kata-containers/tools/packaging/kata-deploy/Dockerfile.components

# Copyright Intel Corporation, 2022 IBM Corp.
# Copyright (c) 2025 NVIDIA Corporation
#
# SPDX-License-Identifier: Apache-2.0

#### Nydus snapshotter & nydus image

FROM alpine:3.22 AS nydus-binary-downloader

# When STATIC_NYDUS_SNAPSHOTTER is set to a non-empty value, download the
# statically linked release asset (nydus-snapshotter-<ver>-linux-static.tar.gz)
# instead of the per-arch (dynamically, glibc-linked) one. The static binaries
# run on musl-only hosts that have no glibc dynamic loader. The static asset is
# currently published for x86_64/amd64 only.
ARG STATIC_NYDUS_SNAPSHOTTER=""

COPY versions.yaml /tmp/versions.yaml

RUN \
	set -e && \
	apk add --no-cache curl yq-go && \
	NYDUS_SNAPSHOTTER_VERSION="$(yq eval -e '.externals.nydus-snapshotter.version | explode(.)' /tmp/versions.yaml)" && \
	NYDUS_SNAPSHOTTER_REPO="$(yq eval -e '.externals.nydus-snapshotter.url | explode(.)' /tmp/versions.yaml)" && \
	mkdir -p /opt/nydus-snapshotter && \
	ARCH="$(uname -m)" && \
	if [ "${ARCH}" = "x86_64" ]; then ARCH=amd64 ; fi && \
	if [ "${ARCH}" = "aarch64" ]; then ARCH=arm64; fi && \
	if [ -n "${STATIC_NYDUS_SNAPSHOTTER}" ]; then \
		if [ "${ARCH}" != "amd64" ]; then \
			echo "STATIC_NYDUS_SNAPSHOTTER is only supported on amd64 (no static asset is published for ${ARCH})" >&2; \
			exit 1; \
		fi; \
		NYDUS_SNAPSHOTTER_TARBALL="nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-static.tar.gz"; \
	else \
		NYDUS_SNAPSHOTTER_TARBALL="nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz"; \
	fi && \
	curl -fOL --progress-bar "${NYDUS_SNAPSHOTTER_REPO}/releases/download/${NYDUS_SNAPSHOTTER_VERSION}/${NYDUS_SNAPSHOTTER_TARBALL}" && \
	tar xvzpf "${NYDUS_SNAPSHOTTER_TARBALL}" -C /opt/nydus-snapshotter && \
	rm "${NYDUS_SNAPSHOTTER_TARBALL}"

#### Build binary package
FROM ubuntu:22.04 AS rust-builder

# Default to Rust 1.93
ARG RUST_TOOLCHAIN=1.93
ENV DEBIAN_FRONTEND=noninteractive
ENV RUSTUP_HOME="/opt/rustup"
ENV CARGO_HOME="/opt/cargo"
ENV PATH="/opt/cargo/bin/:${PATH}"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN \
	mkdir ${RUSTUP_HOME} ${CARGO_HOME} && \
	chmod -R a+rwX ${RUSTUP_HOME} ${CARGO_HOME}

RUN \
	apt-get update && \
	apt-get --no-install-recommends -y install \
		ca-certificates \
		curl \
		gcc \
		libc6-dev \
		musl-tools && \
	apt-get clean && rm -rf /var/lib/apt/lists/ && \
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain ${RUST_TOOLCHAIN} && \
	rustup component add rustfmt clippy

# Build from the repository root so kata-deploy uses the root Cargo workspace:
#   docker build -f tools/packaging/kata-deploy/Dockerfile.components .
WORKDIR /kata

COPY Cargo.toml Cargo.lock ./
COPY src ./src
COPY tools/packaging/kata-deploy/binary ./tools/packaging/kata-deploy/binary
COPY tools/packaging/kata-deploy/job-dispatcher ./tools/packaging/kata-deploy/job-dispatcher

# Install target and run tests based on architecture
# - AMD64/arm64: use musl for fully static binaries
# - PPC64le/s390x: use glibc (musl has issues on these platforms)
RUN \
	HOST_ARCH="$(uname -m)"; \
	rust_arch=""; \
	rust_target=""; \
	case "${HOST_ARCH}" in \
		"x86_64") \
			rust_arch="x86_64"; \
			rust_target="${rust_arch}-unknown-linux-musl"; \
			echo "Installing musl target for ${rust_target}"; \
			rustup target add "${rust_target}"; \
			;; \
		"aarch64") \
			rust_arch="aarch64"; \
			rust_target="${rust_arch}-unknown-linux-musl"; \
			echo "Installing musl target for ${rust_target}"; \
			rustup target add "${rust_target}"; \
			;; \
		"ppc64le") \
			rust_arch="powerpc64le"; \
			rust_target="${rust_arch}-unknown-linux-gnu"; \
			echo "Using glibc target for ${rust_target} (musl is not well supported on ppc64le)"; \
			;; \
		"s390x") \
			rust_arch="s390x"; \
			rust_target="${rust_arch}-unknown-linux-gnu"; \
			echo "Using glibc target for ${rust_target} (musl is not well supported on s390x)"; \
			;; \
		*) echo "Unsupported architecture: ${HOST_ARCH}" && exit 1 ;; \
	esac; \
	echo "${rust_target}" > /tmp/rust_target

# Verify code formatting and run cargo check before tests and build
RUN \
	set -e && \
	rust_target="$(cat /tmp/rust_target)" && \
	echo "Checking code formatting..." && \
	cargo fmt -p kata-deploy --check && \
	cargo fmt -p kata-deploy-job-dispatcher --check && \
	echo "Code formatting check passed!" && \
	echo "Running cargo clippy with target ${rust_target}..." && \
	cargo clippy -p kata-deploy --all-targets --all-features --release --locked --target "${rust_target}" -- -D warnings && \
	cargo clippy -p kata-deploy-job-dispatcher --all-targets --all-features --release --locked --target "${rust_target}" -- -D warnings && \
	echo "Cargo clippy passed!"

# Run tests using --test-threads=1 to prevent environment variable pollution between tests,
# and this is fine as we'll never ever have multiple binaries running at the same time.
RUN \
	rust_target="$(cat /tmp/rust_target)"; \
	echo "Running binary tests with target ${rust_target}..." && \
	RUSTFLAGS="-D warnings" cargo test -p kata-deploy --target "${rust_target}" -- --test-threads=1 && \
	RUSTFLAGS="-D warnings" cargo test -p kata-deploy-job-dispatcher --target "${rust_target}" -- --test-threads=1 && \
	echo "All tests passed!"

RUN \
	rust_target="$(cat /tmp/rust_target)"; \
	echo "Building kata-deploy + kata-deploy-job-dispatcher binaries for ${rust_target}..." && \
	RUSTFLAGS="-D warnings" cargo build --release -p kata-deploy -p kata-deploy-job-dispatcher --target "${rust_target}" && \
	mkdir -p /kata-deploy/bin && \
	cp "/kata/target/${rust_target}/release/kata-deploy" /kata-deploy/bin/kata-deploy && \
	cp "/kata/target/${rust_target}/release/kata-deploy-job-dispatcher" /kata-deploy/bin/kata-deploy-job-dispatcher && \
	echo "Cleaning up build artifacts to save disk space..." && \
	rm -rf /kata/target && \
	cargo clean