Dockerfile.ci

# syntax=docker/dockerfile:1.7
#
# CI smoke-test image for the sbproxy data plane.
#
# Optimized for the kind-based smoke test, the `k8s-operator-smoke`
# Makefile target. That target is local-only; no CI workflow builds this
# image. Uses the same cargo-chef layered layout as
# `Dockerfile.cloudbuild` so warm rebuilds (only first-party source
# changed) finish in under 90s.
#
# This is intentionally NOT the production / release image: the release
# pipeline at `.github/workflows/release.yml` produces signed multi-arch
# images via a different flow (cross-compile + cosign + SBOM). Keep the
# two in sync only on the runtime base (distroless/cc-debian12).
#
# Usage:
#   DOCKER_BUILDKIT=1 docker build -t sbproxy:ci -f Dockerfile.ci .
#   DOCKER_BUILDKIT=1 docker build --build-arg CARGO_PROFILE=release -t sbproxy:release -f Dockerfile.ci .
#
# REQUIRES BuildKit. The cache mounts on /usr/local/cargo/{registry,git}
# only take effect when BuildKit is the active builder. docker >= 23
# enables BuildKit by default, but on a legacy builder the cache mounts
# silently no-op and the build still succeeds (just slower).

# --- Stage 1: chef-base ------------------------------------------------
FROM rust:1.95-bookworm AS chef-base
WORKDIR /src
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      pkg-config libclang-dev \
      build-essential cmake perl \
      protobuf-compiler \
 && rm -rf /var/lib/apt/lists/*
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
    cargo install --locked cargo-chef@0.1.71

# --- Stage 2: planner --------------------------------------------------
FROM chef-base AS planner
COPY . .
RUN cargo chef prepare --recipe-path recipe.json

# --- Stage 3: cacher ---------------------------------------------------
FROM chef-base AS cacher
ARG CARGO_PROFILE=release-fast
COPY --from=planner /src/recipe.json recipe.json
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
    cargo chef cook --profile "${CARGO_PROFILE}" --bin sbproxy --recipe-path recipe.json

# --- Stage 4: builder --------------------------------------------------
FROM chef-base AS builder
ARG CARGO_PROFILE=release-fast
COPY --from=cacher /src/target target
COPY . .
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
    cargo build --profile "${CARGO_PROFILE}" --bin sbproxy --locked \
 && cp "/src/target/${CARGO_PROFILE}/sbproxy" /usr/local/bin/sbproxy \
 && mkdir -p /var/lib/sbproxy

# --- Stage 5: runtime --------------------------------------------------
FROM gcr.io/distroless/cc-debian12:nonroot AS runtime
COPY --from=builder /usr/local/bin/sbproxy /usr/local/bin/sbproxy
# /var/lib/sbproxy must exist and be writable by the nonroot runtime
# user (uid 65532): the documented defaults for the key_management
# keystore and usage rollups live there, and the base image only has a
# root-owned /var/lib (WOR-2087). Keep in sync with the release image
# built inline in .github/workflows/release.yml.
COPY --from=builder --chown=65532:65532 /var/lib/sbproxy /var/lib/sbproxy
EXPOSE 8080 9090
ENTRYPOINT ["/usr/local/bin/sbproxy"]
CMD ["serve", "-f", "/etc/sbproxy/sb.yml"]