mdk/Dockerfile.convergence-campaign at master · marmot-protocol/mdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# syntax=docker/dockerfile:1.7

FROM rust:1.97.1-bookworm@sha256:14bc9c5966e7b3a385794b3d5389a8765668342025fbcc7b2e3d2866ac4bd8c3 AS builder

WORKDIR /workspace
COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
COPY .cargo ./.cargo
COPY crates ./crates
COPY integrations ./integrations
COPY docs/marmot-architecture/product-event-catalogue.json ./docs/marmot-architecture/
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/workspace/target \
    cargo build --locked --release -p convergence-campaign-runner \
      --bin cgka-conformance-node --bin cgka-conformance-relay \
    && mkdir -p /campaign-bin \
    && cp target/release/cgka-conformance-node target/release/cgka-conformance-relay /campaign-bin/

FROM debian:bookworm-20260713-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818

ARG DEBIAN_SNAPSHOT=20260713T000000Z

# Campaign-only image. NET_ADMIN is granted only to short-lived fault-injector
# containers, never participant processes or a production service. The tools
# below implement explicit network and disk fault actions from the versioned
# distributed manifest.
RUN rm -f /etc/apt/sources.list.d/debian.sources \
    && printf 'deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/%s bookworm main\n' "$DEBIAN_SNAPSHOT" \
        > /etc/apt/sources.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        iproute2 \
        iptables \
        ipset \
        procps \
        stress-ng \
        util-linux \
    && dpkg-query --show --showformat='${Package}=${Version}\n' \
        > /usr/local/share/campaign-runtime-packages.txt \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --gid 65532 campaign \
    && useradd --uid 65532 --gid 65532 --no-create-home --shell /usr/sbin/nologin campaign \
    && install --directory --owner=65532 --group=65532 --mode=0700 /campaign

COPY --from=builder /campaign-bin/cgka-conformance-node /usr/local/bin/
COPY --from=builder /campaign-bin/cgka-conformance-relay /usr/local/bin/

VOLUME ["/campaign"]
USER 65532:65532
CMD ["cgka-conformance-node"]