chainguard-dev / chainguard-dev/dfc
Remove unneeded package installs depending on image
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 103
- Forks
- 29
- PR merge metrics
- No merged PRs in 30d
Description
Example
FROM python:3.9.18-slim
RUN apt-get update -q -q && \
apt-get install curl python3 python3-pip
Chainguard recommends removing package installs that already exist on the base image (i.e. listed in their SBOM). Can DFC filter out these installs, ideally checking against that specific image's SBOM?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with how Dockerfile FROM and RUN lines are handled, then determine how the specific base image's SBOM can identify packages already present. Use the example with python:3.9.18-slim to verify that redundant installs such as curl, python3, and python3-pip are filtered while needed packages remain.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, dockerfile, go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100