Optimize runtime container layers

Author: Athos Couto

Dockerfile

@@ -2,18 +2,19 @@
 FROM rust:slim-bullseye AS chef
 RUN apt update \
     && apt install -y libclang-dev clang \
-        build-essential tcl protobuf-compiler file \
-        libssl-dev pkg-config git\
-    && apt clean \
-    && cargo install cargo-chef
+    build-essential tcl protobuf-compiler file \
+    libssl-dev pkg-config git\
+    && apt clean && rm -rf /var/lib/apt/lists/*
+
 # We need to install and set as default the toolchain specified in rust-toolchain.toml
 # Otherwise cargo-chef will build dependencies using wrong toolchain
 # This also prevents planner and builder steps from installing the toolchain over and over again
 COPY rust-toolchain.toml rust-toolchain.toml
 RUN cat rust-toolchain.toml | grep "channel" | awk '{print $3}' | sed 's/\"//g' > toolchain.txt \
     && rustup update $(cat toolchain.txt) \
     && rustup default $(cat toolchain.txt) \
-    && rm toolchain.txt rust-toolchain.toml
+    && rm toolchain.txt rust-toolchain.toml \
+    && cargo install cargo-chef
 
 FROM chef AS planner
 COPY . .
@@ -27,14 +28,19 @@ RUN cargo build -p sqld --release
 
 # runtime
 FROM debian:bullseye-slim
-COPY --from=builder /target/release/sqld /bin/sqld
+
+EXPOSE 5001 8080
+VOLUME [ "/var/lib/sqld" ]
+
 RUN groupadd --system --gid 666 sqld
 RUN adduser --system --home /var/lib/sqld --uid 666 --gid 666 sqld
-RUN apt-get update && apt-get install -y ca-certificates
-COPY docker-entrypoint.sh /usr/local/bin
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-VOLUME [ "/var/lib/sqld" ]
 WORKDIR /var/lib/sqld
 USER sqld
-EXPOSE 5001 8080
+
+COPY docker-entrypoint.sh /usr/local/bin
+
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /target/release/sqld /bin/sqld
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["/bin/sqld"]