sandbox: shrink image by ~2GB (go modcache, locales, docs)

Three safe reclamations to containers/Dockerfile that trim the final
image from ~9.8GB to ~7.5GB without removing any user-facing tool:

- `go clean -modcache` after the ProjectDiscovery installs removes
  ~1.7GB of Go module sources. The resulting binaries in
  /home/pentester/go/bin are self-contained and don't need the
  module cache at runtime.
- Purge non-English glibc locales (~160MB). Sandbox runs with
  LANG=C.UTF-8 implicitly; no locale beyond en/en_US/C is used.
- Remove /usr/share/doc, /usr/share/doc-base, and /usr/share/man
  (~95MB). Runtime doesn't call man or read package docs.

Verified by building + smoke-testing the slim image: all path-visible
tools (semgrep, nuclei, httpx, katana, trivy, zaproxy, trufflehog,
gitleaks, sqlmap, ffuf, subfinder, naabu, bandit, arjun, dirsearch,
wafw00f, tree-sitter, ast-grep, eslint, retire, jshint, js-beautify,
wapiti) report version / usage cleanly on the slim image.
This commit is contained in:
Sean Turner
2026-07-22 11:38:52 +00:00
committed by Devin AI
parent 59f49a1fa2
commit 4524691355
+8 -2
View File
@@ -70,7 +70,8 @@ RUN go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest && \
go install -v github.com/projectdiscovery/katana/cmd/katana@latest && \
go install -v github.com/projectdiscovery/cvemap/cmd/vulnx@latest && \
go install -v github.com/jaeles-project/gospider@latest && \
go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest
go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest && \
go clean -modcache
RUN nuclei -update-templates
@@ -163,7 +164,12 @@ USER root
RUN apt-get autoremove -y && \
apt-get autoclean && \
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && \
# Purge non-English locales (~160MB)
find /usr/share/locale -mindepth 1 -maxdepth 1 -type d \
! -name 'en' ! -name 'en_US' ! -name 'C' -exec rm -rf {} + && \
# Remove package documentation and man pages not needed at runtime (~95MB)
rm -rf /usr/share/doc/* /usr/share/doc-base/* /usr/share/man/*
ENV PATH="/home/pentester/go/bin:/home/pentester/.local/bin:/home/pentester/.npm-global/bin:/app/.venv/bin:$PATH"
ENV VIRTUAL_ENV="/app/.venv"