Docker image is unnecessarily large about semgrep-action

[underyx]

we waste 139MB in the line COPY --from=semgrep /usr/local/bin/semgrep-core /tmp/semgrep-core which we can't delete later because docker layers are append-only. Either squash the image, or maybe we just can just install semgrep from pip?

But we need semgrep-core for semgrep to work at runtime. I don't think we lose any additional space during installation. We cannot directly install from pip cause the pip wheels don't (cannot) support Alpine linux.

[underyx]

probably we don't need to use virtualenvs in the docker image, can just install as system deps?

We had dependency version conflicts between bento & semgrep a while ago, which is why we started doing this. I kinda like that semgrep-agent and semgrep have independent dependencies, one less thing to worry about when developing.

[ievans]

I chatted with @underyx and clarified some things:

I was trying to say that that second install copies the 139MB into /root/.local/pipx if i understand correctly, so we don’t need the /tmp anymore. but the rm -rf /tmp is not reclaiming any space. b/c the docker layers are append only the rm -rf /tmp is useless. If you build with --squash you’ll reclaim it, but that’s an experimental flag

[mschwager]

Removing PRECOMPILED_LOCATION (https://github.com/returntocorp/semgrep-action/pull/156) took this down to 313MB for me. Removing reliance on pipx brought it down to 291MB. Should we remove pipx and call this done?

[ievans]

👍 from me @mschwager!

[raghavjain3]

Closing since the image here seems to be significantly smaller in size than a few months ago (60MB compressed instead of 100+MB).

@ievans please feel free to reopen if you find this to still be an issue

[ievans]

brilliant work all!