Dockerfile.execd

# syntax=docker/dockerfile:1.7-labs
#
# `execd`, the in-sandbox exec endpoint, as a carrier image: a static musl binary at `/execd` and
# nothing else. Its use is to be copied into a sandbox image you already have:
#
#     COPY --from=ghcr.io/beyondoss/execd:latest /execd /usr/local/bin/execd
#
# It is `FROM scratch`: no shell, no libc, so it cannot run commands itself. Running it directly
# (`docker run -e EXECD_BEARER=… ghcr.io/beyondoss/execd`) works, but the commands it would exec need a real
# userland, which is what the image you copy it into provides. Build from the workspace root:
#
#     docker build -f Dockerfile.execd -t execd .
ARG RUST_VERSION=1.92

FROM rust:${RUST_VERSION}-bookworm AS build
# `musl-tools` installs a native `musl-gcc`, so each arch builds natively on its own runner (see
# publish.yml) with no cross-linker.
RUN apt-get update && apt-get install -y --no-install-recommends musl-tools python3 \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /app
# Profile-guided, as release-execd.yml (which has the reasoning): instrument, train, merge, rebuild.
# `RUSTFLAGS` replaces cargo-config rustflags, so `-C relocation-model=static` (a static-pie musl
# binary segfaults at startup in some environments) is repeated in each stage. The base image's
# rustup has no `llvm-tools`, so it is added for `llvm-profdata`.
COPY . .
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/app/target \
    set -eu; \
    target="$(uname -m)-unknown-linux-musl"; \
    rustup target add "$target"; \
    rustup component add llvm-tools-preview; \
    export "CC_$(echo "$target" | tr '-' '_')=musl-gcc"; \
    export "CARGO_TARGET_$(echo "$target" | tr 'a-z-' 'A-Z_')_LINKER=musl-gcc"; \
    prof=/tmp/pgo; rm -rf "$prof"; mkdir -p "$prof/raw"; \
    profdata="$(rustc --print sysroot)/lib/rustlib/$(rustc -vV | awk '/^host: /{print $2}')/bin/llvm-profdata"; \
    RUSTFLAGS="-Cprofile-generate=$prof/raw -C relocation-model=static" \
        cargo build --release --locked --target "$target" -p beyond-execd; \
    python3 .github/pgo-train-execd.py "target/$target/release/execd" "$prof/raw"; \
    "$profdata" merge -o "$prof/merged.profdata" "$prof"/raw/*.profraw; \
    rm -rf "target/$target/release"; \
    RUSTFLAGS="-Cprofile-use=$prof/merged.profdata -C relocation-model=static" \
        cargo build --release --locked --target "$target" -p beyond-execd; \
    cp "target/$target/release/execd" /execd

FROM scratch
COPY --from=build /execd /execd
ENTRYPOINT ["/execd"]