Description
yum install can leave package metadata and caches in an image layer. Keeping files that are unnecessary at runtime can increase image size, transfer time and storage costs.
Deleting files in a later RUN does not shrink earlier layers, so perform installation and cleanup in one layer.
Potential impact
- Larger images can increase registry storage and deployment time.
- Unnecessary installation caches can remain packaged with the image.
Remediation
- Run yum clean all after yum install in the same RUN.
- Check remaining caches and final image size, and manage updates to installed packages separately.
Examples
The existing CentOS 7 examples are historical illustrations of command order. For actual builds, use a supported base and repositories, including a repository that provides nginx.
Before
dockerfile
FROM centos:7
RUN yum install -y nginx
After
dockerfile
FROM centos:7
RUN yum install -y nginx \
&& yum clean all
Explanation:
- Before: Installation caches can remain in the image.
- After: After successful installation, the same layer cleans the yum cache.