maestro-symphony/Dockerfile at main · CharmsDev/maestro-symphony · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
FROM --platform=$BUILDPLATFORM rust:1.92-bookworm AS builder

ARG TARGETARCH

# Set up cross-compilation
WORKDIR /.vars
RUN case "$TARGETARCH" in \
    "amd64") \
        printf "x86_64-unknown-linux-gnu" > target; \
        printf "gcc-x86-64-linux-gnu g++-x86-64-linux-gnu libc6-dev-amd64-cross" > deps; \
        echo '[target.x86_64-unknown-linux-gnu]' >> $CARGO_HOME/config.toml; \
        echo 'linker = "x86_64-linux-gnu-gcc"' >> $CARGO_HOME/config.toml ;; \
    "arm64") \
        printf "aarch64-unknown-linux-gnu" > target; \
        printf "gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libc6-dev-arm64-cross" > deps; \
        echo '[target.aarch64-unknown-linux-gnu]' >> $CARGO_HOME/config.toml; \
        echo 'linker = "aarch64-linux-gnu-gcc"' >> $CARGO_HOME/config.toml ;; \
    *) echo "Unsupported architecture: $TARGETARCH" >&2 && exit 1 ;; \
esac

WORKDIR /dist
WORKDIR /build

# Install build dependencies
RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
    --mount=type=cache,target=/var/cache/apt,sharing=locked \
    apt-get update \
    && apt-get install --no-install-recommends --yes \
        $(cat /.vars/deps) \
        build-essential \
        libclang-dev

# Add target to rustup and install rustfmt
RUN rustup target add $(cat /.vars/target) && \
    rustup component add rustfmt

# Build dependencies
COPY ./Cargo.toml ./Cargo.lock ./
COPY ./macros ./macros
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
    --mount=type=tmpfs,target=/build/src \
    printf "#[allow(dead_code)]\nfn main() {}\n" > src/lib.rs && \
    cargo build --release --target=$(cat /.vars/target)

# Build source
COPY ./src ./src
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
    cargo build --verbose --release --target=$(cat /.vars/target) && \
    mv /build/target/$(cat /.vars/target)/release/maestro-symphony /dist/maestro-symphony

# ---
FROM debian:bookworm-slim

LABEL org.opencontainers.image.source=https://github.com/maestro-org/maestro-symphony

ENV DEBCONF_NONINTERACTIVE_SEEN=true
ENV DEBIAN_FRONTEND=noninteractive

# Install system dependencies
RUN apt-get update \
    && apt-get install --no-install-recommends --yes \
        ca-certificates \
        tini \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Create nonroot user
RUN groupadd --gid 60000 nonroot \
    && useradd --no-log-init --create-home \
        --uid 60000 \
        --gid 60000 \
        --shell /sbin/nologin \
        nonroot

# Copy binary
COPY --from=builder /dist/maestro-symphony /usr/local/bin/maestro-symphony

USER nonroot

# Set entrypoint
ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/usr/local/bin/maestro-symphony" ]