mirror of
https://github.com/therealaleph/MasterHttpRelayVPN-RUST.git
synced 2026-05-18 05:44:35 +03:00
dazzling-no-more
4d2ce91c04
Fixes #620 — `tunnel-node/Dockerfile` used BuildKit-only `RUN --mount=type=cache` directives, breaking on Cloud Run's `gcloud run deploy --source .` path (the underlying `gcr.io/cloud-builders/docker` builder doesn't enable BuildKit, and `--set-build-env-vars DOCKER_BUILDKIT=1` doesn't flip it on either). Reworked to use **cargo-chef**: a dedicated planner stage emits `recipe.json` for dependency metadata, a `cargo chef cook` stage builds just the deps in their own Docker layer, the final build stage adds `src/` on top. Docker's regular layer cache handles dependency reuse — warm rebuilds where only `src/` changes still skip the slow crate compile. ## Changes (`tunnel-node/Dockerfile`-only) - Dropped `# syntax=docker/dockerfile:1` parser directive and all `RUN --mount=type=cache,...` blocks - Added cargo-chef multi-stage build (`chef` → `planner` → `builder`) - Pinned `cargo-chef` to exact `0.1.77` with `--locked` for reproducible installs - Bumped base from `rust:1.85-slim` → `rust:1.90-slim` (cargo-chef's transitive deps require rustc 1.86+; tunnel-node's `Cargo.toml` has no `rust-version` pin so the bump is internal-only) - Removed `ARG TARGETPLATFORM` per-platform cache-id workaround — Docker's regular layer cache is already arch-scoped ## Non-changes (deliberate) - `tunnel-node/Cargo.toml` left alone — the old Dockerfile comment claimed "matches MSRV in Cargo.toml" but no `rust-version` field actually exists. The Docker base bump is internal build-env, not a declared MSRV. - Base image digest pinning left on tag refs — without Renovate/Dependabot to keep digests fresh, pinning trades automatic glibc/openssl/ca-certificates CVE patching for a reproducibility property this repo doesn't currently need. ## Verified locally - `cd tunnel-node && cargo build --release`: clean (binary side unchanged) - `cd tunnel-node && cargo test --release`: 36/36 - Local `docker build` couldn't run (daemon not started on the dev machine); the PR author's test plan documents successful build under classic Docker daemon. Reviewed via Anthropic Claude. Co-Authored-By: dazzling-no-more <noreply@github.com> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
62 lines
2.3 KiB
Docker
62 lines
2.3 KiB
Docker
# Multi-stage build for the mhrv-tunnel-node service.
|
|
#
|
|
# Build stage compiles a release binary on a recent stable Rust.
|
|
# Dependency caching is done via `cargo-chef`: a separate layer cooks
|
|
# just the dependencies first, so warm rebuilds where only `src/`
|
|
# changes reuse that layer and skip recompiling crates.
|
|
#
|
|
# This intentionally avoids BuildKit `--mount=type=cache` directives so
|
|
# the Dockerfile builds on classic Docker daemons too — notably Cloud
|
|
# Run's `gcloud run deploy --source .` builder, which does not enable
|
|
# BuildKit (see issue #620).
|
|
#
|
|
# Runtime stage is `debian:bookworm-slim` for libc compatibility (the
|
|
# binary dynamically links against glibc) plus `ca-certificates` so HTTPS
|
|
# upstream URLs from `data` ops can do TLS handshake. Image stays under
|
|
# 100 MB end-to-end.
|
|
#
|
|
# Runs as a dedicated non-root `tunnel` user (uid 1000) — the service
|
|
# never needs to write outside its own process state, so no reason to
|
|
# give it root.
|
|
#
|
|
# Required env vars:
|
|
# TUNNEL_AUTH_KEY shared secret matching `const TUNNEL_AUTH_KEY` in
|
|
# CodeFull.gs. The service refuses every request
|
|
# without a matching key.
|
|
# PORT HTTP listen port. Defaults to 8080 if unset.
|
|
#
|
|
# Health: the service responds to `GET /` with a small status JSON. Add
|
|
# `--health-cmd 'curl -fsS http://localhost:8080/ || exit 1'` on the
|
|
# `docker run` if you want compose-level health gating.
|
|
|
|
FROM rust:1.90-slim AS chef
|
|
RUN cargo install cargo-chef --locked --version 0.1.77
|
|
WORKDIR /app
|
|
|
|
FROM chef AS planner
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY src/ ./src/
|
|
RUN cargo chef prepare --recipe-path recipe.json
|
|
|
|
FROM chef AS builder
|
|
COPY --from=planner /app/recipe.json recipe.json
|
|
RUN cargo chef cook --release --recipe-path recipe.json
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY src/ ./src/
|
|
RUN cargo build --release --bin tunnel-node && \
|
|
cp /app/target/release/tunnel-node /usr/local/bin/tunnel-node
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN useradd --system --uid 1000 --no-create-home --shell /usr/sbin/nologin tunnel
|
|
|
|
COPY --from=builder /usr/local/bin/tunnel-node /usr/local/bin/tunnel-node
|
|
|
|
USER tunnel
|
|
ENV PORT=8080
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["tunnel-node"]
|