osobh/clawmates
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

perf(image): drop chromium from the server image — 875 MB to 212 MB
deploy / test (push) Successful in 4m0s
Details
deploy / build (push) Successful in 1m41s
Details

Browse Source 
Chromium and fonts-liberation were 758 MB of an 875 MB image: 87% of the server
image was a browser it never launched.

It was installed for the Slice 6 mission PDF renderer, which no longer exists —
every call site passes `render_pdf: false` because markdown is the deliverable —
and NOTHING in the workspace reads the CHROMIUM_BIN this image set. The only
Chromium the platform actually uses is `browser.goto`, which runs it inside the
agent's dedicated egress-enabled BROWSER container
(cm-runtime/src/tools/browser.rs), never in the server.

Measured on gw-04: 875 MB -> 212 MB. The remainder is debian-slim (75 MB), git
and its dependencies (~95 MB) and the server binary (42 MB). git stays: research
topic clones shell out to it, which is why this image left distroless in the
first place.

Verified in the slimmed image: git 2.39.5 present, CA bundle present, chromium
absent, binary executable, templates and all 8 skills shipped.

That 663 MB was paid on every deploy, every registry push, and every air-gapped
bundle.

Co-Authored-By: Claude Opus 5 <[email protected]>
This commit is contained in:
Omar Sobh
2026-08-13 21:24:01 -07:00
co-authored by Claude Opus 5
parent 4d07868410
commit eb120a10dd
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
images/server.Dockerfile
+9 -6
View File
@@ -44,16 +44,19 @@ FROM debian:12-slim
# a git binary; every wizard-materialized research topic silently failed # a git binary; every wizard-materialized research topic silently failed
# to clone until this change. # to clone until this change.
# ca-certificates — required by `git clone` over HTTPS. # ca-certificates — required by `git clone` over HTTPS.
# chromium — headless print-to-pdf for the mission PDF renderer #
# (Slice 6). Ships fonts-liberation so text renders sanely without # NO chromium. It was here for the Slice 6 mission PDF renderer, which is gone:
# hitting the web for a font. Set CHROMIUM_BIN=/usr/bin/chromium # every call site passes `render_pdf: false` (markdown is the deliverable), and
# if the invoking process picks a different name. # NOTHING reads the CHROMIUM_BIN this image used to set — the only Chromium in
# the platform is `browser.goto`, which runs it inside the agent's dedicated
# egress-enabled BROWSER container (cm-runtime/src/tools/browser.rs), never
# here. It cost **758 MB of an 875 MB image**: chromium + fonts-liberation were
# 87% of the server image, shipped on every deploy, every registry push, and
# every air-gapped bundle.
RUN apt-get update \ RUN apt-get update \
&& apt-get install -y --no-install-recommends git ca-certificates \ && apt-get install -y --no-install-recommends git ca-certificates \
chromium fonts-liberation \
&& rm -rf /var/lib/apt/lists/* \ && rm -rf /var/lib/apt/lists/* \
&& useradd -u 65532 -M -s /usr/sbin/nologin nonroot && useradd -u 65532 -M -s /usr/sbin/nologin nonroot
ENV CHROMIUM_BIN=/usr/bin/chromium
COPY --from=builder /clawmates-server /usr/local/bin/clawmates-server COPY --from=builder /clawmates-server /usr/local/bin/clawmates-server
# Builtin templates (team + workflow). Loader upserts them on boot. # Builtin templates (team + workflow). Loader upserts them on boot.
COPY templates /etc/clawmates/templates COPY templates /etc/clawmates/templates