perf(docker): tune release profile and switch to musl/Alpine#84
Merged
Conversation
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
WalkthroughAdded Cargo release profile settings (LTO, single codegen unit, strip, panic = "abort") and updated the Docker build to produce a fully static Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Assessment against linked issues
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Dockerfile (1)
52-52: Pin the Alpine version for reproducible builds.Using the bare
alpinetag means builds may use different Alpine versions over time, potentially introducing unexpected behavior or security differences.📦 Suggested fix to pin Alpine version
-FROM alpine AS runtime +FROM alpine:3.23 AS runtime🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` at line 52, Replace the non-pinned base image in the Dockerfile so builds are reproducible: update the "FROM alpine AS runtime" reference to use a specific Alpine tag (e.g., alpine:3.18) or introduce an ARG like ALPINE_VERSION and use "FROM alpine:${ALPINE_VERSION} AS runtime" so the image version is explicit and repeatable; ensure any CI/build configs set the same ALPINE_VERSION value.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@Dockerfile`:
- Line 52: Replace the non-pinned base image in the Dockerfile so builds are
reproducible: update the "FROM alpine AS runtime" reference to use a specific
Alpine tag (e.g., alpine:3.18) or introduce an ARG like ALPINE_VERSION and use
"FROM alpine:${ALPINE_VERSION} AS runtime" so the image version is explicit and
repeatable; ensure any CI/build configs set the same ALPINE_VERSION value.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7d027231-0547-4b81-a728-de9ce6368232
📒 Files selected for processing (3)
CHANGELOG.mdCargo.tomlDockerfile
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #84 +/- ##
=======================================
Coverage 84.33% 84.33%
=======================================
Files 6 6
Lines 166 166
=======================================
Hits 140 140
Misses 26 26 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile`:
- Line 18: The Dockerfile hard-codes the Rust target with "RUN rustup target add
x86_64-unknown-linux-musl" while the two FROM statements lack platform
directives, causing cross-arch mismatches on arm64 builders; fix by either
adding --platform=linux/amd64 to both FROM statements to force amd64 build and
runtime, or update the Dockerfile to parameterize the target using build
args/variables (e.g., TARGETARCH/TARGETPLATFORM) and derive the rustup target
from those variables so the rustup invocation (the RUN rustup target add ...)
and the runtime FROM are consistent with the chosen architecture.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Dockerfile (1)
54-54: Pin the Alpine version for reproducible builds.Using
alpinewithout a version tag means the image can change unexpectedly when a new Alpine release becomes:latest. This affects build reproducibility and may introduce breaking changes silently. Pin to a stable version such asalpine:3.23.📦 Proposed fix to pin Alpine version
-FROM --platform=linux/amd64 alpine AS runtime +FROM --platform=linux/amd64 alpine:3.23 AS runtime🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` at line 54, The Dockerfile's base image line "FROM --platform=linux/amd64 alpine AS runtime" should pin the Alpine tag to ensure reproducible builds; update that FROM instruction to use a specific, stable tag (e.g., alpine:3.23) instead of the floating "alpine" to prevent unexpected changes in downstream builds.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@Dockerfile`:
- Line 54: The Dockerfile's base image line "FROM --platform=linux/amd64 alpine
AS runtime" should pin the Alpine tag to ensure reproducible builds; update that
FROM instruction to use a specific, stable tag (e.g., alpine:3.23) instead of
the floating "alpine" to prevent unexpected changes in downstream builds.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Dockerfile (1)
31-32: Use--lockedin both Cargo build steps.
Cargo.lockis copied explicitly, but plaincargo buildwill still proceed if the lockfile is out of sync and resolve inside the image.--lockedmakes that drift fail fast and keeps the Docker build deterministic.♻️ Proposed change
RUN --mount=type=cache,target=/usr/local/cargo/registry \ --mount=type=cache,target=/app/target \ CC_x86_64_unknown_linux_musl=musl-gcc \ - cargo build --release --target x86_64-unknown-linux-musl + cargo build --locked --release --target x86_64-unknown-linux-musl @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \ --mount=type=cache,target=/app/target \ touch src/main.rs && \ CC_x86_64_unknown_linux_musl=musl-gcc \ - cargo build --release --target x86_64-unknown-linux-musl && \ + cargo build --locked --release --target x86_64-unknown-linux-musl && \ cp target/x86_64-unknown-linux-musl/release/rust-samples-rocket-restful /app/rust-samples-rocket-restfulAlso applies to: 46-48
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` around lines 31 - 32, Builds are using plain `cargo build` which can resolve/update Cargo.lock inside the image; add `--locked` to both cargo build invocations so the image fails if Cargo.lock is out of sync. Update the two occurrences of the `cargo build --release --target x86_64-unknown-linux-musl` commands (one following `CC_x86_64_unknown_linux_musl=musl-gcc` and the other earlier in the Dockerfile) to `cargo build --locked --release --target x86_64-unknown-linux-musl` so the Docker build remains deterministic given the copied Cargo.lock.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@Dockerfile`:
- Around line 31-32: Builds are using plain `cargo build` which can
resolve/update Cargo.lock inside the image; add `--locked` to both cargo build
invocations so the image fails if Cargo.lock is out of sync. Update the two
occurrences of the `cargo build --release --target x86_64-unknown-linux-musl`
commands (one following `CC_x86_64_unknown_linux_musl=musl-gcc` and the other
earlier in the Dockerfile) to `cargo build --locked --release --target
x86_64-unknown-linux-musl` so the Docker build remains deterministic given the
copied Cargo.lock.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
[profile.release]toCargo.tomlwithlto,codegen-units,strip, andpanic = "abort"to reduce binary size (Tune[profile.release]for smaller binary size (lto,strip,codegen-units) #60)x86_64-unknown-linux-musl(fully static binary) and the runtime stage fromdebian:bookworm-slimtoalpine(Reduce container image size by targetingmusland switching runtime to Alpine #57)Results
debian:bookworm-slim~74 MBalpine~7 MBTest plan
cargo fmtpassescargo clippy --all-targets --all-features -- -D warningspasses cleancargo buildsucceedscargo test— all 38 tests pass, no regressionsdocker compose buildsucceeds — image size confirmed at 9.1 MBdocker compose upstarts the API and responds on port 9000Closes #60
Closes #57
🤖 Generated with Claude Code
Summary by CodeRabbit