Install packages without docs to reduce image size - #897
Open
abrarshivani wants to merge 1 commit into
Open
Conversation
abrarshivani
force-pushed
the
fix/install-packages-nodocs
branch
8 times, most recently
from
August 4, 2026 02:21
aaab24e to
a301308
Compare
abrarshivani
force-pushed
the
fix/install-packages-nodocs
branch
from
August 4, 2026 03:18
a301308 to
b102cbc
Compare
abrarshivani
marked this pull request as ready for review
August 4, 2026 03:22
rahulait
reviewed
Aug 4, 2026
Contributor
|
Thanks @abrarshivani. This change LGTM, lets wait for some time before we merge this PR as we don't want these changes to affect existing release in progress. |
The UBI 8/9/10 base images ship almost no documentation of their own, but they do not set tsflags in /etc/dnf/dnf.conf, so every dnf install and dnf update we run installs docs and man pages into the layers we ship. They grow the image for no runtime benefit and get picked up by CI scanners; NVIDIA#772 hit this when the perl docs pulled in by git were flagged for containing sample secrets. Pass --nodocs to the transactional dnf calls in the RHEL driver and vGPU Manager images, the same way NVIDIA#772 did for git and wget. dnf module enable, versionlock, config-manager, remove and autoremove are left alone. Because this relies on the flag being present at each call, add tests/check-nodocs.sh and run it in CI. It joins continuation lines before matching, so a command split across lines is still seen as one command, and splits each command on &&, ||, ; and | so a chain only passes if every transaction in it carries the flag. The Ubuntu images need no change: the official ubuntu base images ship /etc/dpkg/dpkg.cfg.d/excludes, which already excludes /usr/share/doc and /usr/share/man, so dpkg never writes them. Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
abrarshivani
force-pushed
the
fix/install-packages-nodocs
branch
from
August 4, 2026 20:00
b102cbc to
0e1cf09
Compare
Contributor
Author
|
@rahulait Sounds good. Let's merge this after release. |
Contributor
|
What is the difference in image size before and after this change? |
Contributor
Author
@tariq1890 Following are difference in image sizes:
|
tariq1890
reviewed
Aug 10, 2026
| - release-* | ||
|
|
||
| jobs: | ||
| check-nodocs: |
Contributor
There was a problem hiding this comment.
I don't think this is necessary. If we want to establish a policy of never downloading docs when building images, we could explore that separately. For now, we don't have to add an extra step to our CIs
tariq1890
reviewed
Aug 10, 2026
| SHELL ["/bin/bash", "-c"] | ||
|
|
||
| RUN dnf update -y && dnf clean all | ||
| RUN dnf update -y --nodocs && dnf clean all |
Contributor
There was a problem hiding this comment.
Can we disable docs in a dnf.conf file so that we express this preference once instead of doing so in every dnf command?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #773
What
Pass
--nodocsto the dnf install/update calls in the RHEL driver and vGPU Manager images, plus a CI check so a later call can't drop the flag.Why
The UBI bases don't set
tsflagsin/etc/dnf/dnf.conf, so everydnf install/dnf updatewe run writes documentation into the shipped layers. It grows the image and gets flagged by CI scanners — #772 hit this with perl docs containing sample secrets.The bases themselves are clean, so the docs all come from our own install steps. (
rockylinux:9.8-ubiand10.2-ubialready settsflags=nodocs; ubi8/9/10 and rocky8 don't.)Changes
rhel8/9/10/Dockerfile:dnf updateand theCVE_UPDATESblockrhel8/9/10/install.sh:dep_installerandextra_pkgs_installvgpu-manager/rhel8/9/Dockerfile:pciutilsandCVE_UPDATEStests/check-nodocs.sh+ CI job: fails on any install/update/upgrade/reinstall/downgrade in these files missing--nodocsmodule enable,versionlock,config-manager,removeandautoremoveare untouched. The check skipsrhel*/precompiled, which already persists the setting viaconfig-manager --nodocs --save, andnvidia-driver/ocp_dtk_entrypoint, whose dnf calls run in the started container rather than at image build.Notes
/etc/dpkg/dpkg.cfg.d/excludes, which already drops/usr/share/docand/usr/share/man. This is RHEL only.rm -rf /usr/share/doc/*stays.--nodocsdoesn't cover files shipped without a%docmarker or written outside rpm.nvcr.io/nvidia/cuda:*-base-ubi8/9, which already has documentation in its parent layers. This only stops documentation from the transactions we run.install_weak_deps=Falseleft out: it's what actually kept the perl docs out in avoid installing docs in image #772, but it can silently drop a package needed at runtime. Possible follow up.Testing
Measured on the CI-built
rhel9images for driver580.178.04, base344c1e37vs branchb102cbcf: