Skip to content

Commit 8a3c0b0

Browse files
jtoelke2jtoelke2
authored
feat(docker): add BINARY_SOURCE selector for prebuilt Rust binaries (#945)
* feat(docker): add BINARY_SOURCE selector for prebuilt Rust binaries Signed-off-by: Jonas Toelke <jtoelke@nvidia.com> * fix(docker): preserve exec bit on prebuilt binary COPY Adds --chmod=755 to the COPY instructions in the scratch-based prebuilt binary stages. Without this, binaries produced by PR 4a and shuttled through actions/upload-artifact + download-artifact lose their executable bit during the roundtrip, and the resulting image's ENTRYPOINT fails at runtime. Signed-off-by: Jonas Toelke <jtoelke@nvidia.com> --------- Signed-off-by: Jonas Toelke <jtoelke@nvidia.com>
1 parent df38d1f commit 8a3c0b0

2 files changed

Lines changed: 63 additions & 4 deletions

File tree

‎deploy/docker/Dockerfile.images‎

Lines changed: 43 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,12 @@ ARG K9S_VERSION=v0.50.18
2222
ARG HELM_VERSION=v3.17.3
2323
ARG NVIDIA_CONTAINER_TOOLKIT_VERSION=1.18.2-1
2424

25+
# OS-128 Phase 4: select binary source for final images. `build` (default)
26+
# compiles Rust inside the builder stages below; `prebuilt` consumes binaries
27+
# staged at deploy/docker/.build/prebuilt-binaries/<arch>/. Declared at global
28+
# scope so BuildKit can substitute it in `FROM *-binary-${BINARY_SOURCE}`.
29+
ARG BINARY_SOURCE=build
30+
2531
# ---------------------------------------------------------------------------
2632
# Shared Rust build stages
2733
# ---------------------------------------------------------------------------
@@ -178,10 +184,43 @@ RUN --mount=type=cache,id=cargo-registry-${TARGETARCH},sharing=locked,target=/us
178184
mkdir -p /build/out && \
179185
cp "$(cross_output_dir release)/openshell-sandbox" /build/out/
180186

187+
# ---------------------------------------------------------------------------
188+
# Binary source selector (OS-128 Phase 4)
189+
# ---------------------------------------------------------------------------
190+
# `BINARY_SOURCE` is declared at global scope above (near the other version
191+
# ARGs). `build` (default) routes through the Rust builder stages above;
192+
# `prebuilt` routes through the scratch stages below, which COPY from
193+
# deploy/docker/.build/prebuilt-binaries/<arch>/openshell-{gateway,sandbox}
194+
# in the build context. Prebuilt-artifact production + end-to-end workflow
195+
# wiring land in later Phase 4 PRs; the `prebuilt` path is inert unless a
196+
# caller sets BINARY_SOURCE=prebuilt and stages the binaries.
197+
198+
FROM gateway-builder AS gateway-binary-build
199+
# Inherits /build/out/openshell-gateway from the cargo build stage.
200+
201+
FROM scratch AS gateway-binary-prebuilt
202+
ARG TARGETARCH
203+
# --chmod=755 preserves the executable bit through actions/upload-artifact +
204+
# download-artifact, which strip exec perms during the roundtrip.
205+
COPY --chmod=755 deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-gateway /build/out/openshell-gateway
206+
207+
FROM gateway-binary-${BINARY_SOURCE} AS gateway-binary
208+
209+
FROM supervisor-builder AS supervisor-binary-build
210+
# Inherits /build/out/openshell-sandbox from the cargo build stage.
211+
212+
FROM scratch AS supervisor-binary-prebuilt
213+
ARG TARGETARCH
214+
# --chmod=755 preserves the executable bit through actions/upload-artifact +
215+
# download-artifact, which strip exec perms during the roundtrip.
216+
COPY --chmod=755 deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-sandbox /build/out/openshell-sandbox
217+
218+
FROM supervisor-binary-${BINARY_SOURCE} AS supervisor-binary
219+
181220
# Minimal extraction stage for fast-deploy: exports only the supervisor
182221
# binary (~20-40 MB) instead of the entire build environment (~968 MB).
183222
FROM scratch AS supervisor-output
184-
COPY --from=supervisor-builder /build/out/openshell-sandbox /openshell-sandbox
223+
COPY --from=supervisor-binary /build/out/openshell-sandbox /openshell-sandbox
185224

186225
# ---------------------------------------------------------------------------
187226
# Final gateway image
@@ -197,7 +236,7 @@ RUN useradd --create-home --user-group openshell
197236

198237
WORKDIR /app
199238

200-
COPY --from=gateway-builder /build/out/openshell-gateway /usr/local/bin/
239+
COPY --from=gateway-binary /build/out/openshell-gateway /usr/local/bin/
201240

202241
RUN mkdir -p /build/crates/openshell-server
203242
COPY --chmod=755 crates/openshell-server/migrations /build/crates/openshell-server/migrations
@@ -222,7 +261,7 @@ RUN useradd --create-home --user-group openshell
222261

223262
WORKDIR /app
224263

225-
COPY --from=supervisor-builder /build/out/openshell-sandbox /usr/local/bin/
264+
COPY --from=supervisor-binary /build/out/openshell-sandbox /usr/local/bin/
226265

227266
USER openshell
228267

@@ -292,7 +331,7 @@ COPY --from=nvidia-container-toolkit /usr/bin/nvidia-cdi-hook /usr/bin/
292331
COPY --from=nvidia-container-toolkit /usr/bin/nvidia-container-runtime /usr/bin/
293332
COPY --from=nvidia-container-toolkit /usr/bin/nvidia-ctk /usr/bin/
294333
COPY --from=nvidia-container-toolkit /etc/nvidia-container-runtime /etc/nvidia-container-runtime
295-
COPY --from=supervisor-builder /build/out/openshell-sandbox /opt/openshell/bin/openshell-sandbox
334+
COPY --from=supervisor-binary /build/out/openshell-sandbox /opt/openshell/bin/openshell-sandbox
296335

297336
RUN mkdir -p /var/lib/rancher/k3s/server/manifests \
298337
/var/lib/rancher/k3s/server/static/charts \

‎tasks/scripts/docker-build-image.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,25 @@ if [[ -n "${CI:-}" ]]; then
152152
CODEGEN_ARGS=(--build-arg "CARGO_CODEGEN_UNITS=1")
153153
fi
154154

155+
# OS-128 Phase 4: opt in to consuming pre-built Rust binaries instead of
156+
# compiling inside Docker. Default path (`build`) is unchanged. When
157+
# USE_PREBUILT_BINARIES=true, the Dockerfile's BINARY_SOURCE=prebuilt stages
158+
# are selected, which COPY from deploy/docker/.build/prebuilt-binaries/<arch>/
159+
# in the build context. Callers must stage the binaries before invoking.
160+
BINARY_SOURCE_ARGS=()
161+
if [[ "${USE_PREBUILT_BINARIES:-}" == "true" ]]; then
162+
case "${TARGET}" in
163+
gateway|supervisor|cluster|supervisor-output)
164+
if [[ ! -d deploy/docker/.build/prebuilt-binaries ]]; then
165+
echo "Error: USE_PREBUILT_BINARIES=true but deploy/docker/.build/prebuilt-binaries/ does not exist" >&2
166+
echo " Stage binaries at deploy/docker/.build/prebuilt-binaries/<arch>/openshell-{gateway,sandbox}" >&2
167+
exit 1
168+
fi
169+
BINARY_SOURCE_ARGS=(--build-arg "BINARY_SOURCE=prebuilt")
170+
;;
171+
esac
172+
fi
173+
155174
TAG_ARGS=()
156175
if [[ "${IS_FINAL_IMAGE}" == "1" ]]; then
157176
TAG_ARGS=(-t "${IMAGE_NAME}:${IMAGE_TAG}")
@@ -190,6 +209,7 @@ ce_build \
190209
${VERSION_ARGS[@]+"${VERSION_ARGS[@]}"} \
191210
${K3S_ARGS[@]+"${K3S_ARGS[@]}"} \
192211
${CODEGEN_ARGS[@]+"${CODEGEN_ARGS[@]}"} \
212+
${BINARY_SOURCE_ARGS[@]+"${BINARY_SOURCE_ARGS[@]}"} \
193213
${FEATURE_ARGS[@]+"${FEATURE_ARGS[@]}"} \
194214
--build-arg "CARGO_TARGET_CACHE_SCOPE=${CARGO_TARGET_CACHE_SCOPE}" \
195215
-f "${DOCKERFILE}" \

0 commit comments

Comments
 (0)