|
| 1 | +# ───────────────────────────────────────────────────────────────────────────── |
| 2 | +# Stage 1 — build a fully-static musl binary |
| 3 | +# |
| 4 | +# rust:alpine is the right base for musl static builds: Alpine ships a native |
| 5 | +# musl toolchain so crates with C code (ring, via ureq/rustls) compile cleanly. |
| 6 | +# The debian-slim + musl-tools approach breaks ring because that musl-gcc |
| 7 | +# wrapper does not support the -m64 flag that ring's build script passes. |
| 8 | +# ───────────────────────────────────────────────────────────────────────────── |
| 9 | +FROM rust:alpine AS builder |
| 10 | + |
| 11 | +# Alpine's native musl + build essentials for crates with C dependencies (ring) |
| 12 | +RUN apk add --no-cache musl-dev gcc make perl |
| 13 | + |
| 14 | +WORKDIR /build |
| 15 | + |
| 16 | +# Cache dependency compilation separately from source changes. |
| 17 | +# Copy manifests first so this layer is only invalidated when deps change. |
| 18 | +COPY Cargo.toml Cargo.lock ./ |
| 19 | +COPY crates/vastlint-cli/Cargo.toml crates/vastlint-cli/Cargo.toml |
| 20 | +COPY crates/vastlint-core/Cargo.toml crates/vastlint-core/Cargo.toml |
| 21 | +COPY crates/vastlint-ffi/Cargo.toml crates/vastlint-ffi/Cargo.toml |
| 22 | +COPY crates/vastlint-wasm/Cargo.toml crates/vastlint-wasm/Cargo.toml |
| 23 | + |
| 24 | +# Stub out every crate so Cargo can resolve and compile all dependencies |
| 25 | +# without the real source. The stubs are replaced by the real COPY below. |
| 26 | +RUN for crate in vastlint-cli vastlint-core vastlint-ffi vastlint-wasm; do \ |
| 27 | + mkdir -p crates/$crate/src; \ |
| 28 | + echo 'fn main() {}' > crates/$crate/src/main.rs; \ |
| 29 | + echo '' > crates/$crate/src/lib.rs; \ |
| 30 | + done |
| 31 | + |
| 32 | +RUN cargo build --release --bin vastlint 2>/dev/null || true |
| 33 | + |
| 34 | +# Now copy the real source and rebuild only what changed |
| 35 | +COPY crates/ crates/ |
| 36 | + |
| 37 | +RUN touch crates/vastlint-cli/src/main.rs \ |
| 38 | + && cargo build --release --bin vastlint |
| 39 | + |
| 40 | +# ───────────────────────────────────────────────────────────────────────────── |
| 41 | +# Stage 2 — final image: scratch + the static binary only |
| 42 | +# |
| 43 | +# "scratch" is the absolute minimum: zero OS, zero shell, zero attack surface. |
| 44 | +# The binary is fully self-contained so nothing else is needed. |
| 45 | +# ───────────────────────────────────────────────────────────────────────────── |
| 46 | +FROM scratch |
| 47 | + |
| 48 | +# Copy the static binary |
| 49 | +COPY --from=builder \ |
| 50 | + /build/target/release/vastlint \ |
| 51 | + /vastlint |
| 52 | + |
| 53 | +# /data is the conventional mount point for XML files |
| 54 | +VOLUME ["/data"] |
| 55 | + |
| 56 | +# Default: read from stdin, output plain text. |
| 57 | +# Override at runtime: |
| 58 | +# docker run --rm vastlint vastlint check /data/tag.xml --format json |
| 59 | +ENTRYPOINT ["/vastlint"] |
| 60 | +CMD ["check", "-"] |
0 commit comments