Make the nodejs image smaller
Hi all,
cool project. I am following several efforts to have a good small nodejs image and blogged about this here: https://blog.riemann.cc/digitalisation/2025/10/26/distroless-containers-nix-flakes-vs-fedora/
| REPOSITORY | TAG | MAGE ID | CREATED | SIZE |
|------------|-----|---------|---------|-----:|
| localhost/fedora-micro-nodejs | latest | df43085da156 | 47 seconds ago | 134 MB |
| registry.opencode.de/open-code/oci/nodejs | 22 | db0046e37ec6 | 55 years ago | 157 MB |
| \quay.io/hummingbird/nodejs (Fedora-based) | latest | e05bec4f638e | | 259 MB |
Containerfile for fedora-micro-nodejs:
~~~Dockerfile
# kate: hl Containerfile;
ARG ROOTFS="/mnt/rootfs"
ARG HOME=/home/nonroot
ARG DNF="dnf"
ARG RELEASEVER="42"
FROM quay.io/fedora/fedora-minimal:42
# alternatively:
# ARG RELEASEVER="9"
# FROM registry.access.redhat.com/ubi9/ubi-minimal
# or
# ARG RELEASEVER="10"
# FROM quay.io/almalinuxorg/10-minimal:10.0
ARG ROOTFS
ARG DNF
ARG RELEASEVER
ARG DNF_OPTS="--installroot=${ROOTFS} --releasever=${RELEASEVER} --noplugins --config=/etc/dnf/dnf.conf --setopt=install_weak_deps=0 --setopt=cachedir=/var/cache/$DNF --setopt=keepcache=1 --setopt=reposdir=/etc/yum.repos.d --setopt=varsdir=/etc/dnf"
USER root
# pinning of software versions possible with https://dnf5.readthedocs.io/en/latest/dnf5_plugins/manifest.8.html
# (see also: https://github.com/rpm-software-management/dnf5/pull/2425)
RUN --mount=type=cache,target=/var/cache/$DNF \
mkdir -p ${ROOTFS} && \
$DNF ${DNF_OPTS} -y --nodocs install nodejs22
FROM scratch
ARG ROOTFS
ARG HOME
COPY --from=base ${ROOTFS} /
RUN \
mkdir -p $HOME && \
printf "nonroot:x:1001:\n" >> /etc/group && \
printf "nonroot:x:1001:1001:Nonroot User:/home/nonroot:/sbin/nologin\n" >> /etc/passwd && \
printf "nonroot:!:20386::::::\n" >> /etc/shadow && \
chown -R 1001:1001 $HOME && \
chmod -R g=u $HOME
USER 1001
WORKDIR $HOME
ENTRYPOINT ["/bin/bash"]
~~~
So why is your container 259 MB when my fedora-micro is only 134MB?
I think the container can be made even smalle if ca-certificates would not pull so many dependencies. I have created a bug report here about this:
https://bugzilla.redhat.com/show_bug.cgi?id=2406418
Unfortunately, not yet a reaction yet.
issue