Optimize runtime container layers

- Remove apt update, since it invalidate subsequent layers
- Only copy sqld binary in the last step, since it changes the most
- Copy ca-certificates.crt from builder image

Author: Athos Couto

Dockerfile

@@ -1,19 +1,22 @@
 # build sqld
 FROM rust:slim-bullseye AS chef
-RUN apt update \
-    && apt install -y libclang-dev clang \
-        build-essential tcl protobuf-compiler file \
-        libssl-dev pkg-config git\
-    && apt clean \
-    && cargo install cargo-chef
+
+RUN apt update
+RUN apt install -y libclang-dev clang \
+    build-essential tcl protobuf-compiler file \
+    libssl-dev pkg-config git
+RUN apt clean
+
 # We need to install and set as default the toolchain specified in rust-toolchain.toml
 # Otherwise cargo-chef will build dependencies using wrong toolchain
 # This also prevents planner and builder steps from installing the toolchain over and over again
 COPY rust-toolchain.toml rust-toolchain.toml
-RUN cat rust-toolchain.toml | grep "channel" | awk '{print $3}' | sed 's/\"//g' > toolchain.txt \
-    && rustup update $(cat toolchain.txt) \
-    && rustup default $(cat toolchain.txt) \
-    && rm toolchain.txt rust-toolchain.toml
+RUN cat rust-toolchain.toml | grep "channel" | awk '{print $3}' | sed 's/\"//g' > toolchain.txt; \
+    rustup update $(cat toolchain.txt); \
+    rustup default $(cat toolchain.txt); \
+    rm toolchain.txt rust-toolchain.toml;
+
+RUN cargo install cargo-chef
 
 FROM chef AS planner
 COPY . .
@@ -27,14 +30,19 @@ RUN cargo build -p sqld --release
 
 # runtime
 FROM debian:bullseye-slim
-COPY --from=builder /target/release/sqld /bin/sqld
+
+EXPOSE 5001 8080
+VOLUME [ "/var/lib/sqld" ]
+
 RUN groupadd --system --gid 666 sqld
 RUN adduser --system --home /var/lib/sqld --uid 666 --gid 666 sqld
-RUN apt-get update && apt-get install -y ca-certificates
-COPY docker-entrypoint.sh /usr/local/bin
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-VOLUME [ "/var/lib/sqld" ]
 WORKDIR /var/lib/sqld
 USER sqld
-EXPOSE 5001 8080
+
+COPY docker-entrypoint.sh /usr/local/bin
+
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /target/release/sqld /bin/sqld
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["/bin/sqld"]