brooktrails/gllm
Watch
1
0
Fork
You've already forked gllm
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix(docker): keep CUDA point releases out of the release-churn layer #53

Merged
rcsheets merged 1 commit from fix/cuda-image-churn into main 2026-07-23 08:43:58 +00:00
Conversation 1 Commits 1 Files changed 1 +8 -3
rcsheets commented 2026-07-23 08:38:32 +00:00
Owner
Copy link

Every latest-cuda pull was fetching a ~533MiB compressed blob per release. Breaking that layer down:

Content Size (uncompressed)
CUDA lib point-bumps from apt-get upgrade (libcusparse, libcusolver, libnpp, ...) ~620MB
The actual /gllm binary 13MB
Ubuntu security updates ~15MB

The NVIDIA runtime base ships with the CUDA apt repo enabled (only libcublas is apt-mark held), so the scanner-driven apt-get upgrade -y also pulled point releases of GPU libraries gllm never links -- it uses only libcudart and libcublasLt. buildah commits the final stage as a single layer, so all of it rode in the one blob that changes every release.

Fix: drop /etc/apt/sources.list.d/cuda*.list before the upgrade. Verified against nvidia/cuda:13.3.0-runtime-ubuntu24.04: the upgrade shrinks to 14 small Ubuntu security packages (openssl, perl-base, gzip, ca-certificates, ...). Expected per-release pull drops to roughly 10-15MiB compressed. CUDA library updates still arrive deliberately via CUDA_VERSION bumps, documented in the comment.

Side benefit: no more ~600MB of shadowed old CUDA libs wasted per image version on disk.

🤖 Generated with Claude Code

Every `latest-cuda` pull was fetching a ~533MiB compressed blob per release. Breaking that layer down: | Content | Size (uncompressed) | |---|---| | CUDA lib point-bumps from `apt-get upgrade` (libcusparse, libcusolver, libnpp, ...) | ~620MB | | The actual `/gllm` binary | 13MB | | Ubuntu security updates | ~15MB | The NVIDIA runtime base ships with the CUDA apt repo enabled (only `libcublas` is apt-mark held), so the scanner-driven `apt-get upgrade -y` also pulled point releases of GPU libraries gllm never links -- it uses only `libcudart` and `libcublasLt`. buildah commits the final stage as a single layer, so all of it rode in the one blob that changes every release. Fix: drop `/etc/apt/sources.list.d/cuda*.list` before the upgrade. Verified against `nvidia/cuda:13.3.0-runtime-ubuntu24.04`: the upgrade shrinks to 14 small Ubuntu security packages (openssl, perl-base, gzip, ca-certificates, ...). Expected per-release pull drops to roughly 10-15MiB compressed. CUDA library updates still arrive deliberately via `CUDA_VERSION` bumps, documented in the comment. Side benefit: no more ~600MB of shadowed old CUDA libs wasted per image version on disk. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix(docker): keep CUDA point releases out of the release-churn layer
All checks were successful
ci / test_and_build (pull_request) Successful in 22s
Details
2799e4defe 
The runtime stage's security upgrade ran with the base image's CUDA apt
repo still enabled, so apt-get upgrade pulled point releases of
libcusparse, libcusolver, libnpp, ... -- ~600MB of libraries gllm never
links (it uses only libcudart and libcublasLt). buildah commits the
final stage as a single layer, so every release shipped those upgrades
plus the 13MB binary as one ~533MiB compressed blob that every deploy
re-pulled.

Drop the CUDA sources list before the upgrade: the layer now carries
only the Ubuntu security updates (verified: 14 small packages) and the
binary, cutting the per-release pull to roughly 10-15MiB. CUDA library
updates arrive deliberately via CUDA_VERSION bumps instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
pr-reviewer-bot commented 2026-07-23 08:38:34 +00:00
Collaborator
Copy link

Automated review by pr-reviewer v0.37.0 | Safety Check | Claude Sonnet 5 | tracking id r-61d30a-32e692
This is an AI-generated review and may contain mistakes.

Status: ✅ Completed

⚠️ The primary review (Mistral Small) failed. The review below is from Claude Sonnet 5, which reviewed the same diff.

✅ Verdict: LGTM — Minor, well-scoped Dockerfile fix with no security or runtime concerns; the only nitpick (non-forgiving rm glob) would only affect build robustness, not production behavior.

Small, targeted Dockerfile change: removes the CUDA apt repo list before apt-get upgrade so point releases of unused CUDA libs don't get pulled into the churn layer. Logic is straightforward and matches the stated intent. One minor risk: rm /etc/apt/sources.list.d/cuda*.list (no -f) would fail the build if the glob doesn't match any file (e.g. if the base image ever changes the file naming), but this is a build-time break, easily caught by CI, not a runtime/security issue. No secrets, no unrelated files, no breaking runtime behavior — libcublas/libcudart still come from the base image as before.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.37.0 | Safety Check | Claude Sonnet 5 | tracking id `r-61d30a-32e692`* *This is an AI-generated review and may contain mistakes.* **Status:** ✅ Completed --- > ⚠️ The primary review (**Mistral Small**) failed. The review below is from **Claude Sonnet 5**, which reviewed the same diff. **✅ Verdict: LGTM** — Minor, well-scoped Dockerfile fix with no security or runtime concerns; the only nitpick (non-forgiving rm glob) would only affect build robustness, not production behavior. Small, targeted Dockerfile change: removes the CUDA apt repo list before `apt-get upgrade` so point releases of unused CUDA libs don't get pulled into the churn layer. Logic is straightforward and matches the stated intent. One minor risk: `rm /etc/apt/sources.list.d/cuda*.list` (no `-f`) would fail the build if the glob doesn't match any file (e.g. if the base image ever changes the file naming), but this is a build-time break, easily caught by CI, not a runtime/security issue. No secrets, no unrelated files, no breaking runtime behavior — libcublas/libcudart still come from the base image as before.
rcsheets deleted branch fix/cuda-image-churn 2026-07-23 08:43:59 +00:00
rcsheets changed title from fix(docker): keep CUDA point releases out of the release-churn layer to fix(docker): shrink the per-release pull and stop canaries delaying the push 2026-07-23 08:47:00 +00:00
rcsheets changed title from fix(docker): shrink the per-release pull and stop canaries delaying the push to fix(docker): keep CUDA point releases out of the release-churn layer 2026-07-23 08:48:53 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
brooktrails/gllm!53
No description provided.