roryqi opened a new issue, #11532: URL: https://github.com/apache/gravitino/issues/11532
### Version main branch ### Describe what's wrong The Dockerfiles for `gravitino`, `iceberg-rest-server` and `lance-rest-server` run a recursive `RUN chmod -R g+rwX <app-dir>` right after `COPY`-ing the application tree. Under the OverlayFS storage driver, changing a file's mode copies the whole file up into the `RUN` layer, so the entire application tree is stored **twice** — once in the COPY layer and again in the chmod layer. This roughly doubles the published image size. For example the `gravitino` image carries a ~1.9 GB COPY layer plus a redundant ~1.9 GB chmod layer. ### Error message and/or stacktrace `docker history` on the gravitino image shows the duplicate layer: | Layer | Size | |-------|------| | `COPY packages/gravitino /opt/gravitino` | 1.89 GB | | `RUN chmod -R g+rwX /opt/gravitino ...` | 1.89 GB | The `chmod` layer is a full duplicate of the COPY layer. ### How to reproduce 1. Build the gravitino image: `dev/docker/build-docker.sh --platform linux/amd64 --type gravitino --image apache/gravitino --tag test` 2. Run `docker history apache/gravitino:test` 3. Observe that the `RUN chmod -R g+rwX ...` layer is roughly the same size as the application `COPY` layer. Same pattern exists in `dev/docker/iceberg-rest-server/Dockerfile` and `dev/docker/lance-rest-server/Dockerfile`. ### Additional context The recursive chmod was introduced together with the non-root user change (#10681). Fix is to fold the permission into the COPY via `COPY --chmod=775` so the tree is written once with the correct mode and no duplicate layer is produced. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
