Purge Go module cache from cosmovisor-installing images

[UnbornAztecKing]

What it is

Strips the Go module cache out of the container images that install cosmovisor, so downloaded module source (including npm lockfiles like cosmos-sdk's docs/package-lock.json) is never committed into the shipped image.

The RUN go install cosmossdk.io/tools/cosmovisor/cmd/cosmovisor@v1.5.0 step resolves cosmovisor's dependency graph and writes full module source into /go/pkg/mod, which persists in the image layer. That tree carries build-time npm manifests that SCA scanners flag even though the code is never installed (node_modules), loaded, or run at runtime.

Concretely this closes the Wiz finding for axios 0.25.0 (CVE-2026-42043) at /go/pkg/mod/github.com/cosmos/cosmos-sdk@v0.46.0-beta2.../docs/package-lock.json in mainnet-full-node. Dependency chain: cosmovisor v1.5.0 (indirect) → cosmos-sdk module source → docs/ Docusaurus 2.4.1 → @docusaurus/core → wait-on@6.0.1 → axios@0.25.0. None of that is on the node's runtime path.

The base image (dydxprotocol-base, from the multi-stage protocol/Dockerfile) already ships only the compiled binary with a cache-mounted modcache — so the go install cosmovisor layer is the sole source of these artifacts.

The change

Append && go clean -modcache to the cosmovisor install, in the same RUN layer:

RUN go install cosmossdk.io/tools/cosmovisor/cmd/cosmovisor@v1.5.0 && go clean -modcache

The cosmovisor binary lands in /go/bin (on PATH) and survives; the module cache is wiped before the layer is committed. Same-layer is required — scanners inspect per-layer, so a cleanup in a later layer would leave the artifact in the earlier one.

Property	Delivered
Runtime behavior	Unchanged — cosmovisor binary present and on PATH
Image contents	/go/pkg/mod no longer committed; source manifests gone
Finding class	Removes all SCA-in-Go-module-cache findings from these images, not just axios
Scope	Build/packaging only; no Go deps, no app code touched

Reviewer brief

Eight protocol/testing/*/Dockerfiles, identical one-line change each. The load-bearing one is mainnet/Dockerfile (builds mainnet-full-node). No source or dependency changes.

Out of scope

• protocol/scripts/create_full_node.sh — installs cosmovisor on a host VM, not a container layer; intentionally left unchanged.
• Upgrading the cosmos-sdk fork's docs/ off Docusaurus 2.4.1 (which is what actually pulls axios) — separate hygiene follow-up; not required to close this finding.

Test plan

• Rebuild mainnet-full-node and confirm cosmovisor runs (entrypoint unaffected)
• Confirm /go/pkg/mod is absent in the built image
• Wiz rescan shows the axios / CVE-2026-42043 finding cleared

Summary by CodeRabbit

• Chores
  • Reduced leftover build artifacts in several testing and deployment images by cleaning the Go module cache during installation.
  • This helps keep generated images smaller and avoids carrying unnecessary downloaded sources into the final image layers.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 50044e3f-6c86-4bc5-83e5-03e70aea5015

📥 Commits

Reviewing files that changed from the base of the PR and between 3778421 and a527ae0.

📒 Files selected for processing (8)

• protocol/testing/containertest/Dockerfile
• protocol/testing/e2etest-local/Dockerfile
• protocol/testing/mainnet/Dockerfile
• protocol/testing/snapshotting/Dockerfile.snapshot
• protocol/testing/testnet-dev/Dockerfile
• protocol/testing/testnet-local/Dockerfile
• protocol/testing/testnet-staging/Dockerfile
• protocol/testing/testnet/Dockerfile

---

📝 Walkthrough

Walkthrough

Eight Dockerfiles across protocol/testing directories are modified to combine the existing go install cosmovisor step with go clean -modcache in the same RUN layer, accompanied by explanatory comments describing the rationale for layer-scoped cache cleanup.

Changes

Dockerfile modcache cleanup

Layer / File(s)	Summary
Combine cosmovisor install with cache cleanup protocol/testing/containertest/Dockerfile, protocol/testing/e2etest-local/Dockerfile, protocol/testing/mainnet/Dockerfile, protocol/testing/snapshotting/Dockerfile.snapshot, protocol/testing/testnet-dev/Dockerfile, protocol/testing/testnet-local/Dockerfile, protocol/testing/testnet-staging/Dockerfile, protocol/testing/testnet/Dockerfile	Each Dockerfile's cosmovisor install RUN instruction is updated to also run go clean -modcache in the same layer, with added comments explaining the same-layer cleanup rationale.

Estimated code review effort: 1 (Trivial) | ~4 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: purging the Go module cache from cosmovisor-installing images.
Description check	✅ Passed	The description covers the changelist and test plan well, but the template checklist is not filled out in the required checkbox format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/strip-go-modcache-from-cosmovisor-images

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request