Skip to content

fix(ci): set build_target to 'application' to reduce Docker image size #7913

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xurui-c merged 2 commits into from
May 5, 2026
Merged

fix(ci): set build_target to 'application' to reduce Docker image size #7913

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5037a88
fix(ci): set build_target to 'application' to reduce Docker image size
aldy505 Apr 29, 2026
0b7b2c8
Merge branch 'master' into fix/ci/build-target-application
aldy505 May 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ jobs:
image_name: 'snuba'
platforms: linux/${{ matrix.platform }}
dockerfile_path: 'Dockerfile'
build_target: 'application'

@cursor cursor Bot May 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Production build job missing build_target setting

High Severity

The build_target: 'application' is added to build-multiplatform but not to the build-production job (line 49–60), which pushes to Google Artifact Registry. Without build_target, Docker defaults to building the last stage in the Dockerfile, which is testing — a bloated image containing dev dependencies and Rust toolchains. The Google AR "production" image now diverges from the GHCR images in a way it didn't before this change.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 0b7b2c8. Configure here.

@aldy505 aldy505 May 3, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Self-hosted build does not care about the build-production. This is wrong.

tag_suffix: -${{ matrix.platform }}

@sentry sentry Bot May 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The build-production job is missing build_target: 'application', causing the production image to be built from the testing stage with unnecessary dev dependencies and build artifacts.
Severity: HIGH

Suggested Fix

In the .github/workflows/image.yml file, add the build_target: 'application' parameter to the build-production job, similar to how it has been added to the build-multiplatform job in this pull request. This will ensure the correct, stripped-down application stage is used for the production image.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/image.yml#L35

Potential issue: The `build-production` job in the `image.yml` workflow does not specify
a `build_target`. Because the final stage in the associated Dockerfile is `testing`,
Docker defaults to building this stage for production. This `testing` stage includes
development dependencies, the full Rust toolchain, and source code, none of which should
be in a production image. This results in a significantly larger and potentially less
secure production container. While the pull request correctly adds `build_target:
'application'` to the `build-multiplatform` job, it fails to apply the same necessary
fix to the `build-production` job.

Did we get this right? 👍 / 👎 to inform future reviews.

@aldy505 aldy505 May 3, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Invalid. There is:

snuba/Dockerfile

Lines 146 to 152 in b5a6b12

FROM application_base AS application
USER 0
RUN set -ex; \
apt-get purge -y --auto-remove $(cat /tmp/build-deps.txt); \
rm /tmp/build-deps.txt; \
rm -rf /var/lib/apt/lists/*;
USER snuba

ghcr: true
tag_nightly: false
Expand Down
Loading