Speed up invalidated packaging image rebuilds

[ndizazzo]

Summary

• add stable, locked BuildKit caches for apt, apk, and pacman package state
• scope runtime cache IDs by distro, architecture, backend, and backend version
• retain package-manager downloads independently of Docker layer invalidation
• document the invalidated-layer timing result

Measured impact

Native Ubuntu ARM64 package builds with the package-manager layer invalidated:

Revision	First rebuild	Second rebuild
main	17s	14s
This branch	13s	13s

The conservative second-run comparison is 7.1% faster.

Validation

• packaging matrix and release planner validation
• 88 TypeScript tests, including the 100% matrix coverage gate
• ShellCheck and shell syntax checks
• actionlint and release-path policy scan
• BuildKit checks for Ubuntu and Alpine package/runtime targets
• amd64 Arch package/runtime check covered by the green precheck at the current base
• actual Alpine ARM64 native-package build

Summary by CodeRabbit

• Performance

  • Improved container build and rebuild times by preserving package downloads and indexes between builds.
  • Added architecture-, distribution-, backend-, and version-specific caching to improve cache reliability.
  • Enhanced cache performance for ARM64 Ubuntu builds.

• Bug Fixes

  • Prevented package caches from being unnecessarily cleared during dependency installation.
  • Improved package installation behavior across Ubuntu, Alpine, and Arch-based environments.

[coderabbitai]

Warning

Review limit reached

@ndizazzo, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 51 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: df185424-8875-488b-ab5a-97d85968b988

📥 Commits

Reviewing files that changed from the base of the PR and between d9f9e11 and 4b23224.

📒 Files selected for processing (1)

• TODO.md

📝 Walkthrough

Walkthrough

Package-manager caches now persist outside Docker layers. Build and runtime stages use stable, architecture- and distribution-specific BuildKit cache mounts. Installer scripts retain APT, APK, and Pacman cache data.

Changes

Package-manager cache persistence

Layer / File(s)	Summary
Retain package-manager cache data docker/install-native-package.sh, docker/install-package-build-deps.sh, docker/install-runtime-deps.sh	Ubuntu retains APT lists, Alpine uses /var/cache/apk, and Arch stops clearing the Pacman cache.
Wire scoped BuildKit cache mounts docker/Dockerfile.mesh-llm, TODO.md	Build and runtime stages use locked cache mounts keyed by distribution, architecture, backend, and version. The TODO records validation and ARM64 timing results.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Dockerfile.mesh-llm
  participant BuildKit
  participant Package installers
  participant APT APK Pacman
  Dockerfile.mesh-llm->>BuildKit: Mount scoped package caches
  BuildKit->>Package installers: Run dependency installation
  Package installers->>APT APK Pacman: Update indexes and install packages
  APT APK Pacman-->>BuildKit: Retain package data in mounted caches

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: improving rebuild speed when packaging image layers are invalidated.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/buildkit-cache-mounts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

docker/install-runtime-deps.sh (1)

50-50: 🩺 Stability & Availability | 🔵 Trivial

Configure retention for persistent package caches.

The removed pacman -Scc no longer bounds the Arch package cache. APT and APK caches are also retained. Ensure that BuildKit garbage collection or a scheduled prune limits old package versions. Otherwise, long-lived builders can exhaust disk space.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/install-runtime-deps.sh` at line 50, Configure retention for
persistent package caches in the runtime dependency installation flow: add
BuildKit garbage-collection settings or a scheduled prune covering pacman, APT,
and APK caches, with limits that remove old package versions while preserving
the intended cache behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@TODO.md`:
- Around line 3-5: Update the completed cache-persistence item in TODO.md to
describe the two cache scopes separately: native package cache IDs are
partitioned by DISTRO and TARGET_ARCH, while runtime cache IDs are additionally
partitioned by BACKEND and BACKEND_VERSION. Keep the wording aligned with the
identifiers used in docker/Dockerfile.mesh-llm.

---

Nitpick comments:
In `@docker/install-runtime-deps.sh`:
- Line 50: Configure retention for persistent package caches in the runtime
dependency installation flow: add BuildKit garbage-collection settings or a
scheduled prune covering pacman, APT, and APK caches, with limits that remove
old package versions while preserving the intended cache behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cdd41d9a-5b9b-4c3f-926e-2bd9283ecf16

📥 Commits

Reviewing files that changed from the base of the PR and between df09909 and d9f9e11.

📒 Files selected for processing (5)

• TODO.md
• docker/Dockerfile.mesh-llm
• docker/install-native-package.sh
• docker/install-package-build-deps.sh
• docker/install-runtime-deps.sh