Multi-stage Docker build + simplified publish pipeline

- Dockerfile: build o-rly inside debian:bookworm against bookworm
  moxygen tarball, copy binary to bookworm-slim runtime image
- ci-main.yml publish: download bookworm tarball via ORLY_PLATFORM
  override, docker build does compilation (no C++ toolchain on runner)
- setup-deps-tarball.sh: support ORLY_PLATFORM env var override
- .dockerignore: exclude build dirs, keep fbcode_builder/CMake
- Update moxygen submodule to b3e8ab9 (find_dependency(fmt) fix)

Author: gmarzot

.dockerignore

@@ -1,3 +1,9 @@
 .scratch/
+.git/
 build/
 build-san/
+_build/
+deps/moxygen/.git/
+deps/moxygen/moxygen/
+deps/moxygen/standalone/
+install/

.github/workflows/ci-main.yml

@@ -113,33 +113,16 @@ jobs:
         with:
           submodules: true
 
-      - name: Install system dependencies
-        run: bash deps/moxygen/standalone/install-system-deps.sh
-
-      - name: Download moxygen artifacts
+      - name: Download bookworm moxygen tarball
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          ORLY_PLATFORM: bookworm-amd64
         run: bash scripts/setup-deps-tarball.sh
 
-      - name: Set up ccache
-        uses: hendrikmuhs/ccache-action@v1
-        with:
-          key: publish-amd64
-          max-size: 500M
-
-      - name: Configure
+      - name: Stage tarball for Docker build
         run: |
-          cmake -S . -B _build --preset default \
-            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
-            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
-            -DCMAKE_PREFIX_PATH="$(cat .scratch/cmake_prefix_path.txt)" \
-            -DBUILD_TESTING=OFF
-
-      - name: Build
-        run: cmake --build _build -j$(getconf _NPROCESSORS_ONLN)
-
-      - name: Install
-        run: cmake --install _build --prefix "$GITHUB_WORKSPACE/install"
+          mkdir -p .docker-deps
+          cp -a .scratch/moxygen-install .docker-deps/moxygen
 
       - name: Log in to GHCR
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
@@ -190,6 +173,9 @@ jobs:
         id: package
         run: |
           ARTIFACT="o-rly-bookworm-amd64.tar.gz"
+          docker cp "$(docker create --name extract ghcr.io/${{ github.repository }}:latest):/usr/local/bin/o-rly" .
+          docker rm extract
+          mkdir -p install/bin && mv o-rly install/bin/
           tar czf "$ARTIFACT" -C install .
           echo "artifact=$ARTIFACT" >> "$GITHUB_OUTPUT"
 

deps/moxygen

@@ -1,8 +1,41 @@
+# ── Build stage: compile o-rly inside bookworm against moxygen tarball ───
+FROM debian:bookworm AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential ninja-build git ca-certificates python3-pip \
+        libssl-dev libunwind-dev libgoogle-glog-dev libgflags-dev \
+        libdouble-conversion-dev libevent-dev libsodium-dev libzstd-dev \
+        libboost-all-dev libfmt-dev zlib1g-dev libc-ares-dev libdwarf-dev \
+    && pip install --break-system-packages cmake \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+
+# Moxygen tarball (pre-extracted bookworm build)
+COPY .docker-deps/moxygen /opt/moxygen
+
+# O-rly source — only what cmake needs
+COPY CMakeLists.txt CMakePresets.json ./
+COPY cmake/ cmake/
+COPY src/ src/
+COPY include/ include/
+COPY deps/moxygen/build/fbcode_builder/CMake deps/moxygen/build/fbcode_builder/CMake
+
+RUN cmake -S . -B _build --preset default \
+        -DCMAKE_PREFIX_PATH=/opt/moxygen \
+        -DBUILD_TESTING=OFF -DORLY_BUILD_TESTS=OFF \
+    && cmake --build _build -j$(nproc) \
+    && cmake --install _build --prefix /install
+
+# ── Runtime stage: minimal image with just the binary ────────────────────
 FROM debian:bookworm-slim
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
         libunwind8 \
     && rm -rf /var/lib/apt/lists/*
-COPY install/bin/o_rly /usr/local/bin/o-rly
+
+COPY --from=builder /install/bin/o_rly /usr/local/bin/o-rly
 COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh
+
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

docker/Dockerfile

@@ -60,7 +60,7 @@ detect_platform() {
     fi
 }
 
-PLATFORM=$(detect_platform)
+PLATFORM="${ORLY_PLATFORM:-$(detect_platform)}"
 echo "==> Platform: $PLATFORM"
 
 # ── Find publish run matching submodule SHA ───────────────────────────────────