Dockerfile: clean the rosdep layer (#923) (backport #923)

[mergify]

apt-get clean empties /var/cache/apt/archives. It does not touch /var/lib/apt/lists, so the first layer of this image ships the full Ubuntu package index it downloaded. The line that looks like it cleans up isn't cleaning up the thing that costs the most.

What that costs, measured

For ubuntu:24.04's default sources on amd64 — noble, noble-updates, noble-backports, noble-security across main/restricted/universe/multiverse:

	uncompressed
binary-amd64/Packages	129.6 MB
i18n/Translation-en	60.9 MB
total left in layer 1	190.6 MB

Read off the SHA256: sections of Ubuntu's own Release files rather than estimated, so it's checkable without building anything:

curl -s http://archive.ubuntu.com/ubuntu/dists/noble/Release | \
  awk '/^SHA256:/{f=1;next} f && $3 ~ /binary-amd64\/Packages$/ {s+=$2} END{print s}'

universe alone is 73.4 MB of that.

The rosdep layer

The third RUN resolves and installs the whole dependency tree and never runs apt-get clean, so that layer keeps every .deb it downloaded in /var/cache/apt/archives. I have no container runtime on this machine, so I have not sized it — but it's the layer that installs the most, and it's the only apt layer here with no cleanup at all.

What I deliberately did not change, and why

The second RUN — the one that adds the ROS apt source and installs colcon/rosdep — keeps its lists, on purpose. rosdep install shells out to apt-get install without running its own apt-get update, so removing the lists there would leave the next layer unable to resolve anything. That's a build break, not a saving.

It also wouldn't help if it were safe: those lists are written in layer 2, and deleting them from layer 3 only adds a whiteout — the bytes stay in the image. Dropping them properly would mean merging layers 2 and 3 into one RUN, which is a real restructuring of the git clone / rosdep block and a bigger change than I think is worth putting in front of you unasked. Happy to do it as a follow-up if you'd rather have it.

So this is two lines: rm -rf /var/lib/apt/lists/* in layer 1, apt-get clean in layer 3.

What I could not verify

No Docker or Podman on my side, so I have not built this image. The change is two additions to existing && chains and adds no new command that can fail on its own, but I'd rather say that than let a green-looking PR imply I ran something I didn't. Everything above about layer ordering is read off the Dockerfile and rosdep's apt installer, not observed in a build.

---

Disclosure: I'm an AI agent. The measurement above is mine and reproducible with the command given; the judgement about layer 2 is the part worth a maintainer's second opinion.

---

This is an automatic backport of pull request #923 done by Mergify.