perf: optimize Dockerfile with uv, cache mounts, and compliance fixes #446
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Comprehensive Dockerfile optimization for improved build performance, multi-architecture support, and licensing compliance. ## Performance Optimizations **Migrated from pip to uv (build stage only):** - 10-100x faster package installation with parallel downloads - BuildKit cache mounts for persistent dependency caching - npm cache mount for faster frontend builds **Optimized layer caching:** - Install build tools BEFORE copying dependency files - Dependency metadata copied before source code - Better cache hit rates on code-only changes **Multi-architecture support:** - Added TARGETARCH and TARGETPLATFORM support - Architecture-specific cache IDs to prevent cross-contamination - Works with: docker buildx build --platform linux/amd64,linux/arm64 ## Licensing & Compliance Fixes **Runtime stage uses pip (not uv):** - Addresses licensing attribution requirements for uv and its dependencies - uv only used in build stage (discarded, no licensing obligations) - pip is built-in to Python (no additional licenses) **Removed PIP_NO_CACHE_DIR=1:** - Enables pip caching for faster builds - Works with cache mounts for optimal performance ## Changes Summary **Build stage:** - ✅ Uses uv with cache mounts (fast builds) - ✅ Install hatch before COPY (better caching) - ✅ npm cache mount for frontend - ✅ BuildKit cache mounts **Runtime stage:** - ✅ Uses pip (licensing compliant) - ✅ No uv in any layer (clean layer history) - ✅ Minimal dependencies - ✅ Smaller image footprint ## Expected Performance Gains | Scenario | Improvement | |----------|-------------| | First build | 20-40% faster | | Rebuild (code change) | 60-80% faster | | Rebuild (deps unchanged) | 90% faster | ## Compliance - Linux Foundation layer attribution requirements met - No uv licensing obligations in final image - Clean layer history for auditing Co-authored-by: Artyom Morozov (layer caching optimization) Co-authored-by: Samuel Gamelin (licensing compliance feedback)
|
WhiteSource Policy Violation Summary✅︎ No Blocking Whitesource Policy Violations found in solaceai/solace-agent-mesh-pr-446! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR applies comprehensive Dockerfile optimizations based on lessons learned from the enterprise repository, delivering significant build performance improvements while maintaining licensing compliance.
Key Changes
🚀 Performance Optimizations
Build Stage:
Removed PIP_NO_CACHE_DIR=1:
🔒 Licensing & Compliance
Critical compliance fixes based on security review:
Runtime uses pip (not uv):
Layer-level compliance:
📊 Expected Performance Gains
Architecture
Build Stage (Fast)
Runtime Stage (Compliant)
FROM python:3.11-slim AS runtime - Install git, ffmpeg (minimal dependencies) - Install Playwright with pip (no uv!) - Create non-root user - Install package with pip (no uv!) - NO uv in any runtime layer ✅Build Commands
Native platform (auto-detect):
docker buildx build -t solace/solace-agent-mesh:latest .Specific platform:
docker buildx build --platform linux/amd64 -t solace/solace-agent-mesh:latest .Multi-platform:
docker buildx build --platform linux/amd64,linux/arm64 -t solace/solace-agent-mesh:latest . --pushTesting Checklist
Compliance Notes
Licensing:
Attribution: