Tell apt-get to actually autoremove everything it should

[md5]

I just discovered today that autoremove doesn't remove packages that are required or suggested by any installed package, even if the package that auto-installed them gets removed.

I ended up adding -o APT::AutoRemove::RecommendsImportant=false -o APT::AutoRemove::SuggestsImportant=false in nginx-proxy/docker-gen#66 to get apt-get to remove additional packages that it wasn't removing otherwise.

I'm sure there are other images where this change would make sense, but I thought I'd start with php.

[md5]

Before:

+ apt-get purge -y --auto-remove bzip2 file libcurl4-openssl-dev libreadline6-dev libssl-dev libxml2-dev
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be REMOVED:
  bzip2* file* libcurl4-openssl-dev* libmagic1* libreadline6-dev* libssl-dev*
  libtinfo-dev* libxml2-dev* zlib1g-dev*

After:

+ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false -o APT::AutoRemove::SuggestsImportant=false bzip2 file libcurl4-openssl-dev libreadline6-dev libssl-dev libxml2-dev
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be REMOVED:
  bzip2* file* libc-dev-bin* libc6-dev* libcurl4-openssl-dev* libmagic1*
  libreadline6-dev* libssl-dev* libtinfo-dev* libxml2-dev* linux-libc-dev*
  zlib1g-dev*

[tianon]

I really like this a lot, and it explains some odd behavior. What I don't get is why these default to such seemingly non-intuitive values upstream. 😕 I guess they're trying to err on the side of "don't remove too much" ?

[md5]

Yeah, I was really puzzled why installing and removing curl and ca-certificates on top of debian:jessie was leaving behind libsasl2 and libssl.

I've got a really rough tool at md5/docker-find that I've been using to track down what's inside the layers of an image or container.

[yosifkit]

I just always assume that they are not as good as Portage. 😉 🔥🎣

This looks good to me but the apt-get clean is not necessary, because it is already built in to apt-get update.

[md5]

I dropped the apt-get clean, although that's the first I've seen of that particular voodoo magic...

[yosifkit]

LGTM

[tianon]

I know @paultag will lololol when he sees [php] ... in his inbox, but hopefully he has a second to comment on whether this might be reasonable to include in the Debian base image (https://aptitude.alioth.debian.org/doc/en/ch02s05s05.html Apt::AutoRemove::RecommendsImportant and Apt::AutoRemove::SuggestsImportant which tell apt-get autoremove that it's allowed to be more aggressive about removing Suggests and Recommends dependencies that are no longer necessary).

Regardless, it's 100% totally legit in this case, so LGTM.

[paultag]

Yeah, seems saneish; might let some folks shoot themselves in the foot at some point, but I think when you think about this in terms of it existing in a container -- how bad could it get :)

Plus, it'd never really hit runtime, just image build time, so it'd only fail if you didn't test it :)

👍

[tianon]

Cool, thanks @paultag. ❤️

I'll work up a PR to the debootstrap script in https://github.com/docker/docker with a new file and a nice new comment explaining why we do such strange things. 👍