From 6e72c6811da3bdbcd9c15380b1e849584db0c579 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sat, 18 Apr 2026 11:00:06 -0500
Subject: [PATCH] fix(docker): keep apt cache from filling /var disk during
 build

The cdo install pulls ~1 GB of transitive deps (netCDF/HDF5/ecCodes/
Fortran) and was exhausting CI's /var/cache/apt partition. Two fixes:

- `APT::Keep-Downloaded-Packages=false` deletes each .deb immediately
  after it's extracted, so the archive cache doesn't retain every
  downloaded package through the end of the install.

- Split cdo into its own RUN layer so the base runtime deps finish
  installing and clean before cdo's cache starts growing.
---
 Dockerfile | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a7000f5e..2356dbe3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -142,11 +142,25 @@ FROM ${RUNNER_IMAGE} AS final
 # compile cache. Read at runtime by Microwaveprop.Application.build_timestamp/0.
 ARG BUILD_TIMESTAMP=unknown
 
+# Base runtime deps, without cdo. `APT::Keep-Downloaded-Packages=false`
+# deletes each .deb immediately after install so apt's archive cache
+# doesn't pile up and OOM the /var/cache/apt disk partition the CI
+# builder runs on.
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
+  && apt-get -o APT::Keep-Downloaded-Packages=false install -y --no-install-recommends \
      libstdc++6 openssl libncurses6 locales ca-certificates snmp \
-     libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7 cdo \
-  && rm -rf /var/lib/apt/lists/*
+     libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7 \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
+
+# cdo is ~1 GB of transitive deps (netCDF, HDF5, ecCodes, Fortran
+# runtime). Splitting into its own RUN layer means the base deps above
+# are already extracted + pruned before the cdo cache starts filling,
+# which is what kept the image under the 2 GB CI disk cap.
+RUN apt-get update \
+  && apt-get -o APT::Keep-Downloaded-Packages=false install -y --no-install-recommends cdo \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
 
 RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen