Build a smaller CentOS 7 LLVM toolchain with compiler-rt

[morrisonlevi]

Description

The high-level goals here are:

1. Add static compiler-rt so that we can use -moutline-atomics in C builds on aarch64 for cross-language LTO. The rust compiler already sets this, and cross-language LTO will not work if target features are different. To make this work we need a static compiler-rt. Cross-language LTO may allow us to optimize for size and speed better.
2. Shrink the size of the CentOS family of containers by adjusting LLVM. It extracts libLLVM.so and libclang-cpp.so which the various tools link against, instead of using static linking. It also builds MinRelSize instead of Release, which has a smaller impact than the shared libraries extraction but it's still helpful.

The new CentOS 7 arm64 base image has shrunk by roughly 1/4:

CentOS 7 base	Full image ID	docker image ls size
Old	sha256:a03ac99e0e7187f1433a829baa87f3ea8c1953a026342573a870ff3e7a8040de	4.05 GB
New	sha256:e6890d96f47cf4df43abef716784979ebd68377b3ce78e8136459ec8f9a66f47	2.92 GB

PHP 8.5 CentOS 7	Full image ID	docker image ls size
Old	sha256:b1ceeb687c6c77fea75a8f325c0972f3338e65ee7adf39959a0d40da261e6bee	5.11 GB
New	sha256:596856db14ac1293e601d987fd879626768bb188c0b1da758f34217a0502f589	3.98 GB

Future work

We can build Rust from source and have it use these same LLVM libraries and it will further shrink things.

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[datadog-datadog-prod-us1-2]

 

✨ Unblock PR with BitsAI

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 4 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | test_integrations_frankenphp: [8.5] — ❌ 1 test failed

View more details · View in GitLab

❌ DDTrace\Tests\Integrations\Frankenphp\CommonScenariosTest::testScenario from frankenphp-test.DDTrace\Tests\Integrations\Frankenphp\CommonScenariosTest

20.0
go: downloading cloud.google.com/go/auth/oauth2adapt v0.2.8
go: downloading github.com/google/s2a-go v0.1.9
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.16
go: downloading cloud.google.com/go/compute/metadata v0.9.0
go: downloading github.com/mschoch/smat v0.2.0
go: downloading github.com/bits-and-blooms/bitset v1.24.6
/home/circleci/go/pkg/mod/github.com/mholt/acmez/v3@v3.1.6/csr.go:32:2: golang.org/x/crypto@v0.54.0: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.54.0.zip": stream error: stream ID 55; INTERNAL_ERROR; received from peer
/home/circleci/go/pkg/mod/github.com/mholt/acmez/v3@v3.1.6/csr.go:33:2: golang.org/x/crypto@v0.54.0: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.54.0.zip": stream error: stream ID 55; INTERNAL_ERROR; received from peer
/home/circleci/go/pkg/mod/github.com/caddyserver/certmagic@v0.25.4/certificates.go:32:2: golang.org/x/crypto@v0.54.0: read "https://proxy.golang.org/golang.org/x/crypto/@v/v0.54.0.zip": stream error: stream ID 55; INTERNAL_ERROR; received from peer
...

DataDog/apm-reliability/dd-trace-php | test_extension_ci: [8.3] — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

DataDog/apm-reliability/dd-trace-php | test_extension_ci: [8.4] — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

View all 4 failed jobs.

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 68.26% (-0.01%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: d7827aa | Docs | View more details | Give us feedback!}

[cataphract]

FIY, I've opened #4239 . It avoids centos 7 altogether (for building)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-30T13:24:48.705778Z	b3d1484	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-30T13:23:16.008223Z	b3d1484	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.