proxies
/service/and/file-uploads/.Measured against
ghcr.io/mxschmitt/try-playwright/<name>:latestafter a local rebuild:Go services (
control-service,file-service,log-aggregator)scratchinstead ofalpine:latest+ca-certificates.-trimpath -ldflags="-s -w"./etc/passwd, and/tmpare copied from the Alpine builder.Frontend
npm ci.scratch.Squid
worker-javascript
mcr.microsoft.com/playwright:noble(~3.4GB Ubuntu) withnode:24-bookworm-slim.chromium-headless-shell, Firefox, WebKit, and ffmpeg. Headed Chromium and WebKit GTK are unused in this headless playground.playwright testfrom PATH.Tried slimtoolkit/slim (mint 1.41.8) on the 2.41GB image: Chromium/Firefox/WebKit still launched, but the minified image was larger (2.62GB). The Dockerfile already removed the dead weight, so the tracer had little to delete and flattening plus
--include-shelladded overhead. Not wired into CI.Other workers (python, java, csharp)
Test plan
go test ./...andgo build ./...