The package a grep could not judge
A devcontainer bloat audit removes an unused compiler toolchain, keeps two expensive dependencies, and gives maintenance scripts a CI gate.
The devcontainer had grown to 507 packages and 2.84 GB on disk, without any specific complaint that it was too slow or too large. That made the audit a precaution rather than a cleanup target: inventory the image and its surrounding scripts, find what looked redundant, then decide whether each candidate was unused, invisible to static analysis, or expensive for a reason.
Absence in the repository is not absence#
The compiler toolchain was the clean removal. It occupied about 194 MB, no current dependency needed a native build, no script invoked it, and there was no confirmed interactive use. Python looked equally unused in the repository, but that evidence was misleading. Claude Code, Codex, and Antigravity regularly create small one-off scripts during a session, work that never appears in a committed grep result. Python stayed, with its purpose documented where the image installs it.
Video conversion was the larger temptation. Its distribution package pulled in roughly 367 MB of graphics dependencies that a headless recording pipeline does not need, and a smaller static binary was technically feasible. The alternative lost on a different axis: it would replace an audited operating-system package with a third-party wrapper carrying its own update and patch cadence. The recording pipeline is load-bearing, so the known larger package stayed.
Test the workshop itself#
The audit also found that the tests behind developer CLI lifecycle management only ran when someone remembered them. They use fakes and fixtures, so there was no reason to require a running container or leave them as a manual ritual. A broad path-based CI gate now protects the whole devcontainer directory, avoiding a hand-maintained list that could silently miss the next script.
The useful outcome is not the space saved. It is a clearer standard for what belongs in the workshop: repository references are evidence, interactive use counts even when no file records it, and supply-chain simplicity can outweigh raw image size. The packages that remain now have reasons, and the scripts that keep them current have an automatic check.