Skip to content

fix: clean dnf/yum cache after libicu install in Lambda runtime images (#2594) - #2595

Draft
normj wants to merge 2 commits into
masterfrom
normj/dockerfile-yum-cache-cleanup
Draft

normj wants to merge 2 commits into
masterfrom
normj/dockerfile-yum-cache-cleanup

Conversation

@normj

@normj normj commented Oct 16, 2026

Copy link
Copy Markdown
Member

Issue #, if available

Fixes #2594

Description of changes

The base stage of every published Lambda runtime Dockerfile installs libicu via dnf without cleaning the package-manager cache:

FROM $AMAZON_LINUX AS base
RUN dnf install libicu-67.1-7.amzn2023.0.4.<arch> --assumeyes

Because the final published image stage is FROM base, it inherits that cache layer, baking roughly 170 MB of dnf/yum repository metadata into the shipped image (the .solv/.solvx solver caches and filelists.xml.gz). Deleting the cache in a downstream layer cannot reclaim those bytes — the whiteout only hides them while the earlier layer still carries them.

This PR cleans the cache in the same RUN instruction that installs libicu, so the metadata never lands in the committed layer:

RUN dnf install libicu-67.1-7.amzn2023.0.4.<arch> --assumeyes && \
    dnf clean all && \
    rm -rf /var/cache/dnf /var/cache/yum

Although the issue was filed against net10/arm64, the same uncleaned install exists in every published runtime Dockerfile, so the fix is applied across all eight:

Version amd64 arm64
net8 ✅ ✅
net9 ✅ ✅
net10 ✅ ✅
net11 ✅ ✅

No runtime behavior changes — this only removes build-time package-manager cache that is dead weight at runtime, reducing image size and pull times for downstream consumers.

Checklist

  • I have updated the changelog with a description of my changes (if applicable)
  • I have read the CONTRIBUTING document
  • Local run of the build and tests pass

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

normj added 2 commits October 16, 2026 18:43
The base stage of every published Lambda runtime Dockerfile installs
libicu via dnf without cleaning the package-manager cache. Because the
final published image stage is FROM base, it inherits that cache layer,
baking ~170 MB of dnf/yum repository metadata (solv/solvx solver caches
and filelists.xml.gz) into the shipped image. Deleting the cache in a
downstream layer cannot reclaim those bytes.

Clean the cache in the same RUN instruction that installs libicu so the
metadata never lands in the committed layer. Applied across all eight
published Dockerfiles (net8, net9, net10, net11 x amd64, arm64).

Fixes #2594
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

.NET 10 Lambda ARM64 base image retains ~170 MB of Yum metadata after libicu installation

1 participant