Skip to content

clean-package-cache

apt, apk and yum caches bloat Docker images unless removed in the same RUN layer. The cleanup pattern for each package manager.

On this page

Package managers keep an index and download cache after installing — tens to hundreds of megabytes that a container image will never use. And because Docker layers are append-only, deleting the cache in a later instruction removes nothing: the bytes are already committed. This rule flags package installs whose RUN doesn't clean the cache in the same layer.

What the rule catches

Dockerfile — index cache committed into the layer
FROM debian:12-slim
RUN apt-get update && apt-get install -y curl

Scanning this file reports:

⚠ WARN [docker-doctor/clean-package-cache]
  Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.

Why it matters

This is the most common avoidable image bloat, and the layer mechanics make the intuitive fix wrong — a separate RUN rm -rf /var/lib/apt/lists/* line makes the image larger (it adds a layer that merely hides files). The cleanup only counts if it happens inside the same RUN as the install, so the layer is committed already clean. Same principle behind minimize-layers, applied to the single worst offender.

How to fix it

For apt-get, append && rm -rf /var/lib/apt/lists/*. For apk, use apk add --no-cache. For dnf/yum, run yum clean all.

Dockerfile — layer committed already clean
FROM debian:12-slim
RUN apt-get update \
  && apt-get install -y --no-install-recommends curl \
  && rm -rf /var/lib/apt/lists/*

The pattern per package manager:

  • apt-get — append && rm -rf /var/lib/apt/lists/*
  • apk — use apk add --no-cache <pkg> (no cleanup step needed)
  • dnf / yum — append && dnf clean all / && yum clean all
  • pip — use pip install --no-cache-dir <pkg>
  • npm — prefer npm ci, which is cache-friendly; add && npm cache clean --force after plain npm install

Rule details

  • Rule key — docker-doctor/clean-package-cache
  • Category — Image Size
  • Default severity — warning
  • Applies to — Dockerfiles

Explain this rule from the CLI:

npx @docker-doctor/cli@latest rules explain docker-doctor/clean-package-cache

Change its severity — or turn it off — in your config file:

// docker-doctor.config.ts
export default {
  rules: {
    "docker-doctor/clean-package-cache": "off",
  },
};

Severity affects the health score: error findings cost more points than warning, and info costs the least.