Repository navigation
perf: shrink app image and speed Docker CI/CD - #22
Merged
maryammouzarani2024 merged 8 commits intoAug 27, 2026
Merged
Conversation
CMD started `ollama serve` inside the Flask image, but that image never shipped an Ollama binary. Compose already runs `ollama/ollama:latest` as a second service, and the leftover command failed or no-oped at startup. Dockerfile.ollama was a wrapper Compose never referenced.
pip keeps wheels under /root/.cache/pip in the same layer (~3 GB here). apt's recommended packages are not needed at runtime. --no-cache-dir and --no-install-recommends keep those files out of what we publish.
sentence-transformers depends on torch. The default PyPI wheel is CUDA plus nvidia-* packages, even though RAG labs only embed on CPU (MiniLM, 384-d). Installing the CPU index first stops the CUDA stack from landing in the image. requirements.txt stays unpinned so host/macOS venvs are unchanged.
Current Python deps install from wheels, so gcc was only adding ~300 MB to the final image. libzbar0 stays: it is the runtime library for pyzbar (QR labs). No multi-stage build; the compiler is simply not installed.
COPY . . was shipping tests/, docs/, deploy/, scripts/, and .github/ into the published image. .dockerignore excludes them. make test-docker bind-mounts tests/ so image pytest still runs without baking that tree in.
Hosted runners start empty, so every GHCR push rebuilt every layer from scratch. Buildx plus type=gha reuses layers across runs. Tags stay ghcr.io/owasp/pwnzzai:latest and the full git sha.
ci-docker.yml ran a second pytest (3.11, weaker install) on every push, while test.yml already runs the full suite (3.12 + requirements-test.txt). Reuse that workflow, cache pip, cancel overlapping runs, and ignore docs/** / *.md so documentation PRs do not rebuild or push images.
lint still used older checkout/setup-python while test and docker jobs did not. Bump to checkout@v4 and setup-python@v5, and apply the same docs-only paths-ignore and concurrency so lint does not run twice or on markdown-only changes.
Contributor
Author
Local sanity (linux/arm64, image
|
maryammouzarani2024
requested changes
Aug 27, 2026
maryammouzarani2024
left a comment
maryammouzarani2024
left a comment
Collaborator
There was a problem hiding this comment.
It is not a good idea to hardcode the library version.
rgbuilds
force-pushed
the
docker-ci-optimizations
branch
from
August 27, 2026 06:54
dc7a247 to
7e7c95b
Compare
Contributor
Author
@maryammouzarani2024 Thanks for the feedback. I have removed the commit which hardcoded the version and updated the same PR. |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ollama/ollama:latest); unusedDockerfile.ollamais removed.requirements.txtsosentence-transformersdoes not pull the CUDA wheel.requirements.txtstays unpinned so host/macOS venvs are unchanged.build-essential(wheels cover the Python deps). Keeplibzbar0for QR labs..dockerignorekeeps tests/docs/CI out of the published image;make test-dockerbind-mounts tests.test.yml(3.12 + test extras); docs-only changes skip test/lint/image jobs; lint Actions match test (checkout@v4,setup-python@v5).Lab Python is unchanged.
Image size (linux/arm64 local build)
docker imagesdocker inspect.Sizeghcr.io/owasp/pwnzzai:latestInstalled torch is CPU-only (
2.13.0+cpuon this machine; unpinned). MiniLM encode still returns(1, 384).Test plan
make test-docker(pytest in the rebuilt image): 202 passed, 65 skippedCMDis Flask only; noollama/gcc/tests/in the imageci-docker.ymlcallstest.ymlthen Buildx push/,/basics,/login, Ollama status, QR decode, RAG query,docker-smoke-test.shOption 1 + 2latestpull on linux/amd64 anddocker compose up(/and/check-ollama-status)