zaino/Dockerfile.deterministic at dev · zingolabs/zaino · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
# syntax=docker/dockerfile:1

############################
# Global build args
############################
ARG UID=1000
ARG GID=1000
ARG USER=container_user
ARG HOME=/home/container_user

############################
# Dependencies
############################
FROM stagex/pallet-rust:1.96.0@sha256:abe9b95c93a5afa271f69fcd5eb18c8cd405fe5df6491a63c9418e3a170573dc AS pallet-rust
FROM stagex/pallet-clang@sha256:15cce53f7f94e6eefb67587bb62b2ae5b8a82d043e2b6ef800647b30f4320928 AS pallet-clang
FROM stagex/user-protobuf:35.0@sha256:e93f664067dd9f61c4abe04630a8422ee1bdefa8f466efc2eaeea15d7ee4e67c AS protobuf
FROM stagex/user-abseil-cpp:20260107.1@sha256:411fd1a6a20daae3d931c43928fad8a816e96e5333437cb13c6c81e451f46542 AS abseil-cpp
FROM stagex/core-busybox:1.38.0@sha256:e4a30addc8939c8e232472de904d1d9e97fc2e735fca9a9701ce49db04c6c181 AS busybox

############################
# Builder
############################
FROM pallet-rust AS builder

SHELL ["/bin/sh", "-euo", "pipefail", "-c"]
COPY --from=pallet-clang . /
COPY --from=protobuf . /
COPY --from=abseil-cpp . /

WORKDIR /usr/src/app

# Toggle to build without TLS feature if needed
ARG NO_TLS=false

ENV CARGO_HOME=/usr/local/cargo

ENV CXXSTDLIB="c++"

ENV RUST_BACKTRACE=1
ENV RUSTFLAGS="-C codegen-units=1"
ENV RUSTFLAGS="${RUSTFLAGS} -C target-feature=+crt-static"
ENV RUSTFLAGS="${RUSTFLAGS} -C linker=clang -C link-arg=-fuse-ld=mold"
ENV RUSTFLAGS="${RUSTFLAGS} -C link-arg=/usr/lib/libc++.a"
ENV RUSTFLAGS="${RUSTFLAGS} -C link-arg=/usr/lib/libc++abi.a"
ENV RUSTFLAGS="${RUSTFLAGS} -C link-arg=-Wl,--build-id=none"
ENV SOURCE_DATE_EPOCH=1
ENV CXXFLAGS="-stdlib=libc++ -include cstdint"
ENV ROCKSDB_USE_PKG_CONFIG=0

ENV TARGET_ARCH="x86_64-unknown-linux-musl"

COPY . .

RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    cargo fetch --locked --target $TARGET_ARCH

RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    cargo metadata --locked --format-version=1 > /dev/null 2>&1

# Efficient caches + install to a known prefix (/out)
# This avoids relying on target/release/<bin> paths.
RUN --network=none \
    --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/usr/src/app/target \
    if [ "${NO_TLS}" = "true" ]; then \
      cargo build --release --frozen --target $TARGET_ARCH --bin zainod --features no_tls_use_unencrypted_traffic; \
    else \
      cargo build --release --frozen --target $TARGET_ARCH --bin zainod; \
    fi && \
    install -D -m 0755 /usr/src/app/target/${TARGET_ARCH}/release/zainod /usr/local/bin/zainod

############################
# Export stage
############################
FROM scratch AS export
COPY --from=builder /usr/local/bin/zainod /zainod

############################
# Runtime (slim, non-root)
############################
FROM busybox AS runtime

ARG HOME

WORKDIR ${HOME}

# Copy the installed binary from builder
COPY --from=export /zainod /

# Default ports (adjust if your app uses different ones)
ARG ZAINO_GRPC_PORT=8137
ARG ZAINO_JSON_RPC_PORT=8237
EXPOSE ${ZAINO_GRPC_PORT} ${ZAINO_JSON_RPC_PORT}

# Healthcheck that doesn't assume specific HTTP/gRPC endpoints
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
  CMD /usr/local/bin/zainod --version >/dev/null 2>&1 || exit 1

ENTRYPOINT ["/zainod"]
CMD []