Reducing size with late cleanup

diskless.pkr.hcl

@@ -341,6 +341,25 @@ build {
     ]
   }
 
+  # --- 2d. Final image hygiene: strip caches/logs after the LAST dnf step --
+  # MUST be the last provisioner. The `dnf clean all` in step 2 runs BEFORE the
+  # kiosk (2b) and admin (2c) provisioners, and 2b enables EPEL + installs
+  # weston/chromium/mesa — repopulating /var/cache/dnf (EPEL metadata alone is
+  # ~100MB+). This tree becomes the read-only, UNCOMPRESSED erofs served over
+  # NVMe/TCP, so every cache byte is dead weight read on every boot of every
+  # host. Clear the repo *cache* dirs only — never /var/lib/rpm or
+  # /var/lib/dnf/history (the rpmdb keeps the image introspectable/patchable).
+  provisioner "shell" {
+    inline = [
+      "set -eux",
+      "dnf clean all",
+      "rm -rf /var/cache/dnf/* /var/cache/PackageKit /var/cache/ldconfig/*",
+      "rm -rf /var/lib/dnf/repos/* /var/log/dnf.* /var/log/hawkey.log",
+      "rm -rf /var/tmp/* /tmp/*",
+      "truncate -s 0 /var/log/messages /var/log/secure 2>/dev/null || true",
+    ]
+  }
+
   # --- 3. Extract kernel, initramfs, rootfs from the built disk ------------
   # --- 4. Assemble + sign the UKI; build the OCI release-artifact image ----
   post-processor "shell-local" {