Skip to content

Ship only runtime files in the nginx image's static tree - #16102

Merged
devGregA merged 3 commits into
DefectDojo:bugfixfrom
devGregA:fix/nginx-static-nested-lockfiles
Sep 27, 2026
Merged

devGregA merged 3 commits into
DefectDojo:bugfixfrom
devGregA:fix/nginx-static-nested-lockfiles

Conversation

@devGregA

@devGregA devGregA commented Sep 27, 2026 •

Copy link
Copy Markdown
Contributor

Description

The nginx image copies all of components/node_modules into /usr/share/nginx/html/static/ through collectstatic, so it ships a lot that no page loads: the Tailwind CSS toolchain (the tailwind cli, lightningcss and their prebuilt native binaries), source maps, TypeScript sources and declarations, and the npm lockfiles a couple of packages include in their tarballs. This trims the static tree to the files the UI uses.

  • Dev-only toolchain. After yarn build:css, yarn install --production --ignore-scripts removes the devDependencies (34 packages) before static is collected. The compiled tailwind-out.css is unaffected.
  • Build artifacts. collectstatic now skips *.map, *.ts, *.mts, *.cts and the four npm lockfile names. The default ignore patterns still apply.
  • nanoid. Updates the nanoid 3.x entry in components/yarn.lock to 3.3.19.
  • API v3 reference page. Scalar turns on its hosted "Ask AI" assistant by default. The page now passes data-configuration='{"agent": {"disabled": true}}', so it stays self-contained, consistent with serving the bundle from our own static files rather than a CDN. The rest of the page is unchanged.

Result on the nginx image: the static tree goes from 49,920 files to 31,191, with no .map, .ts, lockfile or native binary left, and it is about 200 MB smaller on disk.

Test results

  • Built Dockerfile.nginx-alpine locally (linux/arm64). The build succeeds and tailwind-out.css is present.
  • Every {% static %} path referenced from dojo/templates that exists in the current image still exists after the change.
  • Checked that none of the skipped .map files are anything other than source maps, and that no shipped JS loads a .ts file at runtime.
  • Ran collectstatic on Django 5.2.16 (the pinned version) with these flags over a test tree: every skipped pattern is dropped at any depth; package.json, JavaScript and default-ignored dotfiles behave as before.
  • Loaded the pinned Scalar bundle with the page's exact HTML shell in a browser: the reference renders from data-url, "Test Request" works, the "Ask AI" controls are gone, and no request leaves the host.
  • Added test_hosted_ai_assistant_is_disabled to unittests/api_v3/test_apiv3_reference_docs.py. I did not run the unit test suite locally; CI runs it. ruff check (0.16.5, repo config) passes on the changed files.

Documentation

No documentation change needed.

🤖 Generated with Claude Code

@devGregA devGregA added this to the 3.3.300 milestone Sep 27, 2026
devGregA and others added 3 commits September 26, 2026 21:40
Once the Tailwind CSS is built, reinstall components with --production so
the CSS toolchain (tailwind cli, lightningcss and their prebuilt native
binaries) is not collected, and have collectstatic skip source maps,
TypeScript sources and declarations, and the npm lockfiles some packages
ship in their tarballs. None of these are loaded by any page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… page

Scalar enables its "Ask AI" assistant by default, which is a third-party
hosted service. Disable it through data-configuration so the page stays
self-contained, the same reason the bundle is served from our own static
files instead of a CDN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devGregA devGregA changed the title Skip npm lockfiles when collecting static for the nginx image Ship only runtime files in the nginx image's static tree Sep 27, 2026
@devGregA
devGregA force-pushed the fix/nginx-static-nested-lockfiles branch from 2b50c0f to 1ad6158 Compare September 27, 2026 03:40
@devGregA
devGregA merged commit 33b7e38 into DefectDojo:bugfix Sep 27, 2026
48 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant