Skip to content

perf: slim the base image (drop unconditional build-essential + nodejs) #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ai-anant wants to merge 1 commit into
base: main
Choose a base branch
from
Open

perf: slim the base image (drop unconditional build-essential + nodejs) #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions docs/install.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,10 +74,15 @@ aidc inspects the repo on every `aidc up` and installs matching toolchains:
| `Gemfile` | Ruby — apt `ruby-full` |
| `pom.xml`, `build.gradle`, `build.gradle.kts` | JDK — apt `default-jdk` |
| `composer.json` | PHP CLI — apt `php-cli` |
| `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lockb` | Node 22 (already in base) |
| `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lockb` | Node 22 — apt `nodejs` (nodesource repo) |
| `requirements.txt`, `uv.lock`, `pyproject.toml`, `Pipfile`, `Pipfile.lock`, `poetry.lock` | Python 3.13 via uv (already in base) |

Node and Python markers don't trigger a language install (the base image already has them) — they're listed so you can see in the build log what aidc detected, and so explicit `AIDC_TOOLCHAINS=node,python` works for clarity. The Python detection still installs `bandit`; see [security.md](security.md#per-toolchain-linters-auto-installed).
Node is installed from the nodesource repo when the `node` toolchain is
detected (or pinned via `AIDC_TOOLCHAINS=node`). Python is already in the
base image (uv-managed) — the marker triggers only the `bandit` linter; see
[security.md](security.md#per-toolchain-linters-auto-installed). Both are
listed so you can see in the build log what aidc detected, and so explicit
`AIDC_TOOLCHAINS=node,python` works for clarity.

The detected list is passed as a Docker `--build-arg AIDC_TOOLCHAINS=go,rust,...` so it caches per combination — switching between repos doesn't rebuild.

Expand Down
18 changes: 9 additions & 9 deletions templates/devcontainer/Dockerfile.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ USER root
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
bubblewrap \
build-essential \
ca-certificates \
curl \
dnsutils \
Expand All @@ -35,14 +34,9 @@ RUN apt-get update \
xz-utils \
zip \
zsh \
&& mkdir -p /etc/apt/keyrings \
&& curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
&& echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" > /etc/apt/sources.list.d/nodesource.list \
&& apt-get update \
&& apt-get install -y --no-install-recommends nodejs \
&& ln -sf /usr/bin/fdfind /usr/local/bin/fd \
&& rm -rf /var/lib/apt/lists/*

&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
RUN ARCH=$(dpkg --print-architecture) \
&& curl -fsSL "https://github.com/dandavison/delta/releases/download/${GIT_DELTA_VERSION}/git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb" -o /tmp/git-delta.deb \
&& dpkg -i /tmp/git-delta.deb \
Expand Down Expand Up @@ -228,6 +222,8 @@ RUN if [ -n "$AIDC_TOOLCHAINS" ]; then \
sudo apt-get install -y --no-install-recommends golang-go && \
GOBIN=/home/vscode/.local/bin go install github.com/securego/gosec/v2/cmd/gosec@latest ;; \
rust) \
sudo apt-get update && \
sudo apt-get install -y --no-install-recommends build-essential && \
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
| sh -s -- -y --default-toolchain stable --profile minimal --no-modify-path && \
mkdir -p /home/vscode/.local/bin && \
Expand All @@ -250,7 +246,11 @@ RUN if [ -n "$AIDC_TOOLCHAINS" ]; then \
sudo apt-get update && \
sudo apt-get install -y --no-install-recommends shellcheck ;; \
node) \
echo "aidc: node 22 already in base (npm/pnpm/yarn/bun via pmg shims; npm audit built-in)" ;; \
sudo mkdir -p /etc/apt/keyrings && \
sudo curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \
echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list >/dev/null && \
sudo apt-get update && \
sudo apt-get install -y --no-install-recommends nodejs ;; \
python) \
UV_TOOL_BIN_DIR="$HOME/.local/bin" \
UV_TOOL_DIR="$HOME/.local/share/uv-tools" \
Expand Down