From efd756df6c7ebf4fdba5b7c02e3004857ea45bc5 Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Wed, 17 Jun 2026 10:59:48 +0000
Subject: [PATCH] Reducing size with late cleanup

---
 diskless.pkr.hcl | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index 3104dc7..09eef9b 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -341,6 +341,25 @@ build {
     ]
   }
 
+  # --- 2d. Final image hygiene: strip caches/logs after the LAST dnf step --
+  # MUST be the last provisioner. The `dnf clean all` in step 2 runs BEFORE the
+  # kiosk (2b) and admin (2c) provisioners, and 2b enables EPEL + installs
+  # weston/chromium/mesa — repopulating /var/cache/dnf (EPEL metadata alone is
+  # ~100MB+). This tree becomes the read-only, UNCOMPRESSED erofs served over
+  # NVMe/TCP, so every cache byte is dead weight read on every boot of every
+  # host. Clear the repo *cache* dirs only — never /var/lib/rpm or
+  # /var/lib/dnf/history (the rpmdb keeps the image introspectable/patchable).
+  provisioner "shell" {
+    inline = [
+      "set -eux",
+      "dnf clean all",
+      "rm -rf /var/cache/dnf/* /var/cache/PackageKit /var/cache/ldconfig/*",
+      "rm -rf /var/lib/dnf/repos/* /var/log/dnf.* /var/log/hawkey.log",
+      "rm -rf /var/tmp/* /tmp/*",
+      "truncate -s 0 /var/log/messages /var/log/secure 2>/dev/null || true",
+    ]
+  }
+
   # --- 3. Extract kernel, initramfs, rootfs from the built disk ------------
   # --- 4. Assemble + sign the UKI; build the OCI release-artifact image ----
   post-processor "shell-local" {