Skip to content

Commit 0e1cf09

Browse files
abrarshivaniabrarshivani
committed
Install packages without docs to reduce image size
The UBI 8/9/10 base images ship almost no documentation of their own, but they do not set tsflags in /etc/dnf/dnf.conf, so every dnf install and dnf update we run installs docs and man pages into the layers we ship. They grow the image for no runtime benefit and get picked up by CI scanners; #772 hit this when the perl docs pulled in by git were flagged for containing sample secrets. Pass --nodocs to the transactional dnf calls in the RHEL driver and vGPU Manager images, the same way #772 did for git and wget. dnf module enable, versionlock, config-manager, remove and autoremove are left alone. Because this relies on the flag being present at each call, add tests/check-nodocs.sh and run it in CI. It joins continuation lines before matching, so a command split across lines is still seen as one command, and splits each command on &&, ||, ; and | so a chain only passes if every transaction in it carries the flag. The Ubuntu images need no change: the official ubuntu base images ship /etc/dpkg/dpkg.cfg.d/excludes, which already excludes /usr/share/doc and /usr/share/man, so dpkg never writes them. Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
1 parent 344c1e3 commit 0e1cf09

10 files changed

Lines changed: 166 additions & 46 deletions

File tree

‎.github/workflows/image.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ on:
2323
- release-*
2424

2525
jobs:
26+
check-nodocs:
27+
runs-on: linux-amd64-cpu4
28+
steps:
29+
- uses: actions/checkout@v7
30+
name: Check out code
31+
- name: Check dnf transactions pass --nodocs
32+
run: ./tests/check-nodocs.sh
33+
2634
image:
2735
runs-on: linux-amd64-cpu4
2836
strategy:

‎rhel10/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ ENV TARGETARCH=$TARGETARCH
3535

3636
SHELL ["/bin/bash", "-c"]
3737

38-
RUN dnf update -y && dnf clean all
38+
RUN dnf update -y --nodocs && dnf clean all
3939

4040
#ARG BASE_URL=http://us.download.nvidia.com/XFree86/Linux-x86_64
4141
ARG BASE_URL=https://us.download.nvidia.com/tesla
@@ -108,7 +108,7 @@ LABEL description="See summary"
108108
# Install / upgrade packages here that are required to resolve CVEs
109109
ARG CVE_UPDATES
110110
RUN if [ -n "${CVE_UPDATES}" ]; then \
111-
dnf update -y ${CVE_UPDATES} && \
111+
dnf update -y --nodocs ${CVE_UPDATES} && \
112112
dnf clean all; \
113113
fi
114114

‎rhel10/install.sh‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ echo "DRIVER_ARCH is $DRIVER_ARCH"
88

99
dep_installer () {
1010
if [ "$DRIVER_ARCH" = "x86_64" ]; then
11-
dnf install -y \
11+
dnf install -y --nodocs \
1212
libglvnd-glx \
1313
ca-certificates \
1414
curl-minimal \
@@ -19,7 +19,7 @@ dep_installer () {
1919
file \
2020
kmod
2121
elif [ "$DRIVER_ARCH" = "ppc64le" ]; then
22-
dnf install -y \
22+
dnf install -y --nodocs \
2323
libglvnd-glx \
2424
ca-certificates \
2525
curl-minimal \
@@ -30,7 +30,7 @@ dep_installer () {
3030
file \
3131
kmod
3232
elif [ "$DRIVER_ARCH" = "aarch64" ]; then
33-
dnf install -y \
33+
dnf install -y --nodocs \
3434
libglvnd-glx \
3535
ca-certificates \
3636
curl-minimal \
@@ -42,8 +42,8 @@ dep_installer () {
4242
kmod
4343
fi
4444

45-
if ! dnf install -y 'dnf-command(config-manager)'; then
46-
dnf install -y dnf5-plugins
45+
if ! dnf install -y --nodocs 'dnf-command(config-manager)'; then
46+
dnf install -y --nodocs dnf5-plugins
4747
fi
4848

4949
OS_RELEASE_ID=$(grep -oP '(?<=^ID=).+' /etc/os-release | tr -d '"')
@@ -57,23 +57,23 @@ dep_installer () {
5757
# unzboot is only available on the EPEL RPM repo
5858
if [ "$DRIVER_ARCH" = "aarch64" ]; then
5959
rpm --import https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10
60-
dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm
60+
dnf install -y --nodocs https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm
6161
dnf config-manager --enable epel
6262
# Try to install unzboot from EPEL. If it is not available yet, build it
6363
# from source because RHEL/Rocky 10 arm64 kernel images require it.
64-
if ! dnf install -y unzboot; then
64+
if ! dnf install -y --nodocs unzboot; then
6565
echo "unzboot package not available in current EPEL version; building from source."
6666

6767
# Install meson build dependencies
68-
if dnf install -y git gcc meson ninja-build glib2-devel zlib-devel libzstd-devel; then
68+
if dnf install -y --nodocs git gcc meson ninja-build glib2-devel zlib-devel libzstd-devel; then
6969
if command -v meson >/dev/null 2>&1 && command -v ninja >/dev/null 2>&1; then
7070
if git clone https://github.com/eballetbo/unzboot.git /tmp/unzboot-src 2>/dev/null; then
7171
if meson setup /tmp/unzboot-src/build /tmp/unzboot-src && meson compile -C /tmp/unzboot-src/build; then
7272
cp /tmp/unzboot-src/build/unzboot /usr/bin/unzboot
7373
chmod +x /usr/bin/unzboot
7474
runtime_pkgs=$(ldd /usr/bin/unzboot | awk '/=> \// { print $3 } /^\// { print $1 }' | xargs -r rpm -q --whatprovides | sort -u)
7575
if [ -n "$runtime_pkgs" ]; then
76-
dnf install -y $runtime_pkgs
76+
dnf install -y --nodocs $runtime_pkgs
7777
fi
7878
echo "Built and installed unzboot from source"
7979
else
@@ -152,35 +152,35 @@ nvidia_installer () {
152152
}
153153

154154
fabricmanager_install() {
155-
dnf install -y nvidia-fabricmanager-${DRIVER_VERSION} nvidia-fabric-manager-devel-${DRIVER_VERSION}
155+
dnf install -y --nodocs nvidia-fabricmanager-${DRIVER_VERSION} nvidia-fabric-manager-devel-${DRIVER_VERSION}
156156
dnf versionlock add nvidia-fabricmanager nvidia-fabric-manager-devel
157157
}
158158

159159
nscq_install() {
160-
dnf install -y libnvidia-nscq-${DRIVER_VERSION}
160+
dnf install -y --nodocs libnvidia-nscq-${DRIVER_VERSION}
161161
dnf versionlock add libnvidia-nscq
162162
}
163163

164164
# libnvsdm packages are not available for arm64
165165
nvsdm_install() {
166166
if [ "$TARGETARCH" = "amd64" ]; then
167-
dnf install -y libnvsdm-${DRIVER_VERSION}
167+
dnf install -y --nodocs libnvsdm-${DRIVER_VERSION}
168168
dnf versionlock add libnvsdm
169169
fi
170170
}
171171

172172
nvlink5_pkgs_install() {
173-
dnf install -y infiniband-diags nvlsm
173+
dnf install -y --nodocs infiniband-diags nvlsm
174174
}
175175

176176
imex_install() {
177-
dnf install -y nvidia-imex-${DRIVER_VERSION}
177+
dnf install -y --nodocs nvidia-imex-${DRIVER_VERSION}
178178
dnf versionlock add nvidia-imex
179179
}
180180

181181
extra_pkgs_install() {
182182
if [ "$DRIVER_TYPE" != "vgpu" ]; then
183-
dnf install -y 'dnf-command(versionlock)'
183+
dnf install -y --nodocs 'dnf-command(versionlock)'
184184

185185
fabricmanager_install
186186
nscq_install

‎rhel8/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ ENV TARGETARCH=$TARGETARCH
3434

3535
SHELL ["/bin/bash", "-c"]
3636

37-
RUN dnf update -y && dnf clean all
37+
RUN dnf update -y --nodocs && dnf clean all
3838

3939
#ARG BASE_URL=http://us.download.nvidia.com/XFree86/Linux-x86_64
4040
ARG BASE_URL=https://us.download.nvidia.com/tesla
@@ -106,7 +106,7 @@ LABEL description="See summary"
106106
# Install / upgrade packages here that are required to resolve CVEs
107107
ARG CVE_UPDATES
108108
RUN if [ -n "${CVE_UPDATES}" ]; then \
109-
dnf update -y ${CVE_UPDATES} && \
109+
dnf update -y --nodocs ${CVE_UPDATES} && \
110110
dnf clean all; \
111111
fi
112112

‎rhel8/install.sh‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ echo "DRIVER_ARCH is $DRIVER_ARCH"
88

99
dep_installer () {
1010
if [ "$DRIVER_ARCH" = "x86_64" ]; then
11-
dnf install -y \
11+
dnf install -y --nodocs \
1212
libglvnd-glx \
1313
ca-certificates \
1414
curl \
@@ -18,7 +18,7 @@ dep_installer () {
1818
cpio \
1919
kmod
2020
elif [ "$DRIVER_ARCH" = "ppc64le" ]; then
21-
dnf install -y \
21+
dnf install -y --nodocs \
2222
libglvnd-glx \
2323
ca-certificates \
2424
curl \
@@ -28,7 +28,7 @@ dep_installer () {
2828
cpio \
2929
kmod
3030
elif [ "$DRIVER_ARCH" = "aarch64" ]; then
31-
dnf install -y \
31+
dnf install -y --nodocs \
3232
libglvnd-glx \
3333
ca-certificates \
3434
curl \
@@ -39,7 +39,7 @@ dep_installer () {
3939
kmod
4040
fi
4141

42-
dnf install -y 'dnf-command(config-manager)'
42+
dnf install -y --nodocs 'dnf-command(config-manager)'
4343
rm -rf /var/cache/yum/*
4444
}
4545

@@ -93,35 +93,35 @@ nvidia_installer () {
9393
}
9494

9595
fabricmanager_install() {
96-
dnf install -y nvidia-fabricmanager-${DRIVER_VERSION} nvidia-fabric-manager-devel-${DRIVER_VERSION}
96+
dnf install -y --nodocs nvidia-fabricmanager-${DRIVER_VERSION} nvidia-fabric-manager-devel-${DRIVER_VERSION}
9797
dnf versionlock add nvidia-fabricmanager nvidia-fabric-manager-devel
9898
}
9999

100100
nscq_install() {
101-
dnf install -y libnvidia-nscq-${DRIVER_VERSION}
101+
dnf install -y --nodocs libnvidia-nscq-${DRIVER_VERSION}
102102
dnf versionlock add libnvidia-nscq
103103
}
104104

105105
nvsdm_install() {
106106
if [ "$TARGETARCH" = "amd64" ]; then
107-
dnf install -y libnvsdm-${DRIVER_VERSION}
107+
dnf install -y --nodocs libnvsdm-${DRIVER_VERSION}
108108
dnf versionlock add libnvsdm
109109
fi
110110
}
111111

112112
nvlink5_pkgs_install() {
113-
dnf install -y infiniband-diags nvlsm
113+
dnf install -y --nodocs infiniband-diags nvlsm
114114
}
115115

116116
imex_install() {
117-
dnf install -y nvidia-imex-${DRIVER_VERSION}
117+
dnf install -y --nodocs nvidia-imex-${DRIVER_VERSION}
118118
dnf versionlock add nvidia-imex
119119
}
120120

121121
extra_pkgs_install() {
122122
if [ "$DRIVER_TYPE" != "vgpu" ]; then
123123
dnf module enable -y nvidia-driver:${DRIVER_BRANCH}-dkms
124-
dnf install -y 'dnf-command(versionlock)'
124+
dnf install -y --nodocs 'dnf-command(versionlock)'
125125

126126
fabricmanager_install
127127
nscq_install

‎rhel9/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ ENV TARGETARCH=$TARGETARCH
3434

3535
SHELL ["/bin/bash", "-c"]
3636

37-
RUN dnf update -y && dnf clean all
37+
RUN dnf update -y --nodocs && dnf clean all
3838

3939
#ARG BASE_URL=http://us.download.nvidia.com/XFree86/Linux-x86_64
4040
ARG BASE_URL=https://us.download.nvidia.com/tesla
@@ -107,7 +107,7 @@ LABEL description="See summary"
107107
# Install / upgrade packages here that are required to resolve CVEs
108108
ARG CVE_UPDATES
109109
RUN if [ -n "${CVE_UPDATES}" ]; then \
110-
dnf update -y ${CVE_UPDATES} && \
110+
dnf update -y --nodocs ${CVE_UPDATES} && \
111111
dnf clean all; \
112112
fi
113113

‎rhel9/install.sh‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ echo "DRIVER_ARCH is $DRIVER_ARCH"
88

99
dep_installer () {
1010
if [ "$DRIVER_ARCH" = "x86_64" ]; then
11-
dnf install -y \
11+
dnf install -y --nodocs \
1212
libglvnd-glx \
1313
ca-certificates \
1414
curl-minimal \
@@ -18,7 +18,7 @@ dep_installer () {
1818
cpio \
1919
kmod
2020
elif [ "$DRIVER_ARCH" = "ppc64le" ]; then
21-
dnf install -y \
21+
dnf install -y --nodocs \
2222
libglvnd-glx \
2323
ca-certificates \
2424
curl-minimal \
@@ -28,7 +28,7 @@ dep_installer () {
2828
cpio \
2929
kmod
3030
elif [ "$DRIVER_ARCH" = "aarch64" ]; then
31-
dnf install -y \
31+
dnf install -y --nodocs \
3232
libglvnd-glx \
3333
ca-certificates \
3434
curl-minimal \
@@ -42,9 +42,9 @@ dep_installer () {
4242
# Download unzboot as kernel images are compressed in the zboot format on RHEL 9 arm64
4343
# unzboot is only available on the EPEL RPM repo
4444
rpm --import https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9
45-
dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
45+
dnf install -y --nodocs https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
4646
dnf config-manager --enable epel
47-
dnf install -y unzboot
47+
dnf install -y --nodocs unzboot
4848

4949
rm -rf /var/cache/yum/*
5050
}
@@ -99,35 +99,35 @@ nvidia_installer () {
9999
}
100100

101101
fabricmanager_install() {
102-
dnf install -y nvidia-fabricmanager-${DRIVER_VERSION} nvidia-fabric-manager-devel-${DRIVER_VERSION}
102+
dnf install -y --nodocs nvidia-fabricmanager-${DRIVER_VERSION} nvidia-fabric-manager-devel-${DRIVER_VERSION}
103103
dnf versionlock add nvidia-fabricmanager nvidia-fabric-manager-devel
104104
}
105105

106106
nscq_install() {
107-
dnf install -y libnvidia-nscq-${DRIVER_VERSION}
107+
dnf install -y --nodocs libnvidia-nscq-${DRIVER_VERSION}
108108
dnf versionlock add libnvidia-nscq
109109
}
110110

111111
# libnvsdm packages are not available for arm64
112112
nvsdm_install() {
113113
if [ "$TARGETARCH" = "amd64" ]; then
114-
dnf install -y libnvsdm-${DRIVER_VERSION}
114+
dnf install -y --nodocs libnvsdm-${DRIVER_VERSION}
115115
dnf versionlock add libnvsdm
116116
fi
117117
}
118118

119119
nvlink5_pkgs_install() {
120-
dnf install -y infiniband-diags nvlsm
120+
dnf install -y --nodocs infiniband-diags nvlsm
121121
}
122122

123123
imex_install() {
124-
dnf install -y nvidia-imex-${DRIVER_VERSION}
124+
dnf install -y --nodocs nvidia-imex-${DRIVER_VERSION}
125125
dnf versionlock add nvidia-imex
126126
}
127127
extra_pkgs_install() {
128128
if [ "$DRIVER_TYPE" != "vgpu" ]; then
129129
dnf module enable -y nvidia-driver:${DRIVER_BRANCH}-dkms
130-
dnf install -y 'dnf-command(versionlock)'
130+
dnf install -y --nodocs 'dnf-command(versionlock)'
131131

132132
# If running on a RockyLinux base image, we enable the Code Ready Builder RPM repo (crb)
133133
OS_RELEASE_ID=$(grep -oP '(?<=^ID=).+' /etc/os-release | tr -d '"')

0 commit comments

Comments
 (0)