build(ws-server): -trimpath -ldflags="-s -w" (RFC#563) #1570

Merged

hongming merged 1 commits from feat/rfc563-ws-server-binary-strip into main 2026-05-19 19:51:16 +00:00

Conversation 2 Commits 1 Files Changed 2

+27 -4

core-be commented 2026-05-19 19:04:02 +00:00

Member

Copy Link

Copy Source

Summary

Add -trimpath -ldflags="-s -w" to the go build invocations in
workspace-server/Dockerfile and workspace-server/Dockerfile.tenant,
mirroring the pattern already in
molecule-controlplane/Dockerfile.

Implements the workspace-server piece of RFC molecule-ai/internal#563.

Empirical measurement

Local build, CGO_ENABLED=0 GOOS=linux GOARCH=amd64, go 1.26.3,
/platform binary only (host: core-be, mac):

metric	before	after	delta
bytes	44,669,544	31,191,202	-13,478,342
MB	42	29	-12
%	—	—	-30.2%

RFC#563 reports the published image deltas as 87 -> 61 MB (-26 MB, ~29%) —
the per-image figure is larger than per-binary because both /platform
and /memory-plugin are stripped, plus the binary is just one layer
of a multi-layer image.

Flag semantics

• -trimpath — strip absolute build-host paths from object code (also
  improves reproducibility)
• -ldflags "-s -w" — linker drops the symbol table (-s) and DWARF
  debug info (-w)
• -X .../buildinfo.GitSHA=${GIT_SHA} is preserved inside the same
  -ldflags string; -X-injected strings live in static data, not the
  symbol table, so they survive -s. Verified locally:

  $ strings /tmp/platform-after | grep rfc563-bench
  rfc563-bench
  

Scope

Single-purpose: only workspace-server/Dockerfile +
workspace-server/Dockerfile.tenant touched. No behavioural change
to the binaries; no other build args, base images, or CI workflow
changes in this PR.

Test plan

• CI green (publish-workspace-server-image.yml etc.)
• Pull the resulting image, exec /platform -version (or call
  /buildinfo) and confirm GitSHA still reports the workflow's
  ${{ github.sha }} — i.e. stripping did not erase the
  -X-injected build var
• Compare docker image inspect sizes pre/post to confirm the
  RFC#563 ~26MB delta on the final image (not just the binary)

Notes

• Not a behavioural change; reviewer should confirm flag pattern
  matches CP-side Dockerfile (it does) and that -X semantics under
  -s -w are correctly understood (they are — see Go linker docs).
• DO NOT merge until 2-eye review per CTO standing rule.

## Summary Add `-trimpath -ldflags="-s -w"` to the `go build` invocations in `workspace-server/Dockerfile` and `workspace-server/Dockerfile.tenant`, mirroring the pattern already in [`molecule-controlplane/Dockerfile`](https://git.moleculesai.app/molecule-ai/molecule-controlplane/src/branch/main/Dockerfile#L6). Implements the workspace-server piece of **RFC molecule-ai/internal#563**. ## Empirical measurement Local build, `CGO_ENABLED=0 GOOS=linux GOARCH=amd64`, go 1.26.3, `/platform` binary only (host: `core-be`, mac): | metric | before | after | delta | |---------|---------------|---------------|-------------------| | bytes | 44,669,544 | 31,191,202 | -13,478,342 | | MB | 42 | 29 | -12 | | % | — | — | -30.2% | RFC#563 reports the published *image* deltas as **87 -> 61 MB (-26 MB, ~29%)** — the per-image figure is larger than per-binary because both `/platform` **and** `/memory-plugin` are stripped, plus the binary is just one layer of a multi-layer image. ## Flag semantics - `-trimpath` — strip absolute build-host paths from object code (also improves reproducibility) - `-ldflags "-s -w"` — linker drops the symbol table (`-s`) and DWARF debug info (`-w`) - `-X .../buildinfo.GitSHA=${GIT_SHA}` is **preserved** inside the same `-ldflags` string; `-X`-injected strings live in static data, not the symbol table, so they survive `-s`. Verified locally: ``` $ strings /tmp/platform-after | grep rfc563-bench rfc563-bench ``` ## Scope Single-purpose: only `workspace-server/Dockerfile` + `workspace-server/Dockerfile.tenant` touched. No behavioural change to the binaries; no other build args, base images, or CI workflow changes in this PR. ## Test plan - [ ] CI green (publish-workspace-server-image.yml etc.) - [ ] Pull the resulting image, exec `/platform -version` (or call `/buildinfo`) and confirm `GitSHA` still reports the workflow's `${{ github.sha }}` — i.e. stripping did not erase the `-X`-injected build var - [ ] Compare `docker image inspect` sizes pre/post to confirm the RFC#563 ~26MB delta on the final image (not just the binary) ## Notes - Not a behavioural change; reviewer should confirm flag pattern matches CP-side Dockerfile (it does) and that `-X` semantics under `-s -w` are correctly understood (they are — see Go linker docs). - DO NOT merge until 2-eye review per CTO standing rule.

core-be added 1 commit 2026-05-19 19:04:02 +00:00

build(ws-server): add -trimpath -ldflags="-s -w" for smaller image (RFC#563) ... 244263430d

Mirror the pattern already used in molecule-controlplane/Dockerfile.
Currently workspace-server only sets -X buildinfo.GitSHA; add -trimpath
plus -s -w (strip symbol table + DWARF debug info) inside the same
-ldflags string. The -X GitSHA injection is preserved (verified via
strings(1) on locally-built binary).

Empirical local measurement (CGO_ENABLED=0 GOOS=linux GOARCH=amd64,
go 1.26.3, /platform binary only):

  before  44,669,544 bytes  (42 MB)
  after   31,191,202 bytes  (29 MB)
  delta   13,478,342 bytes  (12 MB) — 30.2% reduction

RFC#563 reports the published *image* deltas as 87 -> 61 MB (-26 MB,
~29%); the per-image figure is larger than the per-binary figure
because both /platform and /memory-plugin are stripped, and the
binary is one layer of the multi-layer image.

Flag semantics (Go 1.26):
  -trimpath          strip absolute build-host paths from object code
                     (also improves reproducibility)
  -ldflags "-s -w"   linker drops symbol table (-s) and DWARF debug
                     info (-w); -X-injected strings are NOT in the
                     symbol table so GitSHA survives stripping

Single-purpose change: only ws-server Dockerfile + Dockerfile.tenant
touched; no behavioral changes to the binaries themselves.

core-qa approved these changes 2026-05-19 19:12:19 +00:00

core-qa left a comment

Member

Copy Link

Copy Source

mc#1570 RFC#563 ws-server -trimpath/-s/-w. Pattern mirrors molecule-controlplane/Dockerfile. Diff Dockerfile-only; -X-injected GitSHA preserved (per RFC and verified locally by author). No behavioral change. QA APPROVE.

mc#1570 RFC#563 ws-server -trimpath/-s/-w. Pattern mirrors molecule-controlplane/Dockerfile. Diff Dockerfile-only; -X-injected GitSHA preserved (per RFC and verified locally by author). No behavioral change. QA APPROVE.

core-security approved these changes 2026-05-19 19:12:20 +00:00

core-security left a comment

Member

Copy Link

Copy Source

mc#1570 RFC#563 ws-server binary strip (-trimpath, -s, -w). Build-time only, no behavioral change. Strips debug symbols + build-host paths (privacy improvement). GitSHA via -X preserved. Security APPROVE.

mc#1570 RFC#563 ws-server binary strip (-trimpath, -s, -w). Build-time only, no behavioral change. Strips debug symbols + build-host paths (privacy improvement). GitSHA via -X preserved. Security APPROVE.

hongming merged commit 302235da23 into main 2026-05-19 19:51:16 +00:00

hongming referenced this issue from a commit 2026-05-19 19:51:17 +00:00

Merge pull request 'build(ws-server): -trimpath -ldflags="-s -w" (RFC#563)' (#1570) from feat/rfc563-ws-server-binary-strip into main

Sign in to join this conversation.

Reviewers

No Reviewers

core-qa

core-security

Labels

Clear labels

area/ci

CI/CD pipeline issues

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#1570