Cut Python container sizes by 80%+ automatically using AST dependency segregation & verified multi-stage Dockerfiles. Docker & Rancher Desktop Extension with FinOps.

Blog com notícias sobre, Linux, Android, Segurança , etc

ci: build service images from a single Dockerfile (#5782) * ci: build service images from a single Dockerfile Replace the four per-service Dockerfiles with a root Dockerfile exposing one target per service. The old Dockerfiles listed each service's workspace dependencies by hand, twice, and nothing checked those lists: a missing entry only broke the image build once on main (e.g. b8fdb58b7). - Each service builds from the workspace projects it depends on, as resolved by pnpm. `COPY --from` only invalidates a build stage when those files change, so images of services a commit does not touch stay cached. - `pnpm fetch` only depends on the lockfile, so dependency downloads stay cached across source changes. - `pnpm deploy` writes each service and its production dependencies to a self-contained directory, so images no longer carry the whole workspace. This requires pnpm >= 12.2, hence the pnpm 12 upgrade. - A single build-and-push-images workflow replaces the eight per-service, per-registry ones, with separate GHCR and ECR jobs. `pnpm deploy` copies workspace dependencies according to their `files` field: add it to the two packages missing one, and check it in `pnpm verify`. `@atproto/bsky`'s codegen reads `@atproto/bsync`'s protos, so declare it as a dev dependency. Co-Authored-By: Claude <noreply@anthropic.com> remove need for emudhra workaround (by updating node to a fixed version) ci: build each service image once, with a single TypeScript build Dockerfile: - Build each service following the root `pnpm build` steps, scoped to its production dependencies: the codegen tooling, every `prebuild` script in parallel, a single `tsc --build` of the service's tsconfig.json, and `build:ui` for the PDS. `pnpm run --recursive build` is only safe one package at a time, as each package's `tsc --build` also rebuilds the projects it references, rewriting files that other builds are reading. - Select each service's sources with the repository bind mounted, instead of copying it into a layer that changes, and is exported to the build cache, on every commit. - Drop the OCI labels, which the workflow overrides anyway, and the APK cache. build-and-push-images: - Only the GHCR jobs build the images and write the build cache. The ECR jobs then rebuild them from that cache, also when a GHCR job failed, so each image is built once instead of once per registry. - Keep the builder at the end of each job, as the runner is discarded anyway, and ignore cache export errors instead of failing the push. - Label the images `MIT OR Apache-2.0`, as LICENSE.txt states. - Leave a TODO to authenticate to ECR with OIDC instead of long-lived keys. Also pin pnpm's sha512 in `packageManager`, so that corepack verifies it, and fix the bsky and bsync services' tsconfig.json, whose references were swapped. Co-Authored-By: Claude <noreply@anthropic.com> ci: re-run image builds to check caching Co-Authored-By: Claude <noreply@anthropic.com> ci: run the GHCR and ECR image jobs in parallel Waiting for the GHCR jobs to rebuild the ECR images from their cache saves runner time, but delays every ECR image by the slowest GHCR job. Build both concurrently instead. The GHCR jobs remain the only writers of the build cache, which the ECR jobs would only duplicate. Co-Authored-By: Claude <noreply@anthropic.com> docker buildx bake ci: only deploy the services' runtime files pnpm deploy copied each service's whole directory (tsconfig.json, tsconfig.tsbuildinfo) into its image, along with the pnpm-lock.yaml and pnpm-workspace.yaml it writes for the deployed project, which only pnpm reads. The services now declare their entrypoints in `files`, which verify:package-files also checks, and the pnpm files are removed after the deploy. Co-Authored-By: Claude <noreply@anthropic.com> * ci: check that tsconfig references match workspace dependencies Service images build each service with `tsc --build` of its tsconfig, which only builds the projects its references reach, while the root build references every project and masks a missing reference. Such a reference would only break the image build, on main. `verify:tsconfig-references`, run by `pnpm verify`, checks that each project's build tsconfig references each of its workspace dependencies, and only those. Fix the references it reports, and drop lex-installer's unused `@atproto/did` dependency. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>

Explore the fundamentals of Docker and learn how to containerize a web application through a practical, step-by-step tutorial. This beginner-friendly guide covers Docker architecture, Dockerfiles, image building, container execution, essential commands, and common troubleshooting techniques.

Summary The four per-service Dockerfiles listed each service's workspace dependencies by hand, twice (manifests to keep pnpm install cached, then sources), and nothing checked those lists. A mi...

Summary The per-service Dockerfiles listed every workspace dependency twice (manifests, then sources) to keep pnpm install cached, and nothing checked those lists: #5476, #5660, #5661 and #5745 all...

Migration from Dockerfiles to buildpacks can be straightforward for conventional application set-ups. But Dockerfiles often rely on custom…

Cloud Native Buildpacks, which graduated within the CNCF in July 2026, move base image choice out of per-service Dockerfiles into a single builder owned by platform engineering, enabling fleet-wide pa...

What changes Install dependencies before copying source in the bsky, bsync, pds, and ozone Dockerfiles. Source edits can then reuse the dependency-install layer. Each Dockerfile copies its workspac...

What Happened GitHub expanded two security workflows. AI Scan for pull requests is generally available and can flag potential vulnerabilities in changes to languages and frameworks beyond CodeQL’s current coverage,…

Dockerfile Data Validation Engineer at Turing. Structured fields for skills and pay; the application completes on the employer's side.

A Major Shift in How Deplo Builds Applications Deplo has released v0.6.0-canary.8 on October 24, 2026, introducing a significant change to its application deployment pipeline. The update removes Nixpacks and Static as build options, makes Railpack the replacement for affected applications on their next deployment, and improves how Dockerfiles and Docker Compose projects are detected. The release also introduces migration restoration improvements, a more streamlined settings experience, better repository imports, and fixes for several deployment edge cases.