Subject: bug#41607: Guix Docker image inflation

From: zimoun <[email-masked]>
Date: Sun, 31 May 2020 10:24:25 +0200

Dear Stephen,

Follow ups of
https://lists.gnu.org/archive/html/help-guix/2020-05/msg00249.html
and bug#41607 CC http://issues.guix.gnu.org/41607

On Sat, 30 May 2020 at 19:02, Stephen Scheck <[email-masked]> wrote:

> You can convince yourself of this by doing something like the following:
>
>     docker run <some-linux-image>
>     docker exec <container-id> dd if=/dev/urandom of=/RANDOM-DATA
> bs=1048576 count=1024
>     docker commit <container-id>
>     docker exec <container-id> rm /RANDOM-DATA
>     docker commit <container-id>

It does not convince myself and maybe I am doing wrongly but it is not
what I am observing for an example with more than 2 'commits'.  Here
my session, based on your images rename "fresh" because it will happen
on any image.

--8<---------------cut here---------------start------------->8---
$ docker images
REPOSITORY                      TAG                 IMAGE ID
 CREATED             SIZE
fresh                           latest              c36cef8306d5
 3 weeks ago         1.06GB
singularsyntax/guix-bootstrap   1.1.0-alpine-3.11   c36cef8306d5
 3 weeks ago         1.06GB

$ CONTAINER=`docker run --detach --tty --privileged fresh`
$ docker exec --interactive --tty $CONTAINER /bin/sh
/ # dd if=/dev/urandom of=/DATA bs=1234567 count=1024
dd if=/dev/urandom of=/DATA bs=1234567 count=1024
1024+0 records in
1024+0 records out
/ # exit
exit

$ HASH=`docker commit $CONTAINER` && docker tag $HASH add-data
$ docker stop $CONTAINER && docker rm $CONTAINER
cb89992b76ace2afe5dc6e082c8de121c483dfeeb688d89849713e2cf90b68c7
cb89992b76ace2afe5dc6e082c8de121c483dfeeb688d89849713e2cf90b68c7

$ CONTAINER=`docker run --detach --tty --privileged add-data`
$ docker exec --interactive --tty $CONTAINER /bin/sh
/ # rm /DATA
rm /DATA
/ # dd if=/dev/urandom of=/OTHER bs=1234567 count=1024
dd if=/dev/urandom of=/OTHER bs=1234567 count=1024
1024+0 records in
1024+0 records out
/ # exit
exit

$ HASH=`docker commit $CONTAINER` && docker tag $HASH rm-data-add-other
$ docker stop $CONTAINER && docker rm $CONTAINER
93e9afe593226ec29669efe8515b47487f455d4ad5e012cc67372c2549ec7256
93e9afe593226ec29669efe8515b47487f455d4ad5e012cc67372c2549ec7256

$ CONTAINER=`docker run --detach --tty --privileged rm-data-add-other`
$ docker exec --interactive --tty $CONTAINER /bin/sh
/ # rm /OTHER
rm /OTHER
/ # exit
exit

$ HASH=`docker commit $CONTAINER` && docker tag $HASH rm-other

$ docker stop $CONTAINER && docker rm $CONTAINER
469b341c2f394ef05f5f43a5d96239853e3552d979028a457a9bdd1096a8fab4
469b341c2f394ef05f5f43a5d96239853e3552d979028a457a9bdd1096a8fab4

$ docker images
REPOSITORY                      TAG                 IMAGE ID
 CREATED              SIZE
rm-other                        latest              b80d300aa755
 23 seconds ago       3.59GB
rm-data-add-other               latest              de551eac1d55
 About a minute ago   3.59GB
add-data                        latest              6a563daccccd
 3 minutes ago        2.32GB
fresh                           latest              c36cef8306d5
 3 weeks ago          1.06GB
singularsyntax/guix-bootstrap   1.1.0-alpine-3.11   c36cef8306d5
 3 weeks ago          1.06GB

$ CONTAINER=`docker run --detach --tty --privileged rm-other`
$ docker exec --interactive --tty $CONTAINER /bin/sh
/ # ls /
ls /
bin    dev    etc    gnu    home   lib    media  mnt    opt    proc
root   run    sbin   srv    sys    tmp    usr    var
/ # exit
exit
--8<---------------cut here---------------end--------------->8---

> You'll end up with two new images - the first one should be about 1 GB
> larger than the base image,
> the second one the same size.

As you see, the image 'rm-other' does not container either /DATA or
/OTHER and its size is not the same than the initial one 'fresh'.  So
I do not know if the correct Docker terminology is "layer" because the
issue is definitely on the Docker side and not on the Guix side.

Cheers,
simon