dockerfile: `composer install –no-dev installs dev-dependencies, then deletes them straight away after

My docker-compose setup does (I think) some wierd things.

I am installing from this composer.json:

{
    "require-dev":  {
        "phpunit/phpunit":"~9.0",
        "squizlabs/php_codesniffer": "~3.0",
        "fzaninotto/faker": "~1.9"
    },
    "require": {
        "doctrine/orm": "2.7.2",
        "haydenpierce/class-finder": "0.4.2"
    },
    "autoload" : {
        "psr-4": {
            "WebApp\": "src/"
         }
    },
    "autoload-dev" : {
        "psr-4": {
            "WebApp\Tests\" : "tests/"
        }
    }
}

And my dockerfile looks like:

FROM php:7.4.4-apache

#Install git
RUN php -v
RUN apt-get update && apt-get install -y git
RUN apt-get install zip unzip
RUN docker-php-ext-install pdo pdo_mysql mysqli

#enable Ubuntu module 'URL rewrite'
RUN a2enmod rewrite

#Install Composer
RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
RUN php composer-setup.php --install-dir=/usr/local/bin/ --filename=composer

#setup database secrets file
COPY db_secret.prod.php /etc/db_secret.prod.php

#Make php error log file
RUN touch /var/log/php-error.log
RUN chmod 755 /var/log/php-error.log

#copy across necessary files
COPY . /var/www/
RUN rm /var/www/db_secret.prod.php

#change root that server runs files from
RUN sed -i 's+/var/www/html+/var/www/src/html+i' /etc/apache2/sites-available/000-default.conf

#Install php testing
RUN cd .. && composer update && composer install --no-dev

#RUN cd .. && vendor/bin/doctrine orm:schema-tool:create

EXPOSE 80

When running composer install I get:

Step 15/16 : RUN cd .. && composer update && composer install --no-dev
 ---> Running in 2980b48bbbc0
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 55 installs, 0 updates, 0 removals
  - Installing ocramius/package-versions (1.8.0): Downloading (100%)         
  ...abridged for brevity...       
  - Installing fzaninotto/faker (v1.9.1): Downloading (100%)         
symfony/polyfill-intl-normalizer suggests installing ext-intl (For best performance)
symfony/polyfill-intl-grapheme suggests installing ext-intl (For best performance)
symfony/service-contracts suggests installing symfony/service-implementation
symfony/console suggests installing symfony/event-dispatcher
symfony/console suggests installing symfony/lock
symfony/console suggests installing symfony/process
symfony/console suggests installing psr/log (For using the console logger)
doctrine/cache suggests installing alcaeus/mongo-php-adapter (Required to use legacy MongoDB driver)
doctrine/orm suggests installing symfony/yaml (If you want to use YAML Metadata Mapping Driver)
sebastian/global-state suggests installing ext-uopz (*)
phpunit/php-invoker suggests installing ext-pcntl (*)
phpunit/php-code-coverage suggests installing ext-pcov (*)
phpunit/php-code-coverage suggests installing ext-xdebug (*)
phpunit/phpunit suggests installing ext-soap (*)
phpunit/phpunit suggests installing ext-xdebug (*)
Writing lock file
Generating autoload files
ocramius/package-versions: Generating version class...
ocramius/package-versions: ...done generating version class
37 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
Loading composer repositories with package information
Installing dependencies from lock file
Package operations: 0 installs, 0 updates, 31 removals
  - Removing webmozart/assert (1.8.0)
 ...abridged for brevity...
  - Removing fzaninotto/faker (v1.9.1)
Generating autoload files
ocramius/package-versions: Generating version class...
ocramius/package-versions: ...done generating version class
19 packages you are using are looking for funding.
Use the `composer fund` command to find out more!

Can anyone tell me why it would install and then remove the dev packages instead of just omitting them from the original install?

The container for the dockerfile is php744-apache

Answer

Pretty simple: you run composer update (which will update the list of packages, and install them), and afterwards you run composer install --no-dev.

Just out of curiosity: this is only done when updating the Docker image. Is there any good reason for this? Why don’t you decouple the image and the source code running in that image?