From 56b37b9e20272bf2072abdec16b610c7c530b0d9 Mon Sep 17 00:00:00 2001 From: ai-anant Date: Sun, 2 Aug 2026 14:19:03 +0530 Subject: [PATCH] perf: slim the base image (drop unconditional build-essential + nodejs) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - build-essential (~150MB with gcc/g++) was installed for every project; it is only needed when a project compiles C. Moved into the 'rust' toolchain arm (cargo links C deps when installing crates). - nodejs 22 was installed unconditionally via the nodesource repo; moved to the 'node' toolchain arm so non-node projects skip it. - Kept all interactive/network/firewall tooling (vim, tmux, zsh, fzf, gh, jq, ripgrep, iptables, socat, ...) — they're small and aidc relies on several (socat for the clipboard bridge, iptables for the firewall). Expected saving: ~200-300MB per non-node, non-C project image. Refs #11 --- docs/install.md | 9 +++++++-- templates/devcontainer/Dockerfile.tmpl | 18 +++++++++--------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/docs/install.md b/docs/install.md index c872ecf..b51ca68 100644 --- a/docs/install.md +++ b/docs/install.md @@ -74,10 +74,15 @@ aidc inspects the repo on every `aidc up` and installs matching toolchains: | `Gemfile` | Ruby — apt `ruby-full` | | `pom.xml`, `build.gradle`, `build.gradle.kts` | JDK — apt `default-jdk` | | `composer.json` | PHP CLI — apt `php-cli` | -| `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lockb` | Node 22 (already in base) | +| `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lockb` | Node 22 — apt `nodejs` (nodesource repo) | | `requirements.txt`, `uv.lock`, `pyproject.toml`, `Pipfile`, `Pipfile.lock`, `poetry.lock` | Python 3.13 via uv (already in base) | -Node and Python markers don't trigger a language install (the base image already has them) — they're listed so you can see in the build log what aidc detected, and so explicit `AIDC_TOOLCHAINS=node,python` works for clarity. The Python detection still installs `bandit`; see [security.md](security.md#per-toolchain-linters-auto-installed). +Node is installed from the nodesource repo when the `node` toolchain is +detected (or pinned via `AIDC_TOOLCHAINS=node`). Python is already in the +base image (uv-managed) — the marker triggers only the `bandit` linter; see +[security.md](security.md#per-toolchain-linters-auto-installed). Both are +listed so you can see in the build log what aidc detected, and so explicit +`AIDC_TOOLCHAINS=node,python` works for clarity. The detected list is passed as a Docker `--build-arg AIDC_TOOLCHAINS=go,rust,...` so it caches per combination — switching between repos doesn't rebuild. diff --git a/templates/devcontainer/Dockerfile.tmpl b/templates/devcontainer/Dockerfile.tmpl index bae5a6f..aa80e5d 100644 --- a/templates/devcontainer/Dockerfile.tmpl +++ b/templates/devcontainer/Dockerfile.tmpl @@ -13,7 +13,6 @@ USER root RUN apt-get update \ && apt-get install -y --no-install-recommends \ bubblewrap \ - build-essential \ ca-certificates \ curl \ dnsutils \ @@ -35,14 +34,9 @@ RUN apt-get update \ xz-utils \ zip \ zsh \ - && mkdir -p /etc/apt/keyrings \ - && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \ - && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" > /etc/apt/sources.list.d/nodesource.list \ - && apt-get update \ - && apt-get install -y --no-install-recommends nodejs \ && ln -sf /usr/bin/fdfind /usr/local/bin/fd \ - && rm -rf /var/lib/apt/lists/* - + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb RUN ARCH=$(dpkg --print-architecture) \ && curl -fsSL "https://github.com/dandavison/delta/releases/download/${GIT_DELTA_VERSION}/git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb" -o /tmp/git-delta.deb \ && dpkg -i /tmp/git-delta.deb \ @@ -228,6 +222,8 @@ RUN if [ -n "$AIDC_TOOLCHAINS" ]; then \ sudo apt-get install -y --no-install-recommends golang-go && \ GOBIN=/home/vscode/.local/bin go install github.com/securego/gosec/v2/cmd/gosec@latest ;; \ rust) \ + sudo apt-get update && \ + sudo apt-get install -y --no-install-recommends build-essential && \ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \ | sh -s -- -y --default-toolchain stable --profile minimal --no-modify-path && \ mkdir -p /home/vscode/.local/bin && \ @@ -250,7 +246,11 @@ RUN if [ -n "$AIDC_TOOLCHAINS" ]; then \ sudo apt-get update && \ sudo apt-get install -y --no-install-recommends shellcheck ;; \ node) \ - echo "aidc: node 22 already in base (npm/pnpm/yarn/bun via pmg shims; npm audit built-in)" ;; \ + sudo mkdir -p /etc/apt/keyrings && \ + sudo curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \ + echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list >/dev/null && \ + sudo apt-get update && \ + sudo apt-get install -y --no-install-recommends nodejs ;; \ python) \ UV_TOOL_BIN_DIR="$HOME/.local/bin" \ UV_TOOL_DIR="$HOME/.local/share/uv-tools" \