From d326d5c111c3a601d57e65ca14f76b47e16f0a7c Mon Sep 17 00:00:00 2001 From: Abrar Shivani Date: Mon, 31 Aug 2026 18:10:46 -0700 Subject: [PATCH] Install packages without docs to reduce image size The UBI base images do not set tsflags in /etc/dnf/dnf.conf, so every dnf install and dnf update we run installs documentation and man pages into the layers we ship. They grow the image for no runtime benefit and get picked up by CI scanners; #772 hit this when the perl docs pulled in by git were flagged for containing sample secrets. Set tsflags=nodocs once per RHEL image, before the first dnf transaction, so every later call inherits it. That covers the installs in install.sh and the CVE_UPDATES blocks, and also the ones nvidia-driver and ocp_dtk_entrypoint run when the container starts, which passing --nodocs per command would have missed. The bases differ in what they provide, so the value is written through dnf's own config writer rather than by editing the file directly: rockylinux 9.8-ubi and 10.2-ubi already ship tsflags=nodocs, so nothing is done; ubi8, ubi9, ubi10 and the CUDA UBI bases have config-manager preinstalled; rockylinux 8.10-ubi has neither and installs it first. Installing config-manager costs about 4 MiB and only happens on rockylinux 8, which is close to end of life. Everywhere else it is free. Signed-off-by: Abrar Shivani --- rhel10/Dockerfile | 4 +++- rhel8/Dockerfile | 5 ++++- rhel9/Dockerfile | 4 +++- vgpu-manager/rhel8/Dockerfile | 3 ++- vgpu-manager/rhel9/Dockerfile | 3 ++- 5 files changed, 14 insertions(+), 5 deletions(-) diff --git a/rhel10/Dockerfile b/rhel10/Dockerfile index f1277c3a1..6af8c78ec 100644 --- a/rhel10/Dockerfile +++ b/rhel10/Dockerfile @@ -35,7 +35,9 @@ ENV TARGETARCH=$TARGETARCH SHELL ["/bin/bash", "-c"] -RUN dnf update -y && dnf clean all +RUN { grep -qE '^tsflags=.*nodocs' /etc/dnf/dnf.conf || \ + dnf config-manager --save --setopt=tsflags=nodocs; } && \ + dnf update -y && dnf clean all #ARG BASE_URL=http://us.download.nvidia.com/XFree86/Linux-x86_64 ARG BASE_URL=https://us.download.nvidia.com/tesla diff --git a/rhel8/Dockerfile b/rhel8/Dockerfile index efe12cb57..727757183 100644 --- a/rhel8/Dockerfile +++ b/rhel8/Dockerfile @@ -34,7 +34,10 @@ ENV TARGETARCH=$TARGETARCH SHELL ["/bin/bash", "-c"] -RUN dnf update -y && dnf clean all +RUN { dnf config-manager --help >/dev/null 2>&1 || \ + dnf install -y --nodocs 'dnf-command(config-manager)'; } && \ + dnf config-manager --save --setopt=tsflags=nodocs && \ + dnf update -y && dnf clean all #ARG BASE_URL=http://us.download.nvidia.com/XFree86/Linux-x86_64 ARG BASE_URL=https://us.download.nvidia.com/tesla diff --git a/rhel9/Dockerfile b/rhel9/Dockerfile index ae1d0f37b..db77e9604 100644 --- a/rhel9/Dockerfile +++ b/rhel9/Dockerfile @@ -34,7 +34,9 @@ ENV TARGETARCH=$TARGETARCH SHELL ["/bin/bash", "-c"] -RUN dnf update -y && dnf clean all +RUN { grep -qE '^tsflags=.*nodocs' /etc/dnf/dnf.conf || \ + dnf config-manager --save --setopt=tsflags=nodocs; } && \ + dnf update -y && dnf clean all #ARG BASE_URL=http://us.download.nvidia.com/XFree86/Linux-x86_64 ARG BASE_URL=https://us.download.nvidia.com/tesla diff --git a/vgpu-manager/rhel8/Dockerfile b/vgpu-manager/rhel8/Dockerfile index bb4f5b470..c34958554 100644 --- a/vgpu-manager/rhel8/Dockerfile +++ b/vgpu-manager/rhel8/Dockerfile @@ -23,7 +23,8 @@ RUN chmod +x NVIDIA-Linux-${DRIVER_ARCH}-${DRIVER_VERSION}-vgpu-kvm.run COPY nvidia-driver /usr/local/bin COPY ocp_dtk_entrypoint /usr/local/bin -RUN dnf install -y pciutils && \ +RUN dnf config-manager --save --setopt=tsflags=nodocs && \ + dnf install -y pciutils && \ dnf clean all && \ rm -rf /var/cache/dnf/* diff --git a/vgpu-manager/rhel9/Dockerfile b/vgpu-manager/rhel9/Dockerfile index 2a1ae8520..526e3b5f5 100644 --- a/vgpu-manager/rhel9/Dockerfile +++ b/vgpu-manager/rhel9/Dockerfile @@ -36,7 +36,8 @@ RUN chmod +x NVIDIA-Linux-${DRIVER_ARCH}-${DRIVER_VERSION}-vgpu-kvm.run COPY nvidia-driver /usr/local/bin COPY ocp_dtk_entrypoint /usr/local/bin -RUN dnf install -y pciutils && \ +RUN dnf config-manager --save --setopt=tsflags=nodocs && \ + dnf install -y pciutils && \ dnf clean all && \ rm -rf /var/cache/dnf/*