Repository navigation
Conversation
s3rius
requested changes
Oct 6, 2026
| @@ -1,6 +1,6 @@ | |||
| FROM rust:1.98-bookworm AS builder | |||
|
|
|||
| RUN apt update && apt-get install -y pkg-config libjemalloc-dev libssl-dev && apt-get clean | |||
Member
There was a problem hiding this comment.
Libjemalloc is required, since it's default allocator used in lib.rs
Collaborator
Author
There was a problem hiding this comment.
@s3rius jemalloc is still the allocator, it just doesn't come from the system package. tikv-jemalloc-sys builds jemalloc from the source it ships in the crate and links it statically. It only uses a system jemalloc when JEMALLOC_OVERRIDE is set, and we don't set it.
We've been running images without libjemalloc-dev for about a week, since this PR was opened, on our own clusters and at a few clients. The package was never used, in the runtime image it was only extra size.
The final stage installed libssl-dev and libjemalloc-dev, which are build-time packages. The binary needs only the OpenSSL shared library and CA certificates; jemalloc is linked statically. Install just libssl3 and ca-certificates there, skip recommended packages and remove the apt lists to shrink the image and its attack surface. The builder stage does not need libjemalloc-dev either, because tikv-jemalloc-sys builds jemalloc from source. Drop it and use apt-get consistently, as apt is not meant for scripts. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
lexfrei
force-pushed
the
fix/runtime-image-packages
branch
from
October 6, 2026 09:36
6de1224 to
c952b74
Compare
lexfrei
force-pushed
the
fix/dependency-advisories
branch
from
October 6, 2026 09:36
831acaf to
b47b19b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The image no longer carries build packages it does not need, in either stage.
The final stage installs
libssl3andca-certificatesinstead oflibssl-devandlibjemalloc-dev. Apart from the C runtime the Debian base already has, OpenSSL is the only shared library the binary loads. jemalloc is built into the binary statically, solddshows no jemalloc library. The install also skips recommended packages and removes the apt lists in the same layer.The builder stage drops
libjemalloc-devtoo, becausetikv-jemalloc-syscompiles jemalloc from source. It also usesapt-getconsistently.I built it for linux/arm64 with both changes.
--helpruns, and every library in thelddoutput inside the image resolves.The runtime base is still
debian:bookworm.debian:bookworm-slimwould make the image smaller, but changing the base is out of scope here.Stacked on #52.
Closes #51