154 lines
6.9 KiB
Docker
154 lines
6.9 KiB
Docker
# Multi-stage Dockerfile for the Attune universal worker agent
|
|
#
|
|
# Builds a statically-linked attune-agent binary using musl, suitable for
|
|
# injection into ANY container as a sidecar or init container. The binary
|
|
# has zero runtime dependencies — no glibc, no libssl, no shared libraries.
|
|
#
|
|
# Stages:
|
|
# builder - Cross-compile with musl for a fully static binary
|
|
# agent-binary - Minimal scratch image containing just the binary
|
|
# agent-init - BusyBox-based image for use as a Kubernetes init container
|
|
# or Docker Compose volume-populating service (has `cp`)
|
|
#
|
|
# Usage:
|
|
# # Build the minimal binary-only image:
|
|
# DOCKER_BUILDKIT=1 docker buildx build --target agent-binary -f docker/Dockerfile.agent -t attune-agent:binary .
|
|
#
|
|
# # Build the init container image (for volume population via `cp`):
|
|
# DOCKER_BUILDKIT=1 docker buildx build --target agent-init -f docker/Dockerfile.agent -t attune-agent:latest .
|
|
#
|
|
# # Use in docker-compose.yaml to populate a shared volume:
|
|
# # agent-init:
|
|
# # image: attune-agent:latest
|
|
# # command: ["cp", "/usr/local/bin/attune-agent", "/shared/attune-agent"]
|
|
# # volumes:
|
|
# # - agent_binary:/shared
|
|
#
|
|
# Note: The agent binary is part of the worker crate (--bin attune-agent).
|
|
# It connects to the Attune API and executes actions inside the target container.
|
|
|
|
ARG RUST_VERSION=1.92
|
|
ARG DEBIAN_VERSION=bookworm
|
|
|
|
# ============================================================================
|
|
# Stage 1: Builder - Cross-compile a statically-linked binary with musl
|
|
# ============================================================================
|
|
FROM rust:${RUST_VERSION}-${DEBIAN_VERSION} AS builder
|
|
|
|
# Install musl toolchain for static linking
|
|
RUN apt-get update && apt-get install -y \
|
|
musl-tools \
|
|
pkg-config \
|
|
libssl-dev \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Add the musl target for fully static binaries
|
|
RUN rustup target add x86_64-unknown-linux-musl
|
|
|
|
WORKDIR /build
|
|
|
|
# Increase rustc stack size to prevent SIGSEGV during release builds
|
|
ENV RUST_MIN_STACK=67108864
|
|
|
|
# Enable SQLx offline mode — compile-time query checking without a live database
|
|
ENV SQLX_OFFLINE=true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Dependency caching layer
|
|
# Copy only Cargo metadata first so `cargo fetch` is cached when only source
|
|
# code changes. This follows the same pattern as Dockerfile.worker.optimized.
|
|
# ---------------------------------------------------------------------------
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY crates/common/Cargo.toml ./crates/common/Cargo.toml
|
|
COPY crates/api/Cargo.toml ./crates/api/Cargo.toml
|
|
COPY crates/executor/Cargo.toml ./crates/executor/Cargo.toml
|
|
COPY crates/sensor/Cargo.toml ./crates/sensor/Cargo.toml
|
|
COPY crates/core-timer-sensor/Cargo.toml ./crates/core-timer-sensor/Cargo.toml
|
|
COPY crates/worker/Cargo.toml ./crates/worker/Cargo.toml
|
|
COPY crates/notifier/Cargo.toml ./crates/notifier/Cargo.toml
|
|
COPY crates/cli/Cargo.toml ./crates/cli/Cargo.toml
|
|
|
|
# Create minimal stub sources so cargo can resolve the workspace and fetch deps.
|
|
# These are ONLY used for `cargo fetch` — never compiled.
|
|
# NOTE: The worker crate has TWO binary targets (attune-worker and attune-agent),
|
|
# so we create stubs for both to satisfy the workspace resolver.
|
|
RUN mkdir -p crates/common/src && echo "" > crates/common/src/lib.rs && \
|
|
mkdir -p crates/api/src && echo "fn main(){}" > crates/api/src/main.rs && \
|
|
mkdir -p crates/executor/src && echo "fn main(){}" > crates/executor/src/main.rs && \
|
|
mkdir -p crates/executor/benches && echo "fn main(){}" > crates/executor/benches/context_clone.rs && \
|
|
mkdir -p crates/sensor/src && echo "fn main(){}" > crates/sensor/src/main.rs && \
|
|
mkdir -p crates/core-timer-sensor/src && echo "fn main(){}" > crates/core-timer-sensor/src/main.rs && \
|
|
mkdir -p crates/worker/src && echo "fn main(){}" > crates/worker/src/main.rs && \
|
|
echo "fn main(){}" > crates/worker/src/agent_main.rs && \
|
|
mkdir -p crates/notifier/src && echo "fn main(){}" > crates/notifier/src/main.rs && \
|
|
mkdir -p crates/cli/src && echo "fn main(){}" > crates/cli/src/main.rs
|
|
|
|
# Download all dependencies (cached unless Cargo.toml/Cargo.lock change)
|
|
# registry/git use sharing=shared — cargo handles concurrent reads safely
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=shared \
|
|
--mount=type=cache,target=/usr/local/cargo/git,sharing=shared \
|
|
cargo fetch
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Build layer
|
|
# Copy real source code and compile only the agent binary with musl
|
|
# ---------------------------------------------------------------------------
|
|
COPY migrations/ ./migrations/
|
|
COPY crates/ ./crates/
|
|
|
|
# Build ONLY the attune-agent binary, statically linked with musl.
|
|
# Uses a dedicated cache ID (agent-target) so the musl target directory
|
|
# doesn't collide with the glibc target cache used by other Dockerfiles.
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=shared \
|
|
--mount=type=cache,target=/usr/local/cargo/git,sharing=shared \
|
|
--mount=type=cache,id=agent-target,target=/build/target,sharing=locked \
|
|
cargo build --release --target x86_64-unknown-linux-musl --bin attune-agent && \
|
|
cp /build/target/x86_64-unknown-linux-musl/release/attune-agent /build/attune-agent
|
|
|
|
# Strip the binary to minimize size
|
|
RUN strip /build/attune-agent
|
|
|
|
# Verify the binary is statically linked and functional
|
|
RUN ls -lh /build/attune-agent && \
|
|
file /build/attune-agent && \
|
|
ldd /build/attune-agent 2>&1 || true
|
|
|
|
# ============================================================================
|
|
# Stage 2: agent-binary - Minimal image with just the static binary
|
|
# ============================================================================
|
|
# This is the smallest possible image — a single static binary on scratch.
|
|
# Useful when you only need to extract the binary (e.g., via COPY --from).
|
|
FROM scratch AS agent-binary
|
|
|
|
COPY --from=builder /build/attune-agent /usr/local/bin/attune-agent
|
|
|
|
ENTRYPOINT ["/usr/local/bin/attune-agent"]
|
|
|
|
# ============================================================================
|
|
# Stage 3: agent-init - Init container for volume population
|
|
# ============================================================================
|
|
# Uses busybox so we have `cp`, `sh`, etc. for use as a Docker Compose or
|
|
# Kubernetes init container that copies the agent binary into a shared volume.
|
|
#
|
|
# Example docker-compose.yaml usage:
|
|
# agent-init:
|
|
# image: attune-agent:latest
|
|
# command: ["cp", "/usr/local/bin/attune-agent", "/shared/attune-agent"]
|
|
# volumes:
|
|
# - agent_binary:/shared
|
|
#
|
|
# my-worker-container:
|
|
# image: python:3.12
|
|
# command: ["/agent/attune-agent"]
|
|
# volumes:
|
|
# - agent_binary:/agent:ro
|
|
# depends_on:
|
|
# agent-init:
|
|
# condition: service_completed_successfully
|
|
FROM busybox:1.36 AS agent-init
|
|
|
|
COPY --from=builder /build/attune-agent /usr/local/bin/attune-agent
|
|
|
|
ENTRYPOINT ["/usr/local/bin/attune-agent"]
|