Prevent unused packages from being pulled into the base image

* e.g. X11 libraries, mysql libraries, mailutils, NTLM libraries

diff --git a/image/base/Dockerfile b/image/base/Dockerfile
index e669ae3ad43f61e153717d7964f279837faaf188..0e6252a81df7ad51b6e683445eac03faf3680500 100644 (file)
--- a/image/base/Dockerfile
+++ b/image/base/Dockerfile
@@ -28,14 +28,17 @@ RUN echo "deb http://apt.postgresql.org/pub/repos/apt/ buster-pgdg main" | \
         tee /etc/apt/sources.list.d/postgres.list
 RUN curl --silent --location https://deb.nodesource.com/setup_10.x | sudo bash -
 RUN apt -y update
-RUN apt -y install build-essential git wget rsync \
+# install these without recommends to avoid pulling in e.g.
+# X11 libraries, mailutils
+RUN apt -y install --no-install-recommends git rsyslog logrotate cron ssh-client
+RUN apt -y install build-essential rsync \
                        libxslt-dev libcurl4-openssl-dev \
                        libssl-dev libyaml-dev libtool \
                        libxml2-dev gawk parallel \
                        postgresql-${PG_MAJOR} postgresql-client-${PG_MAJOR} \
                        postgresql-contrib-${PG_MAJOR} libpq-dev libreadline-dev \
-                       cron anacron \
-                       psmisc rsyslog vim whois brotli libunwind-dev \
+                       anacron wget \
+                       psmisc vim whois brotli libunwind-dev \
                        libtcmalloc-minimal4 cmake
 RUN sed -i -e 's/start -q anacron/anacron -s/' /etc/cron.d/anacron
 RUN sed -i.bak 's/$ModLoad imklog/#$ModLoad imklog/' /etc/rsyslog.conf

diff --git a/image/base/install-nginx b/image/base/install-nginx
index 7b91333fa69905835757626d146468c733ca2367..3c5ede98a90879e113183cfe04ff5ea2ec93e89e 100755 (executable)
--- a/image/base/install-nginx
+++ b/image/base/install-nginx
@@ -22,10 +22,8 @@ curl -O https://nginx.org/download/nginx-$VERSION.tar.gz
 tar zxf nginx-$VERSION.tar.gz
 cd nginx-$VERSION
 
-# so we get nginx user and so on
-apt install -y nginx libpcre3 libpcre3-dev zlib1g zlib1g-dev
-# we don't want to accidentally upgrade nginx and undo our work
-apt-mark hold nginx
+# nginx-common for boilerplate files etc.
+apt install -y nginx-common libpcre3 libpcre3-dev zlib1g zlib1g-dev
 
 # now ngx_brotli has brotli as a submodule
 cd /tmp/ngx_brotli && git submodule update --init && cd /tmp/nginx-$VERSION