From fb7466941496281891088a82ea413dfc2f0af5f0 Mon Sep 17 00:00:00 2001
From: Octoturge <iwo@octoturge.com>
Date: Thu, 27 Aug 2026 11:14:36 +0200
Subject: [PATCH] Purge apt's downloaded .deb cache in every RUN, not just the
 package lists

Splitting the big RUN blocks (previous commit) got several layers under
the registry's per-blob size cap, but a few packages are still huge
enough on their own to fail - libopencv-dev came in at 793MB, Chrome at
1.08GB. Neither of those RUN blocks was clearing
/var/cache/apt/archives, only /var/lib/apt/lists, so each apt install's
downloaded .deb files were sitting in the layer alongside the unpacked
files. Worth trying before reaching for a Cloudflare-side fix.
---
 templates/web/Dockerfile | 33 ++++++++++++++++++++++-----------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/templates/web/Dockerfile b/templates/web/Dockerfile
index 709c746..e4a3933 100644
--- a/templates/web/Dockerfile
+++ b/templates/web/Dockerfile
@@ -11,7 +11,8 @@ ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
         locales sudo ca-certificates gnupg curl wget \
     && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 ENV LANG=en_US.UTF-8 \
     LANGUAGE=en_US:en \
@@ -28,7 +29,8 @@ RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
     && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
         > /etc/apt/sources.list.d/google-chrome.list \
     && apt-get update && apt-get install -y google-chrome-stable \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 # Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
 # X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
@@ -40,45 +42,54 @@ RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
 # large enough to blow past it if lumped together with everything else.
 RUN apt-get update && apt-get install -y --no-install-recommends \
         build-essential pkg-config cmake \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         clang llvm \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         git git-lfs jq unzip tar file htop tree tmux zsh openssh-client \
     && git lfs install --system \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         libssl-dev libpq-dev libsqlite3-dev \
         postgresql-client redis-tools sqlite3 \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev \
         libgtk-3-dev libsoup-3.0-dev \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         libx11-dev libxext-dev libxrender-dev libxtst-dev libxi-dev \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         python3 python3-pip python3-venv python3-dev \
         protobuf-compiler \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         libopencv-dev \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 # Node.js LTS (22.x) plus npm/pnpm/yarn as root so global bins land on the
 # system PATH for every user.
 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 
 RUN npm install -g pnpm yarn