Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(rust): follow depot recommendations for dockerfiles #29294

Merged
merged 5 commits into from
Feb 28, 2025
+55 −16
Merged

chore(rust): follow depot recommendations for dockerfiles #29294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
834446b
follow depot recommendations
oliverb123 Feb 27, 2025
a75b87e
use depot sccache if it's available in the runner
oliverb123 Feb 27, 2025
ed0d157
whoops
oliverb123 Feb 27, 2025
acae67d
also update workflow
oliverb123 Feb 27, 2025
6bac422
fix dockerfile
oliverb123 Feb 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/rust-docker-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,9 @@ jobs:
labels: ${{ steps.meta.outputs.labels }}
platforms: linux/arm64,linux/amd64
build-args: BIN=${{ matrix.image }}
secrets: |
SCCACHE_WEBDAV_ENDPOINT=${{ env.SCCACHE_WEBDAV_ENDPOINT }}
SCCACHE_WEBDAV_TOKEN=${{ env.SCCACHE_WEBDAV_TOKEN }}
- name: Container image digest
id: digest
Expand Down
34 changes: 26 additions & 8 deletions rust/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,28 +1,46 @@
FROM docker.io/lukemathwalker/cargo-chef:latest-rust-1.82-bookworm AS chef
ARG BIN
WORKDIR /app
# Taken from: https://depot.dev/docs/container-builds/how-to-guides/optimal-dockerfiles/rust-dockerfile
FROM rust:1.82 AS base
RUN cargo install --locked cargo-chef sccache
ENV RUSTC_WRAPPER=sccache SCCACHE_DIR=/sccache

FROM chef AS planner
FROM base AS planner
WORKDIR /app
ARG BIN

COPY . .
RUN cargo chef prepare --recipe-path recipe.json --bin $BIN

FROM chef AS builder
FROM base AS builder
WORKDIR /app
ARG BIN

# Ensure working C compile setup (not installed by default in arm64 images)
RUN apt update && apt install build-essential libssl-dev cmake -y
RUN apt-get update && apt-get install build-essential libssl-dev cmake -y

Check warning on line 18 in rust/Dockerfile

View workflow job for this annotation

GitHub Actions / Lint changed Dockerfiles 

Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`

Check notice on line 18 in rust/Dockerfile

View workflow job for this annotation

GitHub Actions / Lint changed Dockerfiles 

Avoid additional packages by specifying `--no-install-recommends`

COPY --from=planner /app/recipe.json recipe.json
RUN cargo chef cook --release --recipe-path recipe.json --bin $BIN
RUN --mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/usr/local/cargo/git \
--mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
cargo chef cook --release --recipe-path recipe.json --bin $BIN

COPY . .
RUN cargo build --release --bin $BIN
RUN --mount=type=secret,id=SCCACHE_WEBDAV_ENDPOINT,required=false \
--mount=type=secret,id=SCCACHE_WEBDAV_TOKEN,required=false \
--mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/usr/local/cargo/git \
--mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
if [ -f "/run/secrets/SCCACHE_WEBDAV_ENDPOINT" ] && [ -f "/run/secrets/SCCACHE_WEBDAV_TOKEN" ]; then \
SCCACHE_WEBDAV_ENDPOINT=$(cat /run/secrets/SCCACHE_WEBDAV_ENDPOINT) \
SCCACHE_WEBDAV_TOKEN=$(cat /run/secrets/SCCACHE_WEBDAV_TOKEN) \
cargo build --release --bin $BIN; \
else \
cargo build --release --bin $BIN; \
fi


FROM debian:bookworm-slim AS runtime

RUN apt-get update && \

Check warning on line 43 in rust/Dockerfile

View workflow job for this annotation

GitHub Actions / Lint changed Dockerfiles 

Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
apt-get install -y --no-install-recommends \
libssl-dev "ca-certificates" \
&& \
Expand Down
34 changes: 26 additions & 8 deletions rust/Dockerfile-feature-flags
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,42 @@
FROM docker.io/lukemathwalker/cargo-chef:latest-rust-1.82-bookworm AS chef
ARG BIN
WORKDIR /app
# Taken from: https://depot.dev/docs/container-builds/how-to-guides/optimal-dockerfiles/rust-dockerfile
FROM rust:1.82 AS base
RUN cargo install --locked cargo-chef sccache
ENV RUSTC_WRAPPER=sccache SCCACHE_DIR=/sccache

FROM chef AS planner
FROM base AS planner
WORKDIR /app
ARG BIN

COPY . .
RUN cargo chef prepare --recipe-path recipe.json --bin $BIN

FROM chef AS builder
FROM base AS builder
WORKDIR /app
ARG BIN

# Ensure working C compile setup (not installed by default in arm64 images)
RUN apt update && apt install build-essential libssl-dev cmake -y
RUN apt-get update && apt-get install build-essential libssl-dev cmake -y

COPY --from=planner /app/recipe.json recipe.json
RUN cargo chef cook --release --recipe-path recipe.json
RUN --mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/usr/local/cargo/git \
--mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
cargo chef cook --release --recipe-path recipe.json --bin $BIN

COPY . .
RUN cargo build --release --bin $BIN
RUN --mount=type=secret,id=SCCACHE_WEBDAV_ENDPOINT,required=false \
--mount=type=secret,id=SCCACHE_WEBDAV_TOKEN,required=false \
--mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/usr/local/cargo/git \
--mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
if [ -f "/run/secrets/SCCACHE_WEBDAV_ENDPOINT" ] && [ -f "/run/secrets/SCCACHE_WEBDAV_TOKEN" ]; then \
SCCACHE_WEBDAV_ENDPOINT=$(cat /run/secrets/SCCACHE_WEBDAV_ENDPOINT) \
SCCACHE_WEBDAV_TOKEN=$(cat /run/secrets/SCCACHE_WEBDAV_TOKEN) \
cargo build --release --bin $BIN; \
else \
cargo build --release --bin $BIN; \
fi


FROM debian:bookworm-slim AS runtime

Expand Down
Loading