chore: strip debug symbols from binary to reduce image size by 77 MB - #7028
Open
krishnakala987-byte wants to merge 1 commit into
Open
Conversation
Adds -s -w to the existing ldflags in the build target. The binary carried 721,193 symbols and eleven .debug_* sections, accounting for 77.6 MB of its 277 MB size. Binary: 277,213,440 B to 199,579,560 B (-28.0%) Image: 462 MB to 385 MB (-16.7%) The -X injections for GitCommit, BuildTime and ServerMode are unaffected, as they write to the data section rather than .symtab. Verified by extracting the injected build timestamp from the stripped binary with strings. Closes devtron-labs#2539 Signed-off-by: Krishna Kala <krishnakala987@gmail.com>
krishnakala987-byte
requested review from
prakarsh-dt and
vivek-devtron
as code owners
September 10, 2026 07:27
|
Bito Review Skipped - Source Branch Not Found |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One line in the Makefile
buildtarget.-s -wadded to the existing-ldflags, alongside the-Xinjections for GitCommit, BuildTime and ServerMode, which are unchanged.The binary was the largest single contributor to image size.
filereported it aswith debug_info, not stripped, andgo tool nmcounted 721,193 symbols. Section sizes fromreadelf:.symtaband.strtabat roughly 42 MB, the eleven.debug_*sections at roughly 35 MB.How Has This Been Tested?
docker build, once onmainand once with the change.fileon the new binary reportsstrippedwith nodebug_info.readelf -S | grep -cE "debug|symtab"returns 0.-Xinjections survive stripping:stringson the stripped binary still returns the injected build timestamp2026-09-08T06:45:08Z.dial tcp 127.0.0.1:5432: connect: connection refusedwith no database present. Same behaviour as the unstripped build.main.main()atmain.go:42,sql.NewDbConnectionatconnection.go:83), since Go symbolises from pclntab rather than.symtab.Tradeoff:
-wdrops DWARF, so attaching delve to the shipped image would no longer give source-level debugging. Runtime panics and stack traces are unaffected, as above. Flagging in case anything in the release workflow depends on debugging the published image.Out of scope, with reasoning in #2539: the perl dependency chain (git hard-depends on it, so
--no-install-recommendswould not remove it, and it would risk breaking SSH clone URLs by droppingopenssh-client), and apt cache cleanup (already handled in the existing Dockerfile).Question for reviewers: is there anything in the release or debugging workflow that reads symbols from the published binary? If so I can scope this to
-wonly, which still removes roughly 35 MB.Checklist:
Does this PR introduce a user-facing change?
No. The image is smaller and the binary is stripped. Runtime behaviour, the version endpoint and panic symbolisation are unchanged.