From 91f1f413670b974697240d72d333282266990aa0 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 10 Jun 2026 08:35:39 +0000 Subject: [PATCH] build(docker): drop libpq runtime dep and postgresql-dev build dep sqlx's postgres driver implements the wire protocol in pure Rust and TLS goes through rustls, so libpq is never linked. Confirmed via Cargo.lock: no pq-sys, native-tls, or openssl-sys in the dependency tree. Removing postgresql-dev from the build base and libpq from the runtime image shrinks the final image by ~3 MB and removes a C library from the attack/patch surface. perl/make/gcc/musl-dev are kept for the C builds of aws-lc-sys. https://claude.ai/code/session_01GpprjxjtXFYLfXNkoKnHuL --- Dockerfile | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 59dc48e2..e50b8107 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,10 @@ # ─── Stage 1: Shared build base (avoids duplicate apk install) ──────────────── FROM rust:1.94.1-alpine3.23 AS base +# sqlx's postgres driver speaks the wire protocol in pure Rust (no pq-sys in +# Cargo.lock) and TLS goes through rustls, so libpq headers are never needed at +# build time. perl/make/gcc/musl-dev remain for the C builds of aws-lc-sys. RUN apk --no-cache upgrade && \ - apk add --no-cache musl-dev pkgconfig postgresql-dev gcc perl make + apk add --no-cache musl-dev pkgconfig gcc perl make # ─── Stage 2: Cache dependencies ───────────────────────────────────────────── FROM base AS cacher @@ -49,9 +52,10 @@ LABEL org.opencontainers.image.title="OxiCloud" \ org.opencontainers.image.licenses="MIT" # Install only necessary runtime dependencies and update packages -# su-exec is needed by the entrypoint to drop privileges after fixing volume permissions +# su-exec is needed by the entrypoint to drop privileges after fixing volume permissions. +# No libpq: the pure-Rust sqlx postgres driver never links it. RUN apk --no-cache upgrade && \ - apk add --no-cache libgcc ca-certificates libpq tzdata su-exec && \ + apk add --no-cache libgcc ca-certificates tzdata su-exec && \ addgroup -g 1001 -S oxicloud && \ adduser -u 1001 -S oxicloud -G oxicloud