tftsr-devops_investigation/.docker/Dockerfile.linux-arm64
Shaun Arman a365cba30e
All checks were successful
Test / rust-fmt-check (pull_request) Successful in 13s
Test / frontend-typecheck (pull_request) Successful in 1m17s
Test / frontend-tests (pull_request) Successful in 1m20s
PR Review Automation / review (pull_request) Successful in 3m47s
Test / rust-clippy (pull_request) Successful in 4m4s
Test / rust-tests (pull_request) Successful in 5m21s
fix(ci): address second AI review — || true, ca-certs, cache@v4, key suffixes
Dockerfiles:
- Remove || true from rustup component add in all three Linux images;
  rust:1.88-slim default profile already includes both components so the
  command is a clean no-op, not a failure risk — silencing errors served
  no purpose and only hid potential toolchain issues
- Add ca-certificates explicitly to Dockerfile.linux-amd64 and
  Dockerfile.windows-cross (rust:1.88-slim includes it, but being
  explicit is consistent with the arm64 fix and future-proofs against
  base image changes)

Workflows:
- Upgrade actions/cache@v3 → @v4 across test.yml and auto-tag.yml
  (v3 deprecated; v4 has parallel uploads and better large-cache support)
- Add linux-amd64 suffix to cargo cache keys in test.yml Rust jobs and
  auto-tag.yml build-linux-amd64 job; all four jobs target the same
  architecture and now share a cache, benefiting from cross-job hits
  (registry cache is source tarballs, not compiled artifacts — no
  pollution risk between targets)

Not changed:
- alpine:latest + docker-cli in build-images.yml is correct; the reviewer
  confused DinD with socket passthrough — docker:24-cli also has no daemon,
  both use the host socket; the builds already proved alpine works
- curl|bash for rustup is the official install method; rustup.rs publishes
  no checksums for the installer script itself
2026-04-12 20:16:32 -05:00

49 lines
2.4 KiB
Docker

# Pre-baked cross-compiler for Linux arm64 Tauri releases (runs on Linux amd64).
# Bakes in: amd64 cross-toolchain, arm64 multiarch dev libs, Node.js, and Rust.
# This image takes ~15 min to build but is only rebuilt when deps change.
# Rebuild when: Rust toolchain version, webkit2gtk/gtk major version, Node.js major version,
# OpenSSL major version (used via OPENSSL_STATIC=1), or Tauri CLI changes that affect
# bundler system deps.
# Tag format: rust<VER>-node<VER>
FROM ubuntu:22.04
ARG DEBIAN_FRONTEND=noninteractive
# Step 1: amd64 host tools and cross-compiler
RUN apt-get update -qq \
&& apt-get install -y -qq --no-install-recommends \
ca-certificates curl git gcc g++ make patchelf pkg-config perl jq \
gcc-aarch64-linux-gnu g++-aarch64-linux-gnu \
&& rm -rf /var/lib/apt/lists/*
# Step 2: Enable arm64 multiarch. Ubuntu uses ports.ubuntu.com for arm64 to avoid
# binary-all index conflicts with the amd64 archive.ubuntu.com mirror.
RUN dpkg --add-architecture arm64 \
&& sed -i 's|^deb http://archive.ubuntu.com|deb [arch=amd64] http://archive.ubuntu.com|g' /etc/apt/sources.list \
&& sed -i 's|^deb http://security.ubuntu.com|deb [arch=amd64] http://security.ubuntu.com|g' /etc/apt/sources.list \
&& printf '%s\n' \
'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy main restricted universe multiverse' \
'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates main restricted universe multiverse' \
'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security main restricted universe multiverse' \
> /etc/apt/sources.list.d/arm64-ports.list \
&& apt-get update -qq \
&& apt-get install -y -qq --no-install-recommends \
libwebkit2gtk-4.1-dev:arm64 \
libssl-dev:arm64 \
libgtk-3-dev:arm64 \
librsvg2-dev:arm64 \
&& rm -rf /var/lib/apt/lists/*
# Step 3: Node.js 22
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
&& apt-get install -y --no-install-recommends nodejs \
&& rm -rf /var/lib/apt/lists/*
# Step 4: Rust 1.88 with arm64 cross-compilation target
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
--default-toolchain 1.88.0 --profile minimal --no-modify-path \
&& /root/.cargo/bin/rustup target add aarch64-unknown-linux-gnu \
&& /root/.cargo/bin/rustup component add rustfmt clippy
ENV PATH="/root/.cargo/bin:${PATH}"