Install packages without docs to reduce image size - #897
Open
abrarshivani wants to merge 1 commit into
Open
Conversation
abrarshivani
force-pushed
the
fix/install-packages-nodocs
branch
8 times, most recently
from
August 4, 2026 02:21
aaab24e to
a301308
Compare
abrarshivani
force-pushed
the
fix/install-packages-nodocs
branch
from
August 4, 2026 03:18
a301308 to
b102cbc
Compare
abrarshivani
marked this pull request as ready for review
August 4, 2026 03:22
rahulait
reviewed
Aug 4, 2026
Contributor
|
Thanks @abrarshivani. This change LGTM, lets wait for some time before we merge this PR as we don't want these changes to affect existing release in progress. |
abrarshivani
force-pushed
the
fix/install-packages-nodocs
branch
from
August 4, 2026 20:00
b102cbc to
0e1cf09
Compare
Contributor
Author
|
@rahulait Sounds good. Let's merge this after release. |
Contributor
|
What is the difference in image size before and after this change? |
Contributor
Author
@tariq1890 Following are difference in image sizes:
|
tariq1890
reviewed
Aug 10, 2026
| - release-* | ||
|
|
||
| jobs: | ||
| check-nodocs: |
Contributor
There was a problem hiding this comment.
I don't think this is necessary. If we want to establish a policy of never downloading docs when building images, we could explore that separately. For now, we don't have to add an extra step to our CIs
tariq1890
reviewed
Aug 10, 2026
| SHELL ["/bin/bash", "-c"] | ||
|
|
||
| RUN dnf update -y && dnf clean all | ||
| RUN dnf update -y --nodocs && dnf clean all |
Contributor
There was a problem hiding this comment.
Can we disable docs in a dnf.conf file so that we express this preference once instead of doing so in every dnf command?
abrarshivani
force-pushed
the
fix/install-packages-nodocs
branch
3 times, most recently
from
September 1, 2026 01:19
7a69aca to
b222616
Compare
The UBI base images do not set tsflags in /etc/dnf/dnf.conf, so every dnf install and dnf update we run installs documentation and man pages into the layers we ship. They grow the image for no runtime benefit and get picked up by CI scanners; NVIDIA#772 hit this when the perl docs pulled in by git were flagged for containing sample secrets. Set tsflags=nodocs once per RHEL image, before the first dnf transaction, so every later call inherits it. That covers the installs in install.sh and the CVE_UPDATES blocks, and also the ones nvidia-driver and ocp_dtk_entrypoint run when the container starts, which passing --nodocs per command would have missed. The bases differ in what they provide, so the value is written through dnf's own config writer rather than by editing the file directly: rockylinux 9.8-ubi and 10.2-ubi already ship tsflags=nodocs, so nothing is done; ubi8, ubi9, ubi10 and the CUDA UBI bases have config-manager preinstalled; rockylinux 8.10-ubi has neither and installs it first. Installing config-manager costs about 4 MiB and only happens on rockylinux 8, which is close to end of life. Everywhere else it is free. Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
abrarshivani
force-pushed
the
fix/install-packages-nodocs
branch
from
September 1, 2026 01:49
b222616 to
d326d5c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #773
What
Set
tsflags=nodocsonce per RHEL image so dnf stops writing documentation and man pages into the layers we ship.Why
The UBI bases don't set
tsflagsin/etc/dnf/dnf.conf, so everydnf install/dnf updatewe run installs documentation with the package. It grows the image and gets flagged by CI scanners — #772 hit this with perl docs containing sample secrets. The bases themselves are clean, so the docs all come from our own install steps.How
Folded into the first dnf transaction of each image, so everything after it inherits the setting: the installs in
install.sh, theCVE_UPDATESblocks, and thednf installcallsnvidia-driverandocp_dtk_entrypointmake when the container starts. Passing--nodocsper command would have missed those and needed the flag on ~46 call sites.Each Dockerfile only handles the bases it is actually built with, and the value is written through dnf's own config writer rather than by editing the file:
config-managertsflagsbeforerhel9,rhel10rhel8vgpu-manager/rhel8,rhel9Installing
config-managercosts about 4 MiB and only happens on rockylinux 8, which is close to end of life. Everywhere else it is already present.Notes
/etc/dpkg/dpkg.cfg.d/excludes, which already drops/usr/share/docand/usr/share/man. This is RHEL only.rm -rf /usr/share/doc/*ininstall.shstays.nodocsdoesn't cover files shipped without a%docmarker or written outside rpm.nvcr.io/nvidia/cuda:*-base-ubi8/9, which already has documentation in its parent layers. This only stops documentation from the transactions we run.install_weak_deps=Falseleft out: it's what actually kept the perl docs out in avoid installing docs in image #772, but it can silently drop a package needed at runtime. Possible follow up.Testing
Verified on every base image that the change lands on
tsflags=nodocs: ubi8, ubi9, ubi10, rockylinux 8.10/9.8/10.2-ubi, and the CUDA UBI 8 and 9 bases.Built for driver
580.178.04, each pair back to back with--no-cacheso both resolve the same packages:rocky8 saves more despite installing
config-manager, because it starts with more documentation. In its filesystem/usr/share/mangoes from 1289 files to 1 (a dangling symlink) and/usr/share/infofrom 32 to 1, while all 226/usr/share/licensesfiles are untouched./usr/share/docis empty either way, since the existingrm -rfalready cleared it. rhel9 behaves the same, with its 237 license files intact.