Follow-up from #964, deliberately left out of scope there.
What
#964 added a narrow ctx-build stage (build_files + image-versions.yml only) so the package-install stage stops being invalidated by unrelated edits. While verifying that fix, testing confirmed the same class of problem remains in the other stages:
Stage 2 and the ISO stage still mount from the wide ctx, which carries both build_files/ and system_files/. Buildah folds the mounted stage's image ID into the consuming RUN's cache key, so any edit to either directory invalidates both stages together.
Why it matters
The Containerfile documents a "saves 20-80 min" benefit from granular layer caching. That benefit is only partially realised while these stages share a wide context — a system_files-only change still pays for work it cannot have affected.
Fix
Give each stage a context stage narrow enough to cover only what it actually reads, following the ctx-build pattern established in #964.
Verification
The approach used in #964: build twice against isolated --root stores with a local registry cache, change only one input directory, and confirm the unaffected stage reports a cache hit.
Automatable: yes
Follow-up from #964, deliberately left out of scope there.
What
#964 added a narrow
ctx-buildstage (build_files+image-versions.ymlonly) so the package-install stage stops being invalidated by unrelated edits. While verifying that fix, testing confirmed the same class of problem remains in the other stages:Stage 2 and the ISO stage still mount from the wide
ctx, which carries bothbuild_files/andsystem_files/. Buildah folds the mounted stage's image ID into the consumingRUN's cache key, so any edit to either directory invalidates both stages together.Why it matters
The Containerfile documents a "saves 20-80 min" benefit from granular layer caching. That benefit is only partially realised while these stages share a wide context — a
system_files-only change still pays for work it cannot have affected.Fix
Give each stage a context stage narrow enough to cover only what it actually reads, following the
ctx-buildpattern established in #964.Verification
The approach used in #964: build twice against isolated
--rootstores with a local registry cache, change only one input directory, and confirm the unaffected stage reports a cache hit.Automatable: yes