--- title: "Bake stable dependencies into runner images" description: "Prepare versioned system dependencies and build downloads once in the runner image instead of installing them on every job." url: https://starsling.dev/ci-playbooks/techniques/prebuild-runner-images canonicalUrl: https://starsling.dev/ci-playbooks/techniques/prebuild-runner-images --- # Bake stable dependencies into runner images Prepare versioned system dependencies and build downloads once in the runner image instead of installing them on every job. ## How to choose an approach Compare the examples by repository setup, prerequisites, and risks before adopting one. Each company implemented this in its own environment; measure each change against your own baseline. - **[Anthropic](https://starsling.dev/ci-playbooks/anthropic#prefetch-build-inputs)**: Use it when Builds on fresh runners download the same large, versioned inputs on every run, and you control the runner image. Check before adopting: Entries are keyed by exact URL or version, so a bumped dependency downloads fresh until the image is refreshed. - **[Linear](https://starsling.dev/ci-playbooks/linear#preinstall-in-the-ci-image)**: Use it when Multiple jobs repeat stable OS-package setup on equivalent environments. Check before adopting: Pin and rebuild the image, patch vulnerabilities and measure image-pull cost. Repository secrets and mutable build outputs do not belong in the image. ## Apply this technique ````text Evaluate and apply this CI technique to my repository: Bake stable dependencies into runner images. Prepare versioned system dependencies and build downloads once in the runner image instead of installing them on every job. Read the technique and its source-backed company examples: https://starsling.dev/ci-playbooks/techniques/prebuild-runner-images.md Inspect this repository’s CI workflows, build and test commands, dependencies, and recent run timings. Identify where this technique applies and explain the expected benefit using this repository’s evidence. Measure a baseline from recent comparable runs: elapsed time, queue time, runner minutes and failures where available. If data is unavailable, say what cannot be measured. Compare relevant company approaches, checking prerequisites, platform differences and tradeoffs. Rank applicable options by evidence, fit and measurable opportunity; do not present company results as predictions for this repo. Recommend the smallest safe change, show what checks and fallback paths remain, and ASK ME WHICH CHANGE TO APPROVE BEFORE EDITING ANY FILES. Only after approval, work on a new feature branch, make one reversible change, and open a reviewable pull request. Never merge or push to a default or protected branch. Keep required checks, test coverage, deployment and release behavior intact. Validate the change and compare equivalent runs where possible; report limitations and what should be monitored after merge. ```` ## How companies used this technique Read what each company changed and follow the original sources. ### Anthropic: Bake versioned build downloads into the runner image Bun bakes a read-only prefetch store of its dependency tarballs, WebKit prebuilt and zig compiler into its build images. A build copies a prefetched file when its URL matches and downloads from the network when a version has changed. Evidence: Source PR/commit evidence Before the change every CI build downloaded about 18 archive tarballs, a 200 MB WebKit prebuilt and a zig compiler before compiling. ([Source](https://github.com/oven-sh/bun/pull/29568)) Use it when: Builds on fresh runners download the same large, versioned inputs on every run, and you control the runner image. Before applying it: Entries are keyed by exact URL or version, so a bumped dependency downloads fresh until the image is refreshed. [Read more in the Anthropic playbook](https://starsling.dev/ci-playbooks/anthropic#prefetch-build-inputs) [Primary source](https://github.com/oven-sh/bun/pull/29568) ### Linear: Bake stable system dependencies into the CI image Each API test shard spent 7 to 8 seconds installing the same Postgres client with apt. Linear moved it into a small CI base image with Node and the client, and later added the native build headers whose downloads could occasionally hang. Evidence: Company-reported result or observation Together, the CI base image, the filtered install and dropping the node_modules cache reduced per-shard setup time by roughly 44%, from 110-140 seconds to 67-73 seconds. ([Source](https://linear.app/now/ci-bottleneck-reworked#don%27t-cache-when-it%27s-faster-to-rebuild)) Use it when: Multiple jobs repeat stable OS-package setup on equivalent environments. Before applying it: Pin and rebuild the image, patch vulnerabilities and measure image-pull cost. Repository secrets and mutable build outputs do not belong in the image. [Read more in the Linear playbook](https://starsling.dev/ci-playbooks/linear#preinstall-in-the-ci-image) [Primary source](https://linear.app/now/ci-bottleneck-reworked#preinstall-shared-dependencies-in-the-ci-image) ## CI optimization is continuous work. Apply this technique yourself, or use StarSling Runners for faster GitHub Actions and optional agent-driven optimization PRs, which teams on eligible paid plans can turn on. [Get self-improving CI](https://starsling.dev/products/runners) ## Related techniques ### [Reuse downloaded tools across runs](https://starsling.dev/ci-playbooks/techniques/cache-tool-downloads) Cache versioned tools and browser downloads so jobs can restore them while retaining installation and repair checks. 4 implementations · 4 companies (Anthropic, Linear, Shopify, Stripe) ### [Reduce the setup floor before increasing shard count](https://starsling.dev/ci-playbooks/techniques/setup-cost-limits-sharding) Each extra shard repeats checkout, dependencies and container setup. 1 implementation · 1 company (Linear) ### [Cache package downloads and dependency stores](https://starsling.dev/ci-playbooks/techniques/reuse-package-downloads) Restore package-manager downloads or dependency stores while keeping a locked install that validates the requested dependency graph. 7 implementations · 6 companies (DoorDash, Linear, Shopify, Spotify, Stripe, Uber) ## Company Playbooks ### [Anthropic](https://starsling.dev/ci-playbooks/anthropic) Run only affected tests ### [DoorDash](https://starsling.dev/ci-playbooks/doordash) Run build and test in parallel, sharded across CI agents ### [Linear](https://starsling.dev/ci-playbooks/linear) Benchmark the same job on faster hardware ### [Mastra](https://starsling.dev/ci-playbooks/mastra) StarSling runners for the slowest test workflow ### [OpenAI](https://starsling.dev/ci-playbooks/openai) Rank CI fixes by the minutes they save ### [Ramp](https://starsling.dev/ci-playbooks/ramp) Move a CPU-bound test suite to a faster CPU ### [Shopify](https://starsling.dev/ci-playbooks/shopify) Let an agent iterate against one CI metric ### [Spotify](https://starsling.dev/ci-playbooks/spotify) Build arm64 on native arm64 runners ### [Stripe](https://starsling.dev/ci-playbooks/stripe) Run only the tests a change can reach ### [Uber](https://starsling.dev/ci-playbooks/uber) Build the merge-queue speculations most likely to be needed ## Related guides Implementation guides for this technique. ### [Cache workflow dependencies](https://starsling.dev/best-practices/github-actions/cache-dependencies) Choose dependency cache paths and keys for your package manager. ### [Cut repeated test setup](https://starsling.dev/best-practices/github-actions/cut-repeated-test-setup) Share expensive setup at the scope your tests need. ### [Share setup steps across jobs](https://starsling.dev/github-actions/optimizations/avoid-duplicated-setup) Centralize repeated setup definitions and remove duplicate or unused steps. ### [Optimize npm installs](https://starsling.dev/github-actions/optimizations/optimize-npm-install) Cache npm dependencies and large downloads and remove unused tool installs. ### [Optimize pnpm installs](https://starsling.dev/github-actions/optimizations/optimize-pnpm-install) Set up the pnpm store cache in the right order and scope recursive commands. ### [Filter workflows by changed files](https://starsling.dev/best-practices/github-actions/path-filter-workflows) Use paths and job conditions while keeping required checks reporting.