Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions devenv/Containerfile.debian
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# These aren't packages, just low-dependency binaries dropped in /usr/local/bin
# so we can fetch them independently in a separate build.
ARG base=docker.io/library/debian:sid
FROM $base as base
FROM $base AS base
# Life is too short to care about dash
RUN ln -sfr /bin/bash /bin/sh
RUN <<EORUN
Expand All @@ -28,21 +28,21 @@ echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubc
apt -y update
EORUN

FROM base as tools
FROM base AS tools
# renovate: datasource=github-releases depName=astral-sh/uv
ARG uvversion=0.10.2
COPY fetch-tools.py tool-versions.txt install-uv.sh /run/src/
RUN /run/src/fetch-tools.py
RUN apt -y install python3 && /run/src/fetch-tools.py && apt -y purge python3 && apt -y autoremove

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To improve Docker layer hygiene and minimize layer size, it's best practice to use --no-install-recommends with apt install and to clean up apt metadata within the same RUN instruction. This prevents unnecessary packages from being installed and removes cached files that are not needed in the image layer.

RUN apt -y install --no-install-recommends python3 && /run/src/fetch-tools.py && apt -y purge python3 && apt -y autoremove && apt clean && rm -rf /var/lib/apt/lists/*

RUN uvversion=$uvversion /run/src/install-uv.sh

FROM base as rust
FROM base AS rust
# renovate: datasource=custom.rust-nightly depName=rust-nightly versioning=rust-release-channel
ARG rust_nightly=nightly-2026-03-02
COPY install-rust.sh /run/src/
RUN rust_nightly=$rust_nightly /run/src/install-rust.sh

# Kani formal verification tool - requires rustup for toolchain management
FROM rust as kani
FROM rust AS kani
# renovate: datasource=crate depName=kani-verifier
ARG kaniversion=0.67.0
RUN apt-get update && apt-get install -y --no-install-recommends gcc libc6-dev && rm -rf /var/lib/apt/lists/*
Expand Down
Loading