refactor(docker): slim multi-stage build, drop image size by ~58% by matrixise · Pull Request #233 · PythonIreland/website

matrixise · 2026-06-11T19:44:14Z

Summary

Reworks the Dockerfile into a real two-stage build and trims the image from ~1.69 GB to ~715 MB (-58%).

Changes

Real multi-stage: a builder stage (python:3.13-slim + build toolchain) installs every requirement into an isolated venv at /opt/venv; the final dev stage (python:3.13-slim) copies only that venv plus runtime/interactive tooling. build-essential/gcc no longer ship in the final image.
Base image: python:3.13 → python:3.13-slim.
Drop the stray aws package from the install line. It is an abandoned junk PyPI package, not the AWS CLI; boto3 already provides the AWS SDK.
Stop reinstalling ruff via pip -U — it is already pinned in dev.txt.
ADD → COPY for the requirements files.
apt cache mounts on /var/lib/apt/lists with sharing=locked.
New .dockerignore to shrink the build context and keep .env/secrets out of it.

The final dev stage stays the last stage, so docker build -t python.ie/website-dev . (used by task docker:build, no --target) keeps producing the image consumed by both the web and test compose services.

Validation

docker build succeeds.
Smoke tests inside the image: Python 3.13 from the venv, Django 6.0.6, Wagtail 7.3.2, redis client 8.0.0, boto3 1.43.26, fish 4.0.2, psql 17.10, ruff 0.15.16.
python pythonie/manage.py check --settings=pythonie.settings.tests reports 0 issues with the source mounted.

Image size: 1.69 GB → 715 MB.

Rework the Dockerfile into a real two-stage build: - builder stage: python:3.13-slim + build toolchain, installs all requirements into an isolated venv at /opt/venv - dev stage: python:3.13-slim with only runtime packages (postgresql-client) and the interactive tooling the dev shell needs (fish, neovim, less, ack, iputils-ping), copying the venv from the builder The build toolchain (build-essential, gcc) no longer ships in the final image, cutting it from ~1.69GB to ~715MB. Other fixes: - drop the stray `aws` package from the install line (junk PyPI package; boto3 already provides the AWS SDK) - stop reinstalling ruff via pip -U (it is already pinned in dev.txt) - switch ADD to COPY for the requirements files - add apt cache mounts for /var/lib/apt/lists with sharing=locked - add a .dockerignore to shrink the build context and keep .env/secrets out Add a .dockerignore covering VCS, Python caches, local databases, env files and tooling output.

matrixise · 2026-06-11T19:44:14Z

Summary

Reworks the Dockerfile into a real two-stage build and trims the image from ~1.69 GB to ~715 MB (-58%).

Changes

Real multi-stage: a builder stage (python:3.13-slim + build toolchain) installs every requirement into an isolated venv at /opt/venv; the final dev stage (python:3.13-slim) copies only that venv plus runtime/interactive tooling. build-essential/gcc no longer ship in the final image.
Base image: python:3.13 → python:3.13-slim.
Drop the stray aws package from the install line. It is an abandoned junk PyPI package, not the AWS CLI; boto3 already provides the AWS SDK.
Stop reinstalling ruff via pip -U — it is already pinned in dev.txt.
ADD → COPY for the requirements files.
apt cache mounts on /var/lib/apt/lists with sharing=locked.
New .dockerignore to shrink the build context and keep .env/secrets out of it.

The final dev stage stays the last stage, so docker build -t python.ie/website-dev . (used by task docker:build, no --target) keeps producing the image consumed by both the web and test compose services.

Validation

docker build succeeds.
Smoke tests inside the image: Python 3.13 from the venv, Django 6.0.6, Wagtail 7.3.2, redis client 8.0.0, boto3 1.43.26, fish 4.0.2, psql 17.10, ruff 0.15.16.
python pythonie/manage.py check --settings=pythonie.settings.tests reports 0 issues with the source mounted.

Image size: 1.69 GB → 715 MB.

Rework the Dockerfile into a real two-stage build: - builder stage: python:3.13-slim + build toolchain, installs all requirements into an isolated venv at /opt/venv - dev stage: python:3.13-slim with only runtime packages (postgresql-client) and the interactive tooling the dev shell needs (fish, neovim, less, ack, iputils-ping), copying the venv from the builder The build toolchain (build-essential, gcc) no longer ships in the final image, cutting it from ~1.69GB to ~715MB. Other fixes: - drop the stray `aws` package from the install line (junk PyPI package; boto3 already provides the AWS SDK) - stop reinstalling ruff via pip -U (it is already pinned in dev.txt) - switch ADD to COPY for the requirements files - add apt cache mounts for /var/lib/apt/lists with sharing=locked - add a .dockerignore to shrink the build context and keep .env/secrets out Add a .dockerignore covering VCS, Python caches, local databases, env files and tooling output.

matrixise · 2026-06-11T19:44:14Z

Summary

Reworks the Dockerfile into a real two-stage build and trims the image from ~1.69 GB to ~715 MB (-58%).

Changes

Real multi-stage: a builder stage (python:3.13-slim + build toolchain) installs every requirement into an isolated venv at /opt/venv; the final dev stage (python:3.13-slim) copies only that venv plus runtime/interactive tooling. build-essential/gcc no longer ship in the final image.
Base image: python:3.13 → python:3.13-slim.
Drop the stray aws package from the install line. It is an abandoned junk PyPI package, not the AWS CLI; boto3 already provides the AWS SDK.
Stop reinstalling ruff via pip -U — it is already pinned in dev.txt.
ADD → COPY for the requirements files.
apt cache mounts on /var/lib/apt/lists with sharing=locked.
New .dockerignore to shrink the build context and keep .env/secrets out of it.

The final dev stage stays the last stage, so docker build -t python.ie/website-dev . (used by task docker:build, no --target) keeps producing the image consumed by both the web and test compose services.

Validation

docker build succeeds.
Smoke tests inside the image: Python 3.13 from the venv, Django 6.0.6, Wagtail 7.3.2, redis client 8.0.0, boto3 1.43.26, fish 4.0.2, psql 17.10, ruff 0.15.16.
python pythonie/manage.py check --settings=pythonie.settings.tests reports 0 issues with the source mounted.

Image size: 1.69 GB → 715 MB.

Rework the Dockerfile into a real two-stage build: - builder stage: python:3.13-slim + build toolchain, installs all requirements into an isolated venv at /opt/venv - dev stage: python:3.13-slim with only runtime packages (postgresql-client) and the interactive tooling the dev shell needs (fish, neovim, less, ack, iputils-ping), copying the venv from the builder The build toolchain (build-essential, gcc) no longer ships in the final image, cutting it from ~1.69GB to ~715MB. Other fixes: - drop the stray `aws` package from the install line (junk PyPI package; boto3 already provides the AWS SDK) - stop reinstalling ruff via pip -U (it is already pinned in dev.txt) - switch ADD to COPY for the requirements files - add apt cache mounts for /var/lib/apt/lists with sharing=locked - add a .dockerignore to shrink the build context and keep .env/secrets out Add a .dockerignore covering VCS, Python caches, local databases, env files and tooling output.

matrixise · 2026-06-11T19:44:14Z

Summary

Reworks the Dockerfile into a real two-stage build and trims the image from ~1.69 GB to ~715 MB (-58%).

Changes

Real multi-stage: a builder stage (python:3.13-slim + build toolchain) installs every requirement into an isolated venv at /opt/venv; the final dev stage (python:3.13-slim) copies only that venv plus runtime/interactive tooling. build-essential/gcc no longer ship in the final image.
Base image: python:3.13 → python:3.13-slim.
Drop the stray aws package from the install line. It is an abandoned junk PyPI package, not the AWS CLI; boto3 already provides the AWS SDK.
Stop reinstalling ruff via pip -U — it is already pinned in dev.txt.
ADD → COPY for the requirements files.
apt cache mounts on /var/lib/apt/lists with sharing=locked.
New .dockerignore to shrink the build context and keep .env/secrets out of it.

The final dev stage stays the last stage, so docker build -t python.ie/website-dev . (used by task docker:build, no --target) keeps producing the image consumed by both the web and test compose services.

Validation

docker build succeeds.
Smoke tests inside the image: Python 3.13 from the venv, Django 6.0.6, Wagtail 7.3.2, redis client 8.0.0, boto3 1.43.26, fish 4.0.2, psql 17.10, ruff 0.15.16.
python pythonie/manage.py check --settings=pythonie.settings.tests reports 0 issues with the source mounted.

Image size: 1.69 GB → 715 MB.

Rework the Dockerfile into a real two-stage build: - builder stage: python:3.13-slim + build toolchain, installs all requirements into an isolated venv at /opt/venv - dev stage: python:3.13-slim with only runtime packages (postgresql-client) and the interactive tooling the dev shell needs (fish, neovim, less, ack, iputils-ping), copying the venv from the builder The build toolchain (build-essential, gcc) no longer ships in the final image, cutting it from ~1.69GB to ~715MB. Other fixes: - drop the stray `aws` package from the install line (junk PyPI package; boto3 already provides the AWS SDK) - stop reinstalling ruff via pip -U (it is already pinned in dev.txt) - switch ADD to COPY for the requirements files - add apt cache mounts for /var/lib/apt/lists with sharing=locked - add a .dockerignore to shrink the build context and keep .env/secrets out Add a .dockerignore covering VCS, Python caches, local databases, env files and tooling output.

matrixise · 2026-06-11T19:44:14Z

Summary

Reworks the Dockerfile into a real two-stage build and trims the image from ~1.69 GB to ~715 MB (-58%).

Changes

Real multi-stage: a builder stage (python:3.13-slim + build toolchain) installs every requirement into an isolated venv at /opt/venv; the final dev stage (python:3.13-slim) copies only that venv plus runtime/interactive tooling. build-essential/gcc no longer ship in the final image.
Base image: python:3.13 → python:3.13-slim.
Drop the stray aws package from the install line. It is an abandoned junk PyPI package, not the AWS CLI; boto3 already provides the AWS SDK.
Stop reinstalling ruff via pip -U — it is already pinned in dev.txt.
ADD → COPY for the requirements files.
apt cache mounts on /var/lib/apt/lists with sharing=locked.
New .dockerignore to shrink the build context and keep .env/secrets out of it.

The final dev stage stays the last stage, so docker build -t python.ie/website-dev . (used by task docker:build, no --target) keeps producing the image consumed by both the web and test compose services.

Validation

docker build succeeds.
Smoke tests inside the image: Python 3.13 from the venv, Django 6.0.6, Wagtail 7.3.2, redis client 8.0.0, boto3 1.43.26, fish 4.0.2, psql 17.10, ruff 0.15.16.
python pythonie/manage.py check --settings=pythonie.settings.tests reports 0 issues with the source mounted.

Image size: 1.69 GB → 715 MB.

Rework the Dockerfile into a real two-stage build: - builder stage: python:3.13-slim + build toolchain, installs all requirements into an isolated venv at /opt/venv - dev stage: python:3.13-slim with only runtime packages (postgresql-client) and the interactive tooling the dev shell needs (fish, neovim, less, ack, iputils-ping), copying the venv from the builder The build toolchain (build-essential, gcc) no longer ships in the final image, cutting it from ~1.69GB to ~715MB. Other fixes: - drop the stray `aws` package from the install line (junk PyPI package; boto3 already provides the AWS SDK) - stop reinstalling ruff via pip -U (it is already pinned in dev.txt) - switch ADD to COPY for the requirements files - add apt cache mounts for /var/lib/apt/lists with sharing=locked - add a .dockerignore to shrink the build context and keep .env/secrets out Add a .dockerignore covering VCS, Python caches, local databases, env files and tooling output.

matrixise · 2026-06-11T19:44:14Z

Summary

Reworks the Dockerfile into a real two-stage build and trims the image from ~1.69 GB to ~715 MB (-58%).

Changes

Real multi-stage: a builder stage (python:3.13-slim + build toolchain) installs every requirement into an isolated venv at /opt/venv; the final dev stage (python:3.13-slim) copies only that venv plus runtime/interactive tooling. build-essential/gcc no longer ship in the final image.
Base image: python:3.13 → python:3.13-slim.
Drop the stray aws package from the install line. It is an abandoned junk PyPI package, not the AWS CLI; boto3 already provides the AWS SDK.
Stop reinstalling ruff via pip -U — it is already pinned in dev.txt.
ADD → COPY for the requirements files.
apt cache mounts on /var/lib/apt/lists with sharing=locked.
New .dockerignore to shrink the build context and keep .env/secrets out of it.

The final dev stage stays the last stage, so docker build -t python.ie/website-dev . (used by task docker:build, no --target) keeps producing the image consumed by both the web and test compose services.

Validation

docker build succeeds.
Smoke tests inside the image: Python 3.13 from the venv, Django 6.0.6, Wagtail 7.3.2, redis client 8.0.0, boto3 1.43.26, fish 4.0.2, psql 17.10, ruff 0.15.16.
python pythonie/manage.py check --settings=pythonie.settings.tests reports 0 issues with the source mounted.

Image size: 1.69 GB → 715 MB.

Rework the Dockerfile into a real two-stage build: - builder stage: python:3.13-slim + build toolchain, installs all requirements into an isolated venv at /opt/venv - dev stage: python:3.13-slim with only runtime packages (postgresql-client) and the interactive tooling the dev shell needs (fish, neovim, less, ack, iputils-ping), copying the venv from the builder The build toolchain (build-essential, gcc) no longer ships in the final image, cutting it from ~1.69GB to ~715MB. Other fixes: - drop the stray `aws` package from the install line (junk PyPI package; boto3 already provides the AWS SDK) - stop reinstalling ruff via pip -U (it is already pinned in dev.txt) - switch ADD to COPY for the requirements files - add apt cache mounts for /var/lib/apt/lists with sharing=locked - add a .dockerignore to shrink the build context and keep .env/secrets out Add a .dockerignore covering VCS, Python caches, local databases, env files and tooling output.

matrixise · 2026-06-11T19:44:14Z

Summary

Reworks the Dockerfile into a real two-stage build and trims the image from ~1.69 GB to ~715 MB (-58%).

Changes

Real multi-stage: a builder stage (python:3.13-slim + build toolchain) installs every requirement into an isolated venv at /opt/venv; the final dev stage (python:3.13-slim) copies only that venv plus runtime/interactive tooling. build-essential/gcc no longer ship in the final image.
Base image: python:3.13 → python:3.13-slim.
Drop the stray aws package from the install line. It is an abandoned junk PyPI package, not the AWS CLI; boto3 already provides the AWS SDK.
Stop reinstalling ruff via pip -U — it is already pinned in dev.txt.
ADD → COPY for the requirements files.
apt cache mounts on /var/lib/apt/lists with sharing=locked.
New .dockerignore to shrink the build context and keep .env/secrets out of it.

The final dev stage stays the last stage, so docker build -t python.ie/website-dev . (used by task docker:build, no --target) keeps producing the image consumed by both the web and test compose services.

Validation

docker build succeeds.
Smoke tests inside the image: Python 3.13 from the venv, Django 6.0.6, Wagtail 7.3.2, redis client 8.0.0, boto3 1.43.26, fish 4.0.2, psql 17.10, ruff 0.15.16.
python pythonie/manage.py check --settings=pythonie.settings.tests reports 0 issues with the source mounted.

Image size: 1.69 GB → 715 MB.

Rework the Dockerfile into a real two-stage build: - builder stage: python:3.13-slim + build toolchain, installs all requirements into an isolated venv at /opt/venv - dev stage: python:3.13-slim with only runtime packages (postgresql-client) and the interactive tooling the dev shell needs (fish, neovim, less, ack, iputils-ping), copying the venv from the builder The build toolchain (build-essential, gcc) no longer ships in the final image, cutting it from ~1.69GB to ~715MB. Other fixes: - drop the stray `aws` package from the install line (junk PyPI package; boto3 already provides the AWS SDK) - stop reinstalling ruff via pip -U (it is already pinned in dev.txt) - switch ADD to COPY for the requirements files - add apt cache mounts for /var/lib/apt/lists with sharing=locked - add a .dockerignore to shrink the build context and keep .env/secrets out Add a .dockerignore covering VCS, Python caches, local databases, env files and tooling output.

matrixise · 2026-06-11T19:44:14Z

Summary

Reworks the Dockerfile into a real two-stage build and trims the image from ~1.69 GB to ~715 MB (-58%).

Changes

Real multi-stage: a builder stage (python:3.13-slim + build toolchain) installs every requirement into an isolated venv at /opt/venv; the final dev stage (python:3.13-slim) copies only that venv plus runtime/interactive tooling. build-essential/gcc no longer ship in the final image.
Base image: python:3.13 → python:3.13-slim.
Drop the stray aws package from the install line. It is an abandoned junk PyPI package, not the AWS CLI; boto3 already provides the AWS SDK.
Stop reinstalling ruff via pip -U — it is already pinned in dev.txt.
ADD → COPY for the requirements files.
apt cache mounts on /var/lib/apt/lists with sharing=locked.
New .dockerignore to shrink the build context and keep .env/secrets out of it.

The final dev stage stays the last stage, so docker build -t python.ie/website-dev . (used by task docker:build, no --target) keeps producing the image consumed by both the web and test compose services.

Validation

docker build succeeds.
Smoke tests inside the image: Python 3.13 from the venv, Django 6.0.6, Wagtail 7.3.2, redis client 8.0.0, boto3 1.43.26, fish 4.0.2, psql 17.10, ruff 0.15.16.
python pythonie/manage.py check --settings=pythonie.settings.tests reports 0 issues with the source mounted.

Image size: 1.69 GB → 715 MB.

Rework the Dockerfile into a real two-stage build: - builder stage: python:3.13-slim + build toolchain, installs all requirements into an isolated venv at /opt/venv - dev stage: python:3.13-slim with only runtime packages (postgresql-client) and the interactive tooling the dev shell needs (fish, neovim, less, ack, iputils-ping), copying the venv from the builder The build toolchain (build-essential, gcc) no longer ships in the final image, cutting it from ~1.69GB to ~715MB. Other fixes: - drop the stray `aws` package from the install line (junk PyPI package; boto3 already provides the AWS SDK) - stop reinstalling ruff via pip -U (it is already pinned in dev.txt) - switch ADD to COPY for the requirements files - add apt cache mounts for /var/lib/apt/lists with sharing=locked - add a .dockerignore to shrink the build context and keep .env/secrets out Add a .dockerignore covering VCS, Python caches, local databases, env files and tooling output.

Uh oh!

Conversation

matrixise commented Jun 11, 2026

Summary

Changes

Validation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

matrixise commented Jun 11, 2026

Summary

Changes

Validation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

matrixise commented Jun 11, 2026

Summary

Changes

Validation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

matrixise commented Jun 11, 2026

Summary

Changes

Validation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

matrixise commented Jun 11, 2026

Summary

Changes

Validation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

matrixise commented Jun 11, 2026

Summary

Changes