fix(images): reduce container-base size by excluding locales and docs by binujp · Pull Request #20008 · microsoft/azurelinux

binujp · 2026-11-05T22:10:25Z

Summary

Trim the container-base image by excluding non-English RPM locale data and RPM documentation, while retaining licenses and normal runtime package management.

Package the temporary language-selection macro in azurelinux-release-locale-minimal, selected only during the core bootstrap.
Reinstall bootstrap RPMs in a post-bootstrap hook so RPM applies the language policy and records excluded payloads correctly.
Erase the temporary policy RPM directly from config.sh before shipping, allowing subsequent package installations to select their normal locale payloads.
Enable rpm-excludedocs only for core and add artifact checks for locale filtering, policy removal, documentation exclusion, and license preservation.

Why the post-bootstrap hook is necessary

KIWI's host-side bootstrap package transaction does not honor RPM macro overrides installed inside the build chroot. Installing the policy RPM alone therefore cannot filter the initial bootstrap payloads. The post-bootstrap script reinstalls those packages inside the target chroot, where the packaged language policy is active.

Other image profiles do not demand this level of intervention. Even distroless-minimal primarily focuses on package minimization rather than minimizing image size itself. Focusing this change on container-base lets us be judicious about the number of build exceptions we introduce; the other images retain their existing behavior.

Size and validation

The size reduction is approximately 10 MB, with the rebuilt compressed x86_64 OCI archive now 32.05 MB (about 32 MB, or 30.57 MiB).

Rebuilt container-base on x86_64 and checked the new artifact:

Static checks: 55 passed, 36 skipped, including the minimal RPM documentation-exclusion test, which verifies that Bash's README is absent while its license remains.
Selected runtime checks: 4 passed, covering shell access, localhost resolution, production package installation, and explicit non-persistent Preview repository opt-in.

Attribution

Based on the original work by Kshitiz Godara (kgodara912) in #19837: #19837.

binujp · 2026-11-05T22:10:42Z

/azp run

azure-pipelines · 2026-11-05T22:10:49Z

Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions.

binujp · 2026-11-05T22:13:46Z

/azp run

azure-pipelines · 2026-11-05T22:13:53Z

Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions.

Copilot

🟢 Approval recommended

No active review issues remain for the container image locale-filtering and documentation-exclusion changes.

No open issues 🎉

What changed in this PR

Reduces container-base image size by filtering non-English locale payloads and excluding RPM documentation, while preserving licenses and normal runtime package management. Other image profiles retain their existing behavior.

Changes:

Adds a temporary language-policy RPM and reinstalls bootstrap packages inside the image to apply it.
Enables documentation exclusion for the core profile and removes the language-policy RPM before shipping.
Adds artifact checks for locale filtering, policy removal, documentation exclusion, and license preservation.

File	Description
`specs/a/azurelinux-release/macros.container-languages`	Adds the rendered RPM language policy.
`specs/a/azurelinux-release/azurelinux-release.spec`	Reflects the new policy subpackage and release bump.
`locks/azurelinux-release.lock`	Refreshes the component input fingerprint.
`base/images/tests/cases/static/test_container_languages.py`	Checks filtered payloads, policy removal, and retained licenses.
`base/images/teams/container.xml`	Selects the bootstrap policy and enables documentation exclusion for `core`.
`base/images/post_bootstrap.sh`	Reinstalls bootstrap packages under the target’s language policy.
`base/images/config.sh`	Removes the temporary policy RPM before shipping.
`base/comps/azurelinux-release/macros.container-languages`	Defines the allowed RPM language payloads.
`base/comps/azurelinux-release/azurelinux-release.spec`	Packages and validates the temporary language policy.

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

No active review issues remain for the container image locale and documentation filtering changes.

No open issues 🎉

_{Review effort: Balanced}

reuben olinsky (reubeno) · 2026-11-06T01:27:21Z

@@ -27,6 +27,7 @@
        <packagemanager>dnf5</packagemanager>
    </preferences>
    <preferences profiles="core">


question(blocking): Can you help me understand why we can't just use rpm-locale-filtering?

Based on this code in kiwi, it looks like that always includes the POSIX, C, C.UTF-8, and then unions in anything listed in the locale setting:

https://github.com/OSInside/kiwi/blob/f26db086eaa5ee77b26e3edd0363f8b77af8dff1/kiwi/xml_state.py#L282-L302

if self.get_rpm_locale_filtering(): rpm_locale = ['POSIX', 'C', 'C.UTF-8']

We could; but that works only in the image build phase. We still need the post-bootstrap script to reinstall bootstrap rpms to be locale filtered. With a custom rpm we get flexibility to add other customizations in the future. I will make that change, but we do not get a script less bootstrap phase.

reuben olinsky (reubeno) · 2026-11-06T01:31:43Z

        <packagemanager>dnf5</packagemanager>
    </preferences>
    <preferences profiles="core">
+        <rpm-excludedocs>true</rpm-excludedocs>


question(blocking): Don't we want this to apply to the distroless containers?

Two reasons; from the bug my understanding is the container size concern is focused on the core container. Distroless containers do not have the option of reinstalling rpms and thus pulling in locales or docs later. Whatever is already installed is what is available for all workloads. If the focus is on minimizing size of all containers, we can do that. For that, I would rather work on a separate PR.

Use KIWI's native RPM locale filtering for container-base and reinstall bootstrap packages inside the target chroot so filtering applies to their payloads. Let KIWI clean up its temporary RPM macro instead of shipping a custom policy RPM. Exclude documentation only for core and verify locale filtering, build-time policy cleanup, and license retention. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c5603870-57b3-4c21-9eb9-62b600c146af

Copilot

🔵 Needs a closer look

The KIWI/DNF5 bootstrap reinstall and history check need artifact/runtime validation unavailable here, while supplied results cover a different policy mechanism and omit the supported aarch64 image.

No open issues 🎉

_{Review effort: Balanced}

reuben olinsky (reubeno) · 2026-11-06T22:50:09Z

+def test_bootstrap_language_macro_absent(rootfs: Path) -> None:
+    """Do not ship the build-time RPM language override."""
+    assert not (rootfs / "etc/rpm/macros.kiwi-image-config").exists()
+    assert not (rootfs / "etc/rpm/macros.container-languages").exists()


question(non-blocking): Is this still required?

reuben olinsky (reubeno) · 2026-11-06T22:50:35Z

+
+def test_bootstrap_language_macro_absent(rootfs: Path) -> None:
+    """Do not ship the build-time RPM language override."""
+    assert not (rootfs / "etc/rpm/macros.kiwi-image-config").exists()


question(non-blocking): copilot seems to think that the config is created under /usr/lib/rpm/ somewhere; I'm not sure offhand but I figured I'd pass along the note.

binujp requested a review from a team as a code owner November 5, 2026 22:10

Copilot AI balanced review requested due to automatic review settings November 5, 2026 22:10

Copilot started reviewing on behalf of binujp November 5, 2026 22:11

View session

binujp force-pushed the bphilip/resize-base-minimal branch from ea43c95 to 0fa5a70 Compare November 5, 2026 22:13

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 5, 2026 22:14

Copilot started reviewing on behalf of binujp November 5, 2026 22:14

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

reuben olinsky (reubeno) requested changes Nov 6, 2026

View reviewed changes

github-actions Bot added the targets-4.0 label Nov 6, 2026

binujp force-pushed the bphilip/resize-base-minimal branch from 0fa5a70 to 048db62 Compare November 6, 2026 07:03

Copilot AI balanced review requested due to automatic review settings November 6, 2026 07:03

Copilot started reviewing on behalf of binujp November 6, 2026 07:03

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

reuben olinsky (reubeno) approved these changes Nov 6, 2026

View reviewed changes

Conversation

binujp commented Nov 5, 2026

Summary

Why the post-bootstrap hook is necessary

Size and validation

Attribution

Uh oh!

binujp commented Nov 5, 2026

Uh oh!

azure-pipelines Bot commented Nov 5, 2026

Uh oh!

binujp commented Nov 5, 2026

Uh oh!

azure-pipelines Bot commented Nov 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

reuben olinsky (reubeno) Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

binujp Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

reuben olinsky (reubeno) Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

binujp Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

reuben olinsky (reubeno) Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

reuben olinsky (reubeno) Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants