[lelia]

Every release currently rebuilds every layer of the Docker image, so upgrading socketdev/cli downloads nearly the whole image. This PR fixes that and removes about 1.1 GB of payload nothing runs.

Root cause of the per-release re-pull

ARG CLI_VERSION (with the other release ARGs) was declared at the top of the Dockerfile. BuildKit cache-keys every RUN after an ARG on that ARG's value, and CLI_VERSION changes on every release, so every toolchain layer missed the cache on every release build even when nothing in it changed. From the published amd64 manifests:

Upgrade	Layers reused	New compressed bytes
2.11.5 → 2.11.6	8 of 27	1,025 MB of 1,046
2.11.10 → 2.11.11	8 of 27	1,028 MB of 1,049

The base image digest was the same across 2.11.10 → 2.11.11, so the churn didn't come from upstream. The release ARGs are now declared just before the CLI install. tests/unit/test_dockerfile.py fails if one is declared above a toolchain layer again; it fails against main's Dockerfile. Dockerfile is added to the Unit Tests push paths, since the suite now reads it.

Payload removed

• Rust: rustup's minimal profile (rustc, cargo, rust-std) instead of default. Drops about 900 MB of offline HTML docs, plus rustfmt and clippy. Reachability only invokes cargo.
• Caches: npm cache clean --force after the global install, and pip install --no-cache-dir throughout.
• apk update is gone; apk add --no-cache doesn't need it.
• strace is no longer installed (it was referenced nowhere). The changelog notes apk add strace for anyone who relied on it.
• .dockerignore: keeps tests/ and other repo files out of the context and /app. dist/ stays in, because Dockerfile.preview copies the preview wheel from it.

Verification

Local linux/arm64 builds; the PR preview image is built from Dockerfile.preview, so it doesn't exercise these changes.

• Size: 4,579 MB for socketdev/cli:2.11.11 vs 3,446 MB for this branch (uncompressed, arm64). /root/.rustup went from 1,693 to 753 MB, /root/.npm from 20 to 1 MB, /app from 11 to 2 MB.
• Layer reuse: built with CLI_VERSION=2.11.10, then rebuilt with CLI_VERSION=2.11.11. Steps 2–17, everything through the locked dependency install, were CACHED. Only the CLI install and the small layers after it rebuilt. A real release also changes pyproject.toml/uv.lock, which adds the locked-dependency layer (about 21 MB). So an upgrade is roughly 25 MB uncompressed instead of about 1 GB compressed.
• Toolchains: socketcli, cargo/rustc, go, java, dotnet, node, ruby/bundle, pyenv, uv and socket all run. cargo generate-lockfile, cargo metadata and cargo build work on a crate with a crates.io dependency.
• Tests: 734 unit tests pass.

Not verified here: an end-to-end Rust reachability run in the image. e2e-test.yml runs reachability on the runner, not in the image, and only against an npm fixture. I'd appreciate a quick Rust --reach run in a build of this branch from someone with a token, to confirm nothing beyond cargo is needed.

Once released, the GitHub Actions cache (currently around its 10 GB limit) should stop growing by about a full image per release, since unchanged layers are no longer re-exported.

Bumps to 2.11.12. #438 also targets 2.11.12; whichever merges second rides that version and only needs the changelog merged.

Ref: CE-430

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes the default Docker toolchain (minimal Rust, no strace) and layer layout that all CLI container users depend on; Rust reachability in the image was not fully re-verified in this PR.

Overview
Release 2.11.12 reshapes how the published socketdev/cli image is built so version bumps reuse cached toolchain layers instead of forcing a near-full re-download, and trims roughly a gigabyte of unused payload.

Layer caching: CLI_VERSION and the other release-specific build args move to just before the CLI install step. BuildKit invalidates every subsequent RUN when those args change; having them at the top previously busted cache for Go, Java, Rust, pyenv, locked deps, etc. on every release. A new unit test in test_dockerfile.py asserts release ARGs stay below toolchain installs, and Dockerfile is included in the CI paths filter on push.

Smaller image: Rust is installed with rustup’s minimal profile (no offline docs, rustfmt, or clippy); strace is dropped from the base packages; npm and pip caches are cleared or use --no-cache-dir; redundant apk update is removed. A new .dockerignore keeps tests, docs, and similar out of the build context while still allowing preview wheels from dist/.

^{Reviewed by Cursor Bugbot for commit 29a60c9. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 29a60c9. Configure here.}