Dockerfile.s390x

# syntax=docker/dockerfile:1.11
#
# Build natively on an s390x host:
#
#   docker build -f Dockerfile.s390x \
#     --build-arg VERSION="$(git describe --tags --always --dirty)" \
#     --build-arg GIT_REVISION="$(git rev-parse HEAD)" \
#     -t <repo>/agentgateway:<tag> .
#
# s390x-specific notes:
#  * lightningcss ships no working s390x prebuilt native, so we compile it from
#    source and inject it into the UI build. Drop the stage once
#    parcel-bundler/lightningcss#1294 ships in a release.
#  * .cargo/config.toml is unchanged from main. Its CFLAGS include the x86_64/
#    AArch64-only `-mno-omit-leaf-frame-pointer`, which the s390x compiler
#    rejects, so the builder stage exports a portable CFLAGS (see below).
#  * s390x taskdump support needs tokio >= 1.53 (tokio-rs/tokio#8192); the
#    workspace Cargo.toml pins that, so no tokio patch is required.
#  * The runtime image is debian:bookworm-slim — it has an s390x variant, whereas
#    chainguard's glibc-dynamic (used by the main Dockerfile) does not.
#  * The node version must match ui/.nvmrc, and caps it: docker-library/node
#    dropped linux/s390x at 24.18.0, so 24.17.0 is the newest usable tag.

# ─────────────────────────────────────────────────────────────────────────────
# Stage: build the lightningcss native addon (.node) for s390x from source.
# (a rust image with node/npm copied in, so napi has both toolchains)
# Temporary: drop once parcel-bundler/lightningcss#1294 ships a s390x prebuilt.
# ─────────────────────────────────────────────────────────────────────────────
FROM docker.io/library/rust:1.98.0-bookworm AS lightningcss-s390x

COPY --from=docker.io/library/node:24.17.0-bookworm /usr/local/bin/node /usr/local/bin/node
COPY --from=docker.io/library/node:24.17.0-bookworm /usr/local/include/node /usr/local/include/node
COPY --from=docker.io/library/node:24.17.0-bookworm /usr/local/lib/node_modules /usr/local/lib/node_modules
RUN ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
    && ln -sf /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx

RUN apt-get update && apt-get install -y --no-install-recommends \
    python3 make g++ git \
    && rm -rf /var/lib/apt/lists/*

# Pin the build tool for reproducibility.
ARG NAPI_CLI_VERSION=3.7.1
RUN npm install -g @napi-rs/cli@${NAPI_CLI_VERSION}

# Keep in sync with the lightningcss version resolved in ui/pnpm-lock.yaml.
ARG LIGHTNINGCSS_VERSION=1.33.0
RUN rustup target add s390x-unknown-linux-gnu
RUN git clone --depth 1 --branch v${LIGHTNINGCSS_VERSION} \
    https://github.com/parcel-bundler/lightningcss.git /lightningcss-src
WORKDIR /lightningcss-src
RUN npm install
RUN napi build --platform --release --target s390x-unknown-linux-gnu \
    --manifest-path /lightningcss-src/node/Cargo.toml \
    --output-dir /lightningcss-src/node
RUN ls -la /lightningcss-src/node/*.node

# ─────────────────────────────────────────────────────────────────────────────
# Stage: build the UI, injecting the s390x lightningcss native built above.
# ─────────────────────────────────────────────────────────────────────────────
FROM docker.io/library/node:24.17.0-bookworm AS node
WORKDIR /app
COPY ui .
# ui/scripts/generate-schema.mjs reads ../schema/*.json (i.e. /schema here), so
# the repo's schema/ dir must be present alongside the UI — same as the main
# Dockerfile does.
COPY schema /schema

RUN corepack enable

# Hoisted: the COPY steps below need real node_modules/<pkg>/ directories, which
# pnpm's default layout does not create for transitive dependencies.
RUN --mount=type=cache,id=agentgateway-ui-pnpm-s390x,target=/pnpm/store \
    pnpm install --frozen-lockfile --store-dir=/pnpm/store --node-linker=hoisted

COPY --from=lightningcss-s390x \
    /lightningcss-src/node/lightningcss.linux-s390x-gnu.node \
    node_modules/lightningcss/lightningcss.linux-s390x-gnu.node

RUN pnpm build

# ─────────────────────────────────────────────────────────────────────────────
# Stage: build the agentgateway binary for s390x.
# ─────────────────────────────────────────────────────────────────────────────
FROM docker.io/library/rust:1.98.0-bookworm AS builder
ARG PROFILE=release
ARG VERSION
ARG GIT_REVISION
ARG CARGO_FEATURES=agentgateway/ui
ARG CARGO_NO_DEFAULT_FEATURES=false

WORKDIR /app

COPY Makefile Cargo.toml Cargo.lock ./
COPY .cargo ./.cargo
COPY crates ./crates
COPY tools ./tools
COPY --from=node /app/dist ./ui/dist

RUN rustup target add s390x-unknown-linux-gnu
RUN --mount=type=cache,id=cargo-s390x,target=/usr/local/cargo/registry \
    --mount=type=cache,id=cargo-git-s390x,target=/usr/local/cargo/git \
    cargo fetch --locked

# tokio_unstable + force-frame-pointers come from .cargo/config.toml. That file
# (unchanged from main) also sets the x86_64/AArch64-only flag
# `-mno-omit-leaf-frame-pointer`, which the s390x compiler rejects — so we
# override CFLAGS/CXXFLAGS to the portable subset here. Cargo's [env] is
# non-forced, so an exported CFLAGS wins over the config value.
RUN --mount=type=cache,id=target-s390x,target=/app/target \
    --mount=type=cache,id=cargo-s390x,target=/usr/local/cargo/registry \
    --mount=type=cache,id=cargo-git-s390x,target=/usr/local/cargo/git \
    <<EOF
# NOTE: 'set -e' (not '-eu'): VERSION/GIT_REVISION are validated explicitly below.
set -e
export VERSION="${VERSION}"
export GIT_REVISION="${GIT_REVISION}"
# Fail fast — before the multi-minute compile — if version/revision weren't provided.
if [ -z "${VERSION}" ] || [ -z "${GIT_REVISION}" ]; then
  echo "ERROR: both --build-arg VERSION=... and --build-arg GIT_REVISION=... are required." >&2
  echo "  e.g. --build-arg VERSION=\"\$(git describe --tags --always --dirty)\" --build-arg GIT_REVISION=\"\$(git rev-parse HEAD)\"" >&2
  exit 1
fi
# s390x has no `-mno-omit-leaf-frame-pointer`; keep only the portable flag.
export CFLAGS="-fno-omit-frame-pointer"
export CXXFLAGS="-fno-omit-frame-pointer"
TARGET=s390x-unknown-linux-gnu
if [ "${CARGO_NO_DEFAULT_FEATURES}" = "true" ]; then
  cargo build --no-default-features --features "${CARGO_FEATURES}" --target "${TARGET}" --profile ${PROFILE}
else
  cargo build --features "${CARGO_FEATURES}" --target "${TARGET}" --profile ${PROFILE}
fi
mkdir /out
mv /app/target/${TARGET}/${PROFILE}/agentgateway /out/
/out/agentgateway --version
# Fail the build if the version was not stamped in.
if /out/agentgateway --version | grep -q '"unknown"'; then
  echo "ERROR: version is 'unknown' — VERSION/GIT_REVISION not set" >&2
  exit 1
fi
EOF

# ─────────────────────────────────────────────────────────────────────────────
# Stage: final runtime image.
# ─────────────────────────────────────────────────────────────────────────────
FROM debian:bookworm-slim AS runner

# Matches the main Dockerfile: marks this as an official container build, which
# makes the generated default config bind adminAddr to 0.0.0.0 instead of
# localhost (see running_in_official_container()).
ENV AGENTGATEWAY_ENV=container

WORKDIR /

COPY --from=builder /out/agentgateway /app/agentgateway

LABEL org.opencontainers.image.source=https://github.com/agentgateway/agentgateway
LABEL org.opencontainers.image.description="Agentgateway is an open source project that is built on AI-native protocols to connect, secure, and observe agent-to-agent and agent-to-tool communication across any agent framework and environment."

ENTRYPOINT ["/app/agentgateway"]