Skip to content

Commit 9fd7773

Browse files
jayantkjayantk
authored
build(docker): pin Rust image builds to the committed Cargo.lock (#4004)
Every Rust Dockerfile now builds with `--locked`, so an image build resolves to the dependency graph committed in the repo instead of re-resolving against crates.io at build time. The argus, quorum and Tilt dev images had no lockfile in their build context at all and synthesized a throwaway workspace manifest, so they re-resolved the whole graph on every build. `--locked` cannot be bolted onto that shape: cargo garbage-collects lock entries for workspace members that are absent from the context, which counts as a lockfile rewrite. These images now copy the real root `Cargo.toml` + `Cargo.lock` plus every workspace member and build with `-p <crate>` from `/src`, matching the shape fortuna and bulk-trade-pusher already used. Fortuna and bulk-trade-pusher move to the same shape for the same reason. apps/argus/Dockerfile was a stale copy of fortuna's from the port in #2464: it built and shipped the `fortuna` binary and pinned Rust 1.82, which no longer builds the workspace. It now builds and ships `argus` at the repo's pinned toolchain. Nothing consumes the image today - it has no CI workflow and no deployment reference - so there is no rollout concern. Dockerfile.dev's context moves from apps/pyth-lazer-pusher to the repo root so it can see the workspace lockfile; the Tiltfile's context and `only` list move with it. Bare `cargo build` there would now build the entire monorepo workspace, so it is scoped to the three binaries the image extracts. Co-authored-by: Jayant Krishnamurthy <541339+jayantk@users.noreply.github.com>
1 parent f7df0ce commit 9fd7773

11 files changed

Lines changed: 87 additions & 44 deletions

File tree

‎apps/argus/Dockerfile‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,27 @@
1-
ARG RUST_VERSION=1.82.0
1+
ARG RUST_VERSION=1.89.0
22

33
FROM rust:${RUST_VERSION} AS build
44

55
# Build
66
WORKDIR /src
7+
# `cargo build --locked` refuses to rewrite Cargo.lock, and cargo prunes entries
8+
# for absent workspace members, so every member listed in the root Cargo.toml has
9+
# to be in the context even though only one is built.
10+
COPY Cargo.toml Cargo.lock ./
11+
COPY apps/argus apps/argus
712
COPY apps/fortuna apps/fortuna
8-
COPY pythnet pythnet
13+
COPY apps/hermes/client/rust apps/hermes/client/rust
14+
COPY apps/pyth-lazer-pusher apps/pyth-lazer-pusher
15+
COPY apps/quorum apps/quorum
16+
COPY lazer/contracts/cardano/cli/rust lazer/contracts/cardano/cli/rust
17+
COPY pythnet/pythnet_sdk pythnet/pythnet_sdk
18+
COPY target_chains/starknet/tools/test_vaas target_chains/starknet/tools/test_vaas
919
COPY target_chains/ethereum/entropy_sdk/solidity/abis target_chains/ethereum/entropy_sdk/solidity/abis
1020

11-
WORKDIR /src/apps/fortuna
12-
13-
RUN --mount=type=cache,target=/root/.cargo/registry cargo build --release
21+
RUN --mount=type=cache,target=/root/.cargo/registry \
22+
cargo build --locked --release -p argus
1423

1524

1625
FROM rust:${RUST_VERSION}
1726
# Copy artifacts from other images
18-
COPY --from=build /src/apps/fortuna/target/release/fortuna /usr/local/bin/
27+
COPY --from=build /src/target/release/argus /usr/local/bin/

‎apps/binance-recorder/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ RUN apt-get update \
99
WORKDIR /app
1010
COPY Cargo.toml Cargo.lock ./
1111
COPY src ./src
12-
RUN cargo build --release
12+
RUN cargo build --locked --release
1313

1414
FROM debian:bookworm-slim
1515

‎apps/fortuna/Dockerfile‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,22 @@ FROM rust:${RUST_VERSION} AS build
44

55
# Build
66
WORKDIR /src
7+
# `cargo build --locked` refuses to rewrite Cargo.lock, and cargo prunes entries
8+
# for absent workspace members, so every member listed in the root Cargo.toml has
9+
# to be in the context even though only one is built.
10+
COPY Cargo.toml Cargo.lock ./
11+
COPY apps/argus apps/argus
712
COPY apps/fortuna apps/fortuna
8-
COPY pythnet pythnet
9-
COPY Cargo.lock .
13+
COPY apps/hermes/client/rust apps/hermes/client/rust
14+
COPY apps/pyth-lazer-pusher apps/pyth-lazer-pusher
15+
COPY apps/quorum apps/quorum
16+
COPY lazer/contracts/cardano/cli/rust lazer/contracts/cardano/cli/rust
17+
COPY pythnet/pythnet_sdk pythnet/pythnet_sdk
18+
COPY target_chains/starknet/tools/test_vaas target_chains/starknet/tools/test_vaas
1019
COPY target_chains/ethereum/entropy_sdk/solidity/abis target_chains/ethereum/entropy_sdk/solidity/abis
1120

1221
RUN --mount=type=cache,target=/root/.cargo/registry \
13-
printf "[workspace]\nresolver = \"2\"\nmembers = [\"apps/fortuna\",\"pythnet/pythnet_sdk\"]" > Cargo.toml && \
14-
cargo build --release -p fortuna
22+
cargo build --locked --release -p fortuna
1523

1624

1725
FROM rust:${RUST_VERSION}

‎apps/hermes/server/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ COPY pythnet/pythnet_sdk pythnet/pythnet_sdk
1212

1313
WORKDIR /src/apps/hermes/server
1414

15-
RUN --mount=type=cache,target=/root/.cargo/registry cargo build --release
15+
RUN --mount=type=cache,target=/root/.cargo/registry cargo build --locked --release
1616

1717
FROM debian:bookworm-slim
1818
RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*

‎apps/okx-recorder/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ COPY Cargo.toml Cargo.lock ./
55
COPY src ./src
66
# Every TLS-touching dependency is pinned to rustls, so no OpenSSL headers are
77
# needed at build time (unlike binance-recorder, whose SDK pulls native-tls).
8-
RUN cargo build --release
8+
RUN cargo build --locked --release
99

1010
FROM debian:bookworm-slim
1111

‎apps/ondo-recorder/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ FROM rust:1.86-slim AS builder
33
WORKDIR /app
44
COPY Cargo.toml Cargo.lock ./
55
COPY src ./src
6-
RUN cargo build --release
6+
RUN cargo build --locked --release
77

88
FROM debian:bookworm-slim
99

‎apps/pyth-lazer-pusher/bulk-trade-pusher/Dockerfile‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,21 @@ ARG RUST_VERSION=1.88.0
66
FROM rust:${RUST_VERSION} AS build
77

88
WORKDIR /src
9+
# `cargo build --locked` refuses to rewrite Cargo.lock, and cargo prunes entries
10+
# for absent workspace members, so every member listed in the root Cargo.toml has
11+
# to be in the context even though only one is built.
12+
COPY Cargo.toml Cargo.lock ./
13+
COPY apps/argus apps/argus
14+
COPY apps/fortuna apps/fortuna
15+
COPY apps/hermes/client/rust apps/hermes/client/rust
916
COPY apps/pyth-lazer-pusher apps/pyth-lazer-pusher
10-
COPY Cargo.lock .
17+
COPY apps/quorum apps/quorum
18+
COPY lazer/contracts/cardano/cli/rust lazer/contracts/cardano/cli/rust
19+
COPY pythnet/pythnet_sdk pythnet/pythnet_sdk
20+
COPY target_chains/starknet/tools/test_vaas target_chains/starknet/tools/test_vaas
1121

1222
RUN --mount=type=cache,target=/root/.cargo/registry \
13-
printf '[workspace]\nresolver = "2"\nmembers = ["apps/pyth-lazer-pusher/pusher-utils","apps/pyth-lazer-pusher/pusher-base","apps/pyth-lazer-pusher/websocket-delivery","apps/pyth-lazer-pusher/bulk-trade-pusher"]\n\n[workspace.lints.rust]\nunsafe_code = "deny"\n\n[workspace.lints.clippy]\nexpect_used = "warn"\nunwrap_used = "warn"\n' > Cargo.toml && \
14-
cargo build --release -p bulk-pusher
23+
cargo build --locked --release -p bulk-pusher
1524

1625

1726
# Runtime

‎apps/pyth-lazer-pusher/mock/bulk-trade-mock-validator/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# Bulk Trade Mock Validator - Production Build
2-
# Build from repo root: docker build -f mock/bulk-trade-mock-validator/Dockerfile .
2+
# Build from repo root: docker build -f apps/pyth-lazer-pusher/mock/bulk-trade-mock-validator/Dockerfile .
33

44
FROM rust:1.91.1 AS chef
5-
RUN cargo install cargo-chef@0.1.73
5+
RUN cargo install cargo-chef@0.1.73 --locked
66
WORKDIR /src
77

88
FROM chef AS planner

‎apps/pyth-lazer-pusher/tilt/bulk/Dockerfile.dev‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,29 @@
11
# Development Dockerfile - builds ALL binaries for local dev with Tilt
22
# For production, use per-crate Dockerfiles (e.g., bulk-trade-pusher/Dockerfile)
33
#
4-
# Build context should be apps/pyth-lazer-pusher/
4+
# Build context should be the repo root
55

66
FROM rust:1.88 AS builder
77

88
WORKDIR /src
99

10-
# Copy source
11-
COPY pusher-utils pusher-utils
12-
COPY pusher-base pusher-base
13-
COPY websocket-delivery websocket-delivery
14-
COPY bulk-trade-pusher bulk-trade-pusher
15-
COPY mock mock
16-
COPY bulk-trade-cli bulk-trade-cli
17-
18-
# Create workspace Cargo.toml on the fly (no Cargo.lock in context)
19-
RUN printf '[workspace]\nresolver = "2"\nmembers = ["pusher-utils", "pusher-base", "websocket-delivery", "bulk-trade-pusher", "bulk-trade-cli", "mock/bulk-trade-mock-validator"]\n\n[workspace.lints.rust]\nunsafe_code = "deny"\n\n[workspace.lints.clippy]\nunwrap_used = "warn"\nexpect_used = "warn"\npanic = "warn"\nindexing_slicing = "warn"\n' > Cargo.toml
10+
# `cargo build --locked` refuses to rewrite Cargo.lock, and cargo prunes entries
11+
# for absent workspace members, so every member listed in the root Cargo.toml has
12+
# to be in the context even though only the lazer pusher crates are built.
13+
COPY Cargo.toml Cargo.lock ./
14+
COPY apps/argus apps/argus
15+
COPY apps/fortuna apps/fortuna
16+
COPY apps/hermes/client/rust apps/hermes/client/rust
17+
COPY apps/pyth-lazer-pusher apps/pyth-lazer-pusher
18+
COPY apps/quorum apps/quorum
19+
COPY lazer/contracts/cardano/cli/rust lazer/contracts/cardano/cli/rust
20+
COPY pythnet/pythnet_sdk pythnet/pythnet_sdk
21+
COPY target_chains/starknet/tools/test_vaas target_chains/starknet/tools/test_vaas
2022

2123
# Build all binaries
2224
RUN --mount=type=cache,target=/usr/local/cargo/registry \
2325
--mount=type=cache,target=/src/target \
24-
cargo build && \
26+
cargo build --locked -p bulk-pusher -p bulk-trade-mock-validator -p bulk-trade-cli && \
2527
cp target/debug/bulk-pusher /bulk-pusher && \
2628
cp target/debug/bulk-trade-mock-validator /bulk-trade-mock-validator && \
2729
cp target/debug/bulk-trade-cli /bulk-trade-cli

‎apps/pyth-lazer-pusher/tilt/bulk/Tiltfile‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,18 +35,23 @@ print('Topology: %d pushers, %d validators' % (NUM_PUSHERS, NUM_VALIDATORS))
3535
# Create namespace
3636
namespace_create('lazer-pusher-dev')
3737

38-
# Build the container image (context is apps/pyth-lazer-pusher/)
38+
# Build the container image (context is the repo root, so the build sees the
39+
# workspace Cargo.lock and can build with --locked)
3940
docker_build(
4041
REGISTRY + '/pyth-lazer-pusher',
41-
'../..',
42+
'../../../..',
4243
dockerfile='Dockerfile.dev',
4344
only=[
44-
'pusher-utils',
45-
'pusher-base',
46-
'websocket-delivery',
47-
'bulk-trade-pusher',
48-
'mock',
49-
'bulk-trade-cli',
45+
'Cargo.toml',
46+
'Cargo.lock',
47+
'apps/argus',
48+
'apps/fortuna',
49+
'apps/hermes/client/rust',
50+
'apps/pyth-lazer-pusher',
51+
'apps/quorum',
52+
'lazer/contracts/cardano/cli/rust',
53+
'pythnet/pythnet_sdk',
54+
'target_chains/starknet/tools/test_vaas',
5055
],
5156
)
5257

0 commit comments

Comments
 (0)