How can I get smaller closure sizes for use in Docker images?

[shanesveller]

I have an open-source example for an Axum + sqlx project here:

https://github.com/shanesveller/axum-rest-example/blob/5e8831b91724f81970204fff877293e2f2ec65d2/flake.nix#L83-L169

Unfortunately if I use this code as-written like so:

nix -vL build .#docker && ./result | docker load

I get an image that pulls the entire deps tree into the runtime image, to the tune of about 350MB. The Dockerfile in the same repo produces a binary of about 18MB and a total image size of about 87MB including the base Alpine OS.

I attempted to use doInstallCargoArtifacts = false; on my application derivation, but I've misunderstood how it's intended to work or it's not helping shrink the closure size.

Do you have any advice?

[dpc]

Not sure how much help it will be but I had neat and slim images with https://github.com/rustshop/rustshop/blob/a8ff84a8f3d8522fb218574cb9f6b7935596aceb/flake.nix#L93

Your flake.nix looks similar. I didn't use flake-utils.lib.mkApp (I don't know what it even does :D). Otherwise I can't see anything standing out.

doInstallCargoArtifacts = false; is indeed supposed to prevent target/ (compressed) being copied into $out.

[shanesveller]

Thanks for the resource/discussion! I do hope that these are meaningfully similar but I'll note that for comparison, the two flakes use:

• fenix vs oxalica/rust-overlay
• naersk vs crane

There's a lot of under-the-hood differences in both of those distinctions, but it's a useful point of reference nonetheless.

[shanesveller]

Whoops, sorry, I see naersk in the inputs but it looks like it's not in the critical path. My mistake.

[dpc]

Whoops, sorry, I see naersk in the inputs but it looks like it's not in the critical path. My mistake.

Yeap, it's just a leftover that I should clean.

fenix vs oxalica/rust-overlay

I'm not an expert, but it seems unlikely this would result in different outcome. crane just wants the Rust binaries to use.

[ipetkov]

Thanks for the report @shanesveller! This is actually a bug: #80

The tl;dr is that rust will include links to source files in panic info (e.g. line numbers) which nix sees as the final binary still "depending" on those sources. We go to some lengths to break the false-dependency but looks like it was broken and I didn't have the tests to catch it 😬

[ipetkov]

@shanesveller to get unblocked I'd recommend setting RUSTFLAGS = "-Clink-arg=-fuse-ld=lld"; for all the derivations (including buildDepsOnly) which build the crate. More info and a better general solution will be tracked in #80