[TrueSkrillor]

Came across this while setting up dedicated Jenkins workers. I asked Claude to optimize the images in terms of build time, image size and layer count (best practice level, not aggressively). The results are compelling, the resulting binaries are byte-identical. Here's a quick comparison for a few images that Claude tested:

Image	Build time before	Build time after	Δ time	Size before (MB)	Size after (MB)	Δ size (MB)	Layers
entrypoint (base of most images)	25s¹	15s¹	−40 %	24.1	16.2	−7.9	2 → 1
debian-build:sid (build base)	1m 04s¹	56s¹	−12 %	1229.3	1187.5	−41.9	4 → 4
OpenSSL 0.9.8zh	47s	47s	+0 %	40.9	33.0	−7.9	6 → 5
OpenSSL 1.0.2u	1m 04s	1m 02s	−3 %	47.1	39.3	−7.9	6 → 5
OpenSSL 1.1.1w	2m 00s	12s	−90 %	70.0	49.5	−20.5	6 → 5
OpenSSL 3.5.4	7m 15s¹	46s¹	−89 %	111.5	79.4	−32.2	6 → 5
OpenSSL 4.0.0	10m 14s¹	1m 24s¹	−86 %	111.4	78.7	−32.7	6 → 5
LibreSSL 4.2.0	1m 49s	27s	−75 %	112.0	104.1	−7.9	6 → 5
BoringSSL 3945	2m 54s	39s	−78 %	108.8	100.9	−7.9	7 → 6
BoringSSL 945f4a5_x509_anvil	9m 28s¹	3m 28s¹	−63 %	151.9	144.0	−7.9	7 → 6
GnuTLS 3.6.16	5m 59s	3m 55s	−35 %	111.8	104.0	−7.9	6 → 5
GnuTLS 3.8.10	5m 50s	3m 34s	−39 %	74.0	66.1	−7.9	4 → 3
wolfSSL 5.8.2	30s	29s	−3 %	37.3	29.4	−7.9	8 → 7
Botan 3.9.0	16m 35s¹	3m 05s¹	−81 %	110.4	102.6	−7.9	5 → 4
mbed TLS 3.6.5 ²	>16m (aborted) / 1m 32s¹	44s¹	−52 %	26.9	19.0	−7.9	4 → 3
MatrixSSL 4.0.2	20s	18s	−10 %	27.6	19.8	−7.9	5 → 4
NSS 3.38	58s	59s	+2 %	171.4	163.5	−7.9	8 → 7
rustls 0.23.18	1m 08s¹	41s¹	−40 %	138.0	134.1	−3.9	3 → 3
tlslite-ng 0.4.2	9s¹	8s¹	−11 %	146.0	138.9	−7.1	9 → 9
Go	12s¹	11s¹	−8 %	30.1	20.4	−9.7	3 → 2
basicClient	10s¹	10s¹	+0 %	233.4	195.1	−38.4	4 → 4
Firefox 52.0.2	1m 16s	1m 25s	+12 %	1342.9	1000.1	−342.8	16 → 8

Total size of the 22 sampled images: 4457 MB → 3825 MB (−632 MB)

Build times without a mark come from a sequential run (one build at a time, before and after alternating).

¹ marks images built in a parallel run with 6 concurrent builds: compare those only with each other. Builds that are still serial, like OpenSSL < 1.1.0 or wolfSSL (mostly clone, autogen and configure), are unchanged within noise. Firefox and NSS spend most of their time downloading, so those differences are network noise. Sizes are as reported by docker image inspect.

² The original mbedtls_x2 build never finished (aborted after more than 16 min). 1m 32s is the original Dockerfile with only the jsonschema pin applied.

[TrueSkrillor]

Moving to -Development