NativeAOT StripSymbols should allow options for what to do with the symbol file

[eerhardt]

In trying to make a minimally sized NativeAOT app in a Linux Docker container, the first thing a developer needs to do is set StripSymbols=true. The symbols in the app can bloat the app size by 2-3x.

However, the developer also needs to move the symbols out of their publish directory in order to actually save the size in the Docker image.

Typically, Dockerfiles will publish the app to a specific directory (using -o), and then copy that whole directory into the final container. Here's an example from https://docs.docker.com/samples/dotnetcore/:

# syntax=docker/dockerfile:1
FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build-env
WORKDIR /app
    
# Copy csproj and restore as distinct layers
COPY *.csproj ./
RUN dotnet restore
    
# Copy everything else and build
COPY ../engine/examples ./
RUN dotnet publish -c Release -o out
    
# Build runtime image
FROM mcr.microsoft.com/dotnet/aspnet:6.0
WORKDIR /app
COPY --from=build-env /app/out .
ENTRYPOINT ["dotnet", "aspnetapp.dll"]

Following this same pattern with PublishAot=true will still keep the .dbg file in the app, bloating the image.

We should add some options for what to do with the resulting "stripped" symbol file. Useful options I can think of:

1. Don't publish the symbol file in the output folder. (It will still be in the obj folder)
2. Specify a separate folder to publish the symbol file to

This way developers can simply set this setting in their .csproj (or Directory.Build.props), and they won't have to write work-around code like this in their Dockerfile:

# remove the symbols so they aren't part of the published app
RUN rm -rf /app/publish/*.dbg

cc @MichalStrehovsky

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[agocke]

I think this belongs to the SDK -- the exact same behavior happens when you publish a project today (the PDBs get copied to the output directory). I would want any similar option to be available for regular publishing.

[richlander]

There should be a way to publish a "full prod" app.

For example, the *.Development.json file gets published, too. The only way to fix this today is to delete specific files in the build/sdk stage or copy specific files from the build/sdk stage. Both are bad.

[DamianEdwards]

The *.Development.json example is interesting as it's convention from much higher up in the stack (the host building layer in Microsoft.Extensions.Hosting). When doing my own investigations into Docker publish of ASP.NET Core apps I ended up just manually excluding those files as part of my publish (either in my .csproj file or the Docker file itself). Ultimately the project owner needs to own what they want their final output to be, and I'm not sure excluding things like symbols and environment specific configuration files by default is the right approach as they're runtime concerns, not build time.

[MichalStrehovsky]

There should ideally be a PublishSymbols property that controls whether debug symbols end up part of the publish output.

Without Native AOT in the picture, when you do build, the debug symbols get generated to the obj directory. When you do publish, the publishing process will then go and also copy them to your publish output.

With Native AOT, the process is similar (except that we do everything as part of publish): the output is generated under bin\...\native (along with the PDB/DBG), and then we copy this PDB to the publish output (bin\...\publish, typically).

It feels like what we want is an option to not make the PDB/DBG part of publish.

[MichalStrehovsky]

Aaaand looking at the actual sources, looks like there already is such property: CopyOutputSymbolsToPublishDirectory. We just need to respect it for PublishAot. PR out shortly...