Reduce cephcsi container image size by using a minimal final base image

[ismaelpuerto]

Describe the feature you'd like to have

Use a minimal base image (quay.io/centos/centos:stream9) for the final runtime stage of the cephcsi multi-stage Dockerfile, instead of the full Ceph daemon image (quay.io/ceph/ceph).

The final image would only install the strictly required Ceph client shared libraries (librados2, librbd1, libcephfs2) from the official Ceph RPM repository

The build/compilation stage remains unchanged — it still uses the full Ceph image to provide the -devel headers needed for CGo compilation.

What is the value to the end user? (why is it a priority?)

• Faster image pulls and pod startup: The current image is ~900 MB–1.2 GB. A minimal image would be ~500 MB, significantly reducing pull times in bandwidth-constrained or edge environments.
• Reduced storage consumption: Less disk usage on container registries and on every node in the cluster where the DaemonSet runs.
• Smaller attack surface: Fewer installed packages means fewer potential CVEs to patch and track. The full Ceph image contains daemons, debug tools, and libraries that the CSI plugin never uses at runtime.
• Faster rollouts and scaling: Lighter images mean quicker DaemonSet rollouts and Pod scheduling, improving operational agility.

How will we know we have a good solution? (acceptance criteria)

• The final cephcsi image is based on a minimal image (e.g., CentOS Stream 9) rather than the full Ceph daemon image.

Additional context

I have a working proof-of-concept patch that implements this approach. In my testing, the resulting image size was ~515 MB without compress, down from ~2 GB without compress with the current full Ceph base image.

1. deploy/cephcsi/image/Dockerfile: The final FROM stage switches from updated_base to ${FINAL_BASE_IMAGE} (defaults to quay.io/centos/centos:stream9). The Ceph release RPM is installed and only the userspace client libraries are pulled.
2. Makefile: CEPH_VERSION is passed as a --build-arg to the container build command so the Dockerfile can configure the correct Ceph repository.

The ldd check at the end of the Dockerfile acts as a safety gate — if any shared library is missing in the minimal image, the build fails immediately.

[Madhu-1]

@ismaelpuerto are you able to build and run cephcsi image with above changes? The question becase we also need to have some binaries installed in the base image (for example rbd) that should be of same version as the libraries we are installing

[nixpanic]

We should not use different Ceph builds for compiling and runtime. There is no guarantee that it works without issues (they potentially have different compile options, or slight version changes causing binary incompatibilities).

Maybe the Ceph team is willing to provide a smaller container image that only contains the required client-side RPMs. This is something that should be brought up with the Ceph build team in the main Ceph project.

[nixpanic]

@ismaelpuerto if we can use the same Ceph build for both stages, we can probably start with your approach. Do you want to open a PR for that with the changes you're proposing?