From 1b75aaf94eff7e00df393cb7358d7762e59c98f0 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 4 Sep 2026 15:17:40 +0200 Subject: [PATCH 1/6] dind: remove btrfs-progs dependency The btrfs storage driver no longer requires the btrfs userspace utilities at runtime. Moby switched its btrfs implementation to use the kernel UAPI directly in v23.0, removing its dependency on libbtrfs/btrfs-progs. Containerd similarly switched its btrfs snapshotter to use the kernel UAPI through containerd/btrfs/v2 in containerd 1.7, making kernel headers a build-time dependency instead of requiring btrfs-progs at runtime. Remove btrfs-progs from the dind image, as neither the Moby btrfs storage driver nor containerd's btrfs snapshotter requires it. - https://github.com/moby/moby/commit/3208dcabdc8997340b255f5b880fef4e3f54580d - https://github.com/containerd/containerd/commit/52f82acb7b3984fcb143af50c29a0ac0ceb5dc5d Signed-off-by: Sebastiaan van Stijn --- 29/dind/Dockerfile | 1 - Dockerfile-dind.template | 1 - 2 files changed, 2 deletions(-) diff --git a/29/dind/Dockerfile b/29/dind/Dockerfile index 12a47cc9e..48b2212bb 100644 --- a/29/dind/Dockerfile +++ b/29/dind/Dockerfile @@ -10,7 +10,6 @@ FROM docker:29-cli # https://github.com/docker/docker-ce-packaging/blob/963aa02666035d4e268f33c63d7868d6cdd1d34c/deb/common/control#L28-L41 RUN set -eux; \ apk add --no-cache \ - btrfs-progs \ e2fsprogs \ e2fsprogs-extra \ git \ diff --git a/Dockerfile-dind.template b/Dockerfile-dind.template index 75d30e7df..a6d9ec114 100644 --- a/Dockerfile-dind.template +++ b/Dockerfile-dind.template @@ -5,7 +5,6 @@ FROM docker:{{ env.version }}-cli # https://github.com/docker/docker-ce-packaging/blob/963aa02666035d4e268f33c63d7868d6cdd1d34c/deb/common/control#L28-L41 RUN set -eux; \ apk add --no-cache \ - btrfs-progs \ e2fsprogs \ e2fsprogs-extra \ git \ From 3806f369440a6bbe66e17a8eaf046f2576a7e58a Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 4 Sep 2026 15:20:57 +0200 Subject: [PATCH 2/6] dind: remove e2fsprogs and xfsprogs dependencies The e2fsprogs, e2fsprogs-extra, and xfsprogs packages were runtime dependencies of the devicemapper storage driver, providing the tools used to create and configure ext4 and XFS filesystems. The devicemapper storage driver was disabled by default in Docker Engine v23.0 and removed in v25.0. None of these filesystem utilities are required by the remaining storage drivers. Remove e2fsprogs, e2fsprogs-extra, and xfsprogs from the dind image. - https://docs.docker.com/engine/deprecated/#device-mapper-storage-driver Signed-off-by: Sebastiaan van Stijn --- 29/dind/Dockerfile | 3 --- Dockerfile-dind.template | 3 --- 2 files changed, 6 deletions(-) diff --git a/29/dind/Dockerfile b/29/dind/Dockerfile index 48b2212bb..12babdc5a 100644 --- a/29/dind/Dockerfile +++ b/29/dind/Dockerfile @@ -10,15 +10,12 @@ FROM docker:29-cli # https://github.com/docker/docker-ce-packaging/blob/963aa02666035d4e268f33c63d7868d6cdd1d34c/deb/common/control#L28-L41 RUN set -eux; \ apk add --no-cache \ - e2fsprogs \ - e2fsprogs-extra \ git \ ip6tables \ iptables \ openssl \ pigz \ shadow-uidmap \ - xfsprogs \ xz \ zfs \ ; diff --git a/Dockerfile-dind.template b/Dockerfile-dind.template index a6d9ec114..034b1029e 100644 --- a/Dockerfile-dind.template +++ b/Dockerfile-dind.template @@ -5,15 +5,12 @@ FROM docker:{{ env.version }}-cli # https://github.com/docker/docker-ce-packaging/blob/963aa02666035d4e268f33c63d7868d6cdd1d34c/deb/common/control#L28-L41 RUN set -eux; \ apk add --no-cache \ - e2fsprogs \ - e2fsprogs-extra \ git \ ip6tables \ iptables \ openssl \ pigz \ shadow-uidmap \ - xfsprogs \ xz \ zfs \ ; From 27c828f21018d680dc1e68b95e8ce9df7caa236f Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 4 Sep 2026 15:24:56 +0200 Subject: [PATCH 3/6] dind: remove duplicate git dependency Git was originally added explicitly to the dind variants when the separate git variant was folded into dind. It was later added to the CLI variants as well, to support build and buildx workflows that invoke git. As the dind image is based on the CLI image, git is now inherited from its parent and no longer needs to be installed again. Remove the redundant git package from the dind dependencies. - https://github.com/docker-library/docker/commit/485fefe743baed5a2dd9e5d22b685c14eda4c61e - https://github.com/docker-library/docker/commit/b348a31fc955dd6500a4aa9537bbef51688a181e Signed-off-by: Sebastiaan van Stijn --- 29/dind/Dockerfile | 1 - Dockerfile-dind.template | 1 - 2 files changed, 2 deletions(-) diff --git a/29/dind/Dockerfile b/29/dind/Dockerfile index 12babdc5a..cc5f32a5c 100644 --- a/29/dind/Dockerfile +++ b/29/dind/Dockerfile @@ -10,7 +10,6 @@ FROM docker:29-cli # https://github.com/docker/docker-ce-packaging/blob/963aa02666035d4e268f33c63d7868d6cdd1d34c/deb/common/control#L28-L41 RUN set -eux; \ apk add --no-cache \ - git \ ip6tables \ iptables \ openssl \ diff --git a/Dockerfile-dind.template b/Dockerfile-dind.template index 034b1029e..e671bcdae 100644 --- a/Dockerfile-dind.template +++ b/Dockerfile-dind.template @@ -5,7 +5,6 @@ FROM docker:{{ env.version }}-cli # https://github.com/docker/docker-ce-packaging/blob/963aa02666035d4e268f33c63d7868d6cdd1d34c/deb/common/control#L28-L41 RUN set -eux; \ apk add --no-cache \ - git \ ip6tables \ iptables \ openssl \ From f86144766362a70f2a532425bfad4b6602237149 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 4 Sep 2026 15:45:33 +0200 Subject: [PATCH 4/6] dind: update links for runtime-dependencies Signed-off-by: Sebastiaan van Stijn --- 29/dind/Dockerfile | 5 +++-- Dockerfile-dind.template | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/29/dind/Dockerfile b/29/dind/Dockerfile index cc5f32a5c..a6a1802fb 100644 --- a/29/dind/Dockerfile +++ b/29/dind/Dockerfile @@ -6,8 +6,9 @@ FROM docker:29-cli -# https://github.com/moby/moby/blob/0eecd59153c03ced5f5ddd79cc98f29e4d86daec/project/PACKAGERS.md#runtime-dependencies -# https://github.com/docker/docker-ce-packaging/blob/963aa02666035d4e268f33c63d7868d6cdd1d34c/deb/common/control#L28-L41 +# Runtime dependencies: +# - https://github.com/moby/moby/blob/864598f8c2677189e308eb4a3b3c0dd41fc06599/project/PACKAGERS.md#runtime-dependencies#runtime-dependencies +# - https://github.com/docker/packaging/blob/0ba325d178593583f190dc91566214a85c3880ad/pkg/docker-engine/deb/control#L24-L36 RUN set -eux; \ apk add --no-cache \ ip6tables \ diff --git a/Dockerfile-dind.template b/Dockerfile-dind.template index e671bcdae..1767d0bf4 100644 --- a/Dockerfile-dind.template +++ b/Dockerfile-dind.template @@ -1,8 +1,9 @@ {{ include "shared" -}} FROM docker:{{ env.version }}-cli -# https://github.com/moby/moby/blob/0eecd59153c03ced5f5ddd79cc98f29e4d86daec/project/PACKAGERS.md#runtime-dependencies -# https://github.com/docker/docker-ce-packaging/blob/963aa02666035d4e268f33c63d7868d6cdd1d34c/deb/common/control#L28-L41 +# Runtime dependencies: +# - https://github.com/moby/moby/blob/864598f8c2677189e308eb4a3b3c0dd41fc06599/project/PACKAGERS.md#runtime-dependencies#runtime-dependencies +# - https://github.com/docker/packaging/blob/0ba325d178593583f190dc91566214a85c3880ad/pkg/docker-engine/deb/control#L24-L36 RUN set -eux; \ apk add --no-cache \ ip6tables \ From 5500fe3af2d5436cba77c707d0cd085d41b94337 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 17:36:34 +0200 Subject: [PATCH 5/6] remove containerd, ctr and use embedded containerd before/after: docker image ls dind IMAGE ID DISK USAGE CONTENT SIZE EXTRA dind:before 6f84404d1f9d 528MB 137MB dind:latest 5ac80767b941 436MB 112MB Signed-off-by: Sebastiaan van Stijn --- 29/dind/Dockerfile | 4 ++-- 29/dind/dockerd-entrypoint.sh | 2 ++ Dockerfile-dind.template | 4 ++-- dockerd-entrypoint.sh | 2 ++ 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/29/dind/Dockerfile b/29/dind/Dockerfile index a6a1802fb..b69f974ac 100644 --- a/29/dind/Dockerfile +++ b/29/dind/Dockerfile @@ -80,12 +80,12 @@ RUN set -eux; \ --no-same-owner \ # we exclude the CLI binary because we already extracted that over in the "docker:29-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer --exclude 'docker/docker' \ + --exclude 'docker/containerd' \ + --exclude 'docker/ctr' \ ; \ rm docker.tgz; \ \ dockerd --version; \ - containerd --version; \ - ctr --version; \ runc --version # https://github.com/docker/docker/tree/master/hack/dind diff --git a/29/dind/dockerd-entrypoint.sh b/29/dind/dockerd-entrypoint.sh index 77ff1aab3..ad0a663f8 100755 --- a/29/dind/dockerd-entrypoint.sh +++ b/29/dind/dockerd-entrypoint.sh @@ -124,6 +124,7 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2376 \ + --feature "embedded-containerd" \ --tlsverify \ --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ @@ -135,6 +136,7 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2375 \ + --feature "embedded-containerd" \ "$@" DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" fi diff --git a/Dockerfile-dind.template b/Dockerfile-dind.template index 1767d0bf4..ab3abddee 100644 --- a/Dockerfile-dind.template +++ b/Dockerfile-dind.template @@ -65,12 +65,12 @@ RUN set -eux; \ --no-same-owner \ # we exclude the CLI binary because we already extracted that over in the "docker:{{ env.version }}-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer --exclude 'docker/docker' \ + --exclude 'docker/containerd' \ + --exclude 'docker/ctr' \ ; \ rm docker.tgz; \ \ dockerd --version; \ - containerd --version; \ - ctr --version; \ runc --version # https://github.com/docker/docker/tree/master/hack/dind diff --git a/dockerd-entrypoint.sh b/dockerd-entrypoint.sh index 77ff1aab3..ad0a663f8 100755 --- a/dockerd-entrypoint.sh +++ b/dockerd-entrypoint.sh @@ -124,6 +124,7 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2376 \ + --feature "embedded-containerd" \ --tlsverify \ --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ @@ -135,6 +136,7 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2375 \ + --feature "embedded-containerd" \ "$@" DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" fi From a073bca9030dc47807ecaa6cda73c01d0d470c24 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 4 Sep 2026 14:53:17 +0200 Subject: [PATCH 6/6] fixup! remove containerd, ctr and use embedded containerd Signed-off-by: Sebastiaan van Stijn --- 29/dind/dockerd-entrypoint.sh | 2 -- dockerd-entrypoint.sh | 2 -- 2 files changed, 4 deletions(-) diff --git a/29/dind/dockerd-entrypoint.sh b/29/dind/dockerd-entrypoint.sh index ad0a663f8..77ff1aab3 100755 --- a/29/dind/dockerd-entrypoint.sh +++ b/29/dind/dockerd-entrypoint.sh @@ -124,7 +124,6 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2376 \ - --feature "embedded-containerd" \ --tlsverify \ --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ @@ -136,7 +135,6 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2375 \ - --feature "embedded-containerd" \ "$@" DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" fi diff --git a/dockerd-entrypoint.sh b/dockerd-entrypoint.sh index ad0a663f8..77ff1aab3 100755 --- a/dockerd-entrypoint.sh +++ b/dockerd-entrypoint.sh @@ -124,7 +124,6 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2376 \ - --feature "embedded-containerd" \ --tlsverify \ --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ @@ -136,7 +135,6 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2375 \ - --feature "embedded-containerd" \ "$@" DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" fi