From b679e25bd3fd25cfd617d274a92ee4ee13baaa27 Mon Sep 17 00:00:00 2001
From: ai-anant <ant2010in@gmail.com>
Date: Sun, 2 Aug 2026 14:16:49 +0530
Subject: [PATCH] perf: keep build caches out of the image (uv/go/cargo/apt)

The image accumulated build-time caches that serve no runtime purpose:
- uv download cache (semgrep/ast-grep wheels) in /root/.cache/uv
- go build+module cache after compiling gosec (~/.cache, ~/go)
- cargo registry+git+target after compiling cargo-audit (~1GB)
- apt archives and stale gem cache

Move uv downloads to BuildKit cache mounts (--mount=type=cache) so they
live in the builder cache, not the image; point GOCACHE/GOPATH and
CARGO_TARGET_DIR at /tmp and remove them after install; apt-get clean +
drop apt archives and gem cache.

Refs #10
---
 templates/devcontainer/Dockerfile.tmpl | 27 +++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/templates/devcontainer/Dockerfile.tmpl b/templates/devcontainer/Dockerfile.tmpl
index bae5a6f..328c3e8 100644
--- a/templates/devcontainer/Dockerfile.tmpl
+++ b/templates/devcontainer/Dockerfile.tmpl
@@ -41,7 +41,8 @@ RUN apt-get update \
     && apt-get update \
     && apt-get install -y --no-install-recommends nodejs \
     && ln -sf /usr/bin/fdfind /usr/local/bin/fd \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
 
 RUN ARCH=$(dpkg --print-architecture) \
     && curl -fsSL "https://github.com/dandavison/delta/releases/download/${GIT_DELTA_VERSION}/git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb" -o /tmp/git-delta.deb \
@@ -53,7 +54,8 @@ ENV UV_PYTHON_INSTALL_DIR=/opt/uv/python \
     UV_TOOL_DIR=/opt/uv/tools \
     UV_TOOL_BIN_DIR=/usr/local/bin \
     UV_LINK_MODE=copy
-RUN uv python install 3.13 \
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv python install 3.13 \
     && ln -sf "$(uv python find 3.13)" /usr/local/bin/python3 \
     && ln -sf /usr/local/bin/python3 /usr/local/bin/python \
     && uv tool install ast-grep-cli
@@ -101,7 +103,8 @@ RUN ARCH_RAW="$(dpkg --print-architecture)" \
 
 # Always-on security tooling: semgrep (SAST), gitleaks + trufflehog (secrets).
 # SCA is handled by vet/pmg above; this layer covers code-pattern and secret scans.
-RUN uv tool install semgrep \
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv tool install semgrep \
     && curl -fsSL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
        | sh -s -- -b /usr/local/bin
 
@@ -226,7 +229,8 @@ RUN if [ -n "$AIDC_TOOLCHAINS" ]; then \
           go) \
             sudo apt-get update && \
             sudo apt-get install -y --no-install-recommends golang-go && \
-            GOBIN=/home/vscode/.local/bin go install github.com/securego/gosec/v2/cmd/gosec@latest ;; \
+            GOBIN=/home/vscode/.local/bin GOPATH=/tmp/gopath GOCACHE=/tmp/go-build go install github.com/securego/gosec/v2/cmd/gosec@latest && \
+            rm -rf /tmp/gopath /tmp/go-build ;; \
           rust) \
             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
               | sh -s -- -y --default-toolchain stable --profile minimal --no-modify-path && \
@@ -234,12 +238,14 @@ RUN if [ -n "$AIDC_TOOLCHAINS" ]; then \
             ln -sf "$HOME/.cargo/bin/cargo" /home/vscode/.local/bin/cargo && \
             ln -sf "$HOME/.cargo/bin/rustc" /home/vscode/.local/bin/rustc && \
             ln -sf "$HOME/.cargo/bin/rustup" /home/vscode/.local/bin/rustup && \
-            "$HOME/.cargo/bin/cargo" install cargo-audit --locked && \
-            ln -sf "$HOME/.cargo/bin/cargo-audit" /home/vscode/.local/bin/cargo-audit ;; \
+            CARGO_TARGET_DIR=/tmp/cargo-target "$HOME/.cargo/bin/cargo" install cargo-audit --locked && \
+            ln -sf "$HOME/.cargo/bin/cargo-audit" /home/vscode/.local/bin/cargo-audit && \
+            rm -rf /tmp/cargo-target "$HOME/.cargo/registry" "$HOME/.cargo/git" ;; \
           ruby) \
             sudo apt-get update && \
             sudo apt-get install -y --no-install-recommends ruby-full && \
-            sudo gem install --no-document bundler-audit ;; \
+            sudo gem install --no-document bundler-audit && \
+            sudo rm -rf /var/lib/gems/*/cache ;; \
           java) \
             sudo apt-get update && \
             sudo apt-get install -y --no-install-recommends default-jdk ;; \
@@ -255,6 +261,7 @@ RUN if [ -n "$AIDC_TOOLCHAINS" ]; then \
             UV_TOOL_BIN_DIR="$HOME/.local/bin" \
             UV_TOOL_DIR="$HOME/.local/share/uv-tools" \
             uv tool install bandit && \
+            uv cache clean && \
             echo "aidc: python 3.13 already in base (uv-managed); bandit installed" ;; \
           *) \
             echo "aidc: unknown toolchain '$tc' (skipped)" >&2 ;; \
@@ -281,11 +288,13 @@ RUN if [ -n "$AIDC_SECURITY_TOOLS" ]; then \
           checkov) \
             UV_TOOL_BIN_DIR="$HOME/.local/bin" \
             UV_TOOL_DIR="$HOME/.local/share/uv-tools" \
-            uv tool install checkov ;; \
+            uv tool install checkov && \
+            uv cache clean ;; \
           bandit) \
             UV_TOOL_BIN_DIR="$HOME/.local/bin" \
             UV_TOOL_DIR="$HOME/.local/share/uv-tools" \
-            uv tool install bandit ;; \
+            uv tool install bandit && \
+            uv cache clean ;; \
           *) \
             echo "aidc: unknown security tool '$tool' (skipped)" >&2 ;; \
         esac; \