wip: apply some cleanups

Signed-off-by: Mateusz Gozdek <mgozdek@microsoft.com>

Author: invidian

targets/linux/deb/distro/container.go

@@ -265,12 +265,6 @@ for f in $(echo "${deb_files}" | tr ' ' '\n' | grep -E '/(usrmerge|usr-is-merged
     # Remove the deb file so it won't be re-installed.
     rm "${f}"
 done
-
-# Copy apt sources from worker into rootfs so the final container can install packages. Do we want that?
-# There is no guarantee that the final image will have access to the same sources worker had (e.g. with  mounted repos).
-#
-# At the moment this is necessary so we can for example install test dependencies without using worker image.
-#cp -ar /etc/apt/sources.list* "${rootfs}/etc/apt/"
 `
 
 	opts = append(opts, dalec.ProgressGroup("Fetch DEB Packages"))
@@ -290,9 +284,124 @@ done
 		frontend.IgnoreCache(input.Client, targets.IgnoreCacheKeyContainer),
 	).AddMount("/tmp/rootfs", baseImageFromSpec(baseImg, input))
 
-	return baseImg.With(installPackagesInContainer(input, []llb.RunOption{
+	result := baseImg.With(installPackagesInContainer(input, []llb.RunOption{
 		dalec.ProgressGroup("Install DEB Packages"),
 		llb.AddEnv("DEBIAN_FRONTEND", "noninteractive"),
 		llb.Args([]string{"/usr/bin/sh", "-c", "dpkg --install --force-depends /var/cache/apt/archives/*.deb && rm -rf /var/cache/apt/archives/*.deb"}),
 	}))
+
+	result = cleanupBootstrapContainer(result, input, opts...)
+
+	// Squash all layers into one by copying the final filesystem into a fresh
+	// scratch state. Without this, files extracted in the bootstrap layer but
+	// removed during cleanup still occupy space in the earlier layer.
+	squashOpts := append(opts, dalec.ProgressGroup("Squash container layers"))
+	return llb.Scratch().File(llb.Copy(result, "/", "/", &llb.CopyInfo{
+		CopyDirContentsOnly: true,
+		CreateDestPath:      true,
+		AllowWildcard:       true,
+	}), squashOpts...)
+}
+
+// cleanupBootstrapContainer removes package manager infrastructure, unnecessary
+// packages, and caches from the container image.
+func cleanupBootstrapContainer(st llb.State, input buildContainerInput, opts ...llb.ConstraintsOpt) llb.State {
+	cleanupOpts := append(opts, dalec.ProgressGroup("Cleanup Bootstrap Container"))
+
+	hasDocs := input.Spec.GetArtifacts(input.Target).HasDocs()
+
+	// Directories to remove.
+	rmDirsCmd := `rm -rf /var/lib/apt /var/cache/apt /var/log/apt /var/log/dpkg.log \
+    /var/cache/debconf /etc/apt \
+    /usr/lib/apt /usr/share/apt \
+    /usr/share/debconf /usr/share/bug /usr/share/lintian /usr/share/bash-completion \
+    /usr/share/locale`
+	if !hasDocs {
+		rmDirsCmd += ` \
+    /usr/share/doc /usr/share/man /usr/share/info`
+	}
+
+	script := `#!/bin/sh
+
+# --- Remove directories ---
+` + rmDirsCmd + `
+
+# --- Remove unnecessary packages ---
+
+
+# Helper: collect installed packages from a candidate list.
+collect_installed() {
+    result=""
+    for pkg in $@; do
+        if dpkg-query -W -f='${Status}' "${pkg}" 2>/dev/null | grep -q 'install ok installed'; then
+            result="${result} ${pkg}"
+        fi
+    done
+    echo "${result}"
+}
+
+# Phase 1: Purge apt and packages whose removal scripts may load shared libs.
+phase1=$(collect_installed \
+    apt apt-utils libapt-pkg6.0 libapt-pkg7.0 \
+    debconf debconf-i18n libdebconfclient0 \
+    debian-archive-keyring ubuntu-keyring \
+    passwd login.defs base-passwd \
+    bash-completion manpages sensible-utils sqv \
+    ncurses-base ncurses-bin \
+    perl-base libtext-charwidth-perl libtext-iconv-perl libtext-wrapi18n-perl \
+    liblocale-gettext-perl \
+    bash sed debianutils findutils mawk \
+    bsdutils bsdextrautils util-linux sysvinit-utils \
+    init-system-helpers \
+    libpam-modules libpam-modules-bin libpam-runtime libpam0g \
+    libdb5.3 libdb5.3t64 libsqlite3-0 \
+    libaudit-common libaudit1 \
+    liblastlog2-2 \
+)
+
+if [ -n "${phase1}" ]; then
+    dpkg --purge --force-depends --force-remove-essential ${phase1} || true
+fi
+
+# Phase 2: Remove low-level libraries that phase 1 packages depended on.
+phase2=$(collect_installed \
+    libsemanage-common libsemanage2 \
+    libsystemd0 libudev1 \
+    libseccomp2 \
+    libmount1 libblkid1 libsmartcols1 \
+    libcap-ng0 \
+    libtinfo6 \
+    grep \
+    hostname \
+    gzip
+)
+
+if [ -n "${phase2}" ]; then
+    dpkg --purge --force-depends --force-remove-essential ${phase2} || true
+fi
+
+# Phase 3: Remove dpkg, its libraries, coreutils, dash, and remaining tools
+# in a single dpkg invocation. Once dpkg is loaded in memory, it won't
+# re-read the shared libraries, so removing them in the same call is safe.
+# dash is the shell running this script — the kernel keeps the fd open.
+# dpkg uses --remove (not --purge) to preserve /var/lib/dpkg/status
+# for security scanners.
+dpkg --remove --force-depends --force-remove-essential \
+    diffutils \
+    libbsd0 libmd0 libselinux1 libsepol2 libpcre2-8-0 \
+    libacl1 libattr1 libcap2 \
+    libbz2-1.0 liblz4-1 liblzma5 libxxhash0 \
+    libuuid1 libcrypt1 tar dash coreutils \
+    dpkg || true
+`
+
+	scriptSt := llb.Scratch().File(llb.Mkfile("cleanup.sh", 0o755, []byte(script)), cleanupOpts...)
+
+	st = st.Run(
+		dalec.WithConstraints(cleanupOpts...),
+		llb.AddMount("/tmp/dalec-cleanup.sh", scriptSt, llb.SourcePath("cleanup.sh"), llb.Readonly),
+		llb.Args([]string{"/usr/bin/sh", "/tmp/dalec-cleanup.sh"}),
+	).Root()
+
+	return st
 }