From 7edbe11eb8316112d1de95c8df48ecf932904e13 Mon Sep 17 00:00:00 2001
From: Jason Volk <jason@zemos.net>
Date: Sun, 8 Jun 2025 23:45:55 +0000
Subject: [PATCH] docker: Dedup cargo and chef dockerfiles.

Signed-off-by: Jason Volk <jason@zemos.net>
---
 docker/Dockerfile.cargo      | 59 +++++++++++++++++++++----
 docker/Dockerfile.cargo.deps | 84 ------------------------------------
 docker/Dockerfile.source     |  7 +--
 docker/bake.hcl              | 55 ++++++++++++++---------
 4 files changed, 85 insertions(+), 120 deletions(-)
 delete mode 100644 docker/Dockerfile.cargo.deps

diff --git a/docker/Dockerfile.cargo b/docker/Dockerfile.cargo
index 93cd26b3..f711b431 100644
--- a/docker/Dockerfile.cargo
+++ b/docker/Dockerfile.cargo
@@ -4,6 +4,7 @@ FROM input AS cargo
 ARG sys_target
 ARG rust_target
 ARG rust_toolchain
+ARG RUST_HOME
 ARG RUSTUP_HOME
 ARG CARGO_HOME
 ARG CARGO_TARGET
@@ -11,25 +12,56 @@ ARG CARGO_TARGET_DIR
 ARG cargo_target_profile
 ARG cargo_target_artifact
 ARG cargo_target_share
+ARG CARGO_TERM_VERBOSE=0
+ARG RUST_BACKTRACE
+ARG JEMALLOC_OVERRIDE
+ARG ROCKSDB_LIB_DIR
+ARG CARGO_BUILD_RUSTFLAGS
+ARG CARGO_PROFILE_TEST_DEBUG
+ARG CARGO_PROFILE_TEST_INCREMENTAL
+ARG CARGO_PROFILE_BENCH_DEBUG
+ARG CARGO_PROFILE_BENCH_LTO
+ARG CARGO_PROFILE_RELEASE_LTO
+ARG CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG
+ARG CARGO_PROFILE_RELEASE_DEBUGINFO_LTO
 ARG cargo_profile
 ARG cargo_features
 ARG cargo_spec_features
 ARG cargo_cmd
+ARG color_args="--color always"
+ARG recipe_args=""
 ARG cargo_args=""
+ARG git_checkout
 
 WORKDIR /
 COPY --link --from=input . .
+COPY --link --from=rust ${RUST_HOME} ${RUST_HOME}
+COPY --link --from=deps /usr/src/tuwunel /usr/src/tuwunel
 
 WORKDIR /usr/lib/${sys_target}
 COPY --link --from=rocksdb . .
 
 WORKDIR /usr/src/tuwunel
+ENV PATH="${CARGO_HOME}/bin:$PATH"
+ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
+ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
+ENV JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
+ENV ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
+ENV CARGO_PROFILE_TEST_DEBUG="${CARGO_PROFILE_TEST_DEBUG}"
+ENV CARGO_PROFILE_TEST_INCREMENTAL="${CARGO_PROFILE_TEST_INCREMENTAL}"
+ENV CARGO_PROFILE_BENCH_DEBUG="${CARGO_PROFILE_BENCH_DEBUG}"
+ENV CARGO_PROFILE_BENCH_LTO="${CARGO_PROFILE_BENCH_LTO}"
+ENV CARGO_PROFILE_RELEASE_LTO="${CARGO_PROFILE_RELEASE_LTO}"
+ENV CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG="${CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG}"
+ENV CARGO_PROFILE_RELEASE_DEBUGINFO_LTO="${CARGO_PROFILE_RELEASE_DEBUGINFO_LTO}"
+ENV CARGO_BUILD_RUSTFLAGS="${CARGO_BUILD_RUSTFLAGS}"
+ENV CARGO_TARGET_DIR="${CARGO_TARGET_DIR}"
 ENV targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
 ENV targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
 RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared,ro \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared,ro \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared,ro \
 --mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
 --mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
 --mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
@@ -48,11 +80,20 @@ RUN \
             --locked \
             --workspace \
             "${cargo_spec_features}" \
-            --features "${cargo_features}" \
-            --profile "${cargo_profile}" \
-            --target "${CARGO_TARGET}" \
-            --target-dir "${CARGO_TARGET_DIR}" \
-            --manifest-path Cargo.toml \
-            --color always \
+            "--features=${cargo_features}" \
+            "--profile=${cargo_profile}" \
+            "--target=${CARGO_TARGET}" \
+            "--target-dir=${CARGO_TARGET_DIR}" \
+            "--manifest-path=Cargo.toml" \
+            ${recipe_args} \
+            ${color_args} \
             ${cargo_args}
+
+    # If this image is further reused with other cargo commands, all
+    # modifications made by cargo chef cook outside of target-dir have to be
+    # cleared. If not, resulting build artifacts will link incorrectly, even
+    # without error. For example, a target executable may be produced which
+    # does nothing except exit(0). If you have observed a smoketest failing in
+    # such a manner, investigate this as a cause of the issue.
+    git restore -W -S --source=${git_checkout} .
 EOF
diff --git a/docker/Dockerfile.cargo.deps b/docker/Dockerfile.cargo.deps
deleted file mode 100644
index 2739bff1..00000000
--- a/docker/Dockerfile.cargo.deps
+++ /dev/null
@@ -1,84 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS deps
-ARG sys_target
-ARG rust_target
-ARG rust_toolchain
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG CARGO_TARGET_DIR
-ARG cargo_target_profile
-ARG cargo_target_artifact
-ARG cargo_target_share
-ARG CARGO_BUILD_RUSTFLAGS
-ARG CARGO_PROFILE_TEST_DEBUG
-ARG CARGO_PROFILE_TEST_INCREMENTAL
-ARG CARGO_PROFILE_BENCH_DEBUG
-ARG CARGO_PROFILE_BENCH_LTO
-ARG CARGO_PROFILE_RELEASE_LTO
-ARG CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG
-ARG CARGO_PROFILE_RELEASE_DEBUGINFO_LTO
-ARG cargo_profile
-ARG cargo_features
-ARG cargo_spec_features
-ARG cook_args
-ARG git_checkout
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/lib/${sys_target}
-COPY --link --from=rocksdb . .
-
-WORKDIR /usr/src/tuwunel
-COPY --link --from=recipe recipe.json .
-
-ENV CARGO_PROFILE_TEST_DEBUG="${CARGO_PROFILE_TEST_DEBUG}"
-ENV CARGO_PROFILE_TEST_INCREMENTAL="${CARGO_PROFILE_TEST_INCREMENTAL}"
-ENV CARGO_PROFILE_BENCH_DEBUG="${CARGO_PROFILE_BENCH_DEBUG}"
-ENV CARGO_PROFILE_BENCH_LTO="${CARGO_PROFILE_BENCH_LTO}"
-ENV CARGO_PROFILE_RELEASE_LTO="${CARGO_PROFILE_RELEASE_LTO}"
-ENV CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG="${CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG}"
-ENV CARGO_PROFILE_RELEASE_DEBUGINFO_LTO="${CARGO_PROFILE_RELEASE_DEBUGINFO_LTO}"
-ENV CARGO_BUILD_RUSTFLAGS="${CARGO_BUILD_RUSTFLAGS}"
-ENV CARGO_TARGET_DIR="${CARGO_TARGET_DIR}"
-ENV targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
-ENV targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
-<<EOF
-    set -eux
-    rustup run ${rust_toolchain} \
-        cargo chef cook ${cook_args} \
-            --verbose \
-            --locked \
-            --workspace \
-            "${cargo_spec_features}" \
-            --features "${cargo_features}" \
-            --profile "${cargo_profile}" \
-            --target "${CARGO_TARGET}" \
-            --target-dir "${CARGO_TARGET_DIR}" \
-            --manifest-path Cargo.toml \
-            --recipe-path recipe.json
-
-    # If this image is further reused with other cargo commands, all
-    # modifications made by cargo chef cook outside of target-dir have to be
-    # cleared. If not, resulting build artifacts will link incorrectly, even
-    # without error. For example, a target executable may be produced which
-    # does nothing except exit(0). If you have observed a smoketest failing in
-    # such a manner, investigate this as a cause of the issue.
-    git restore -W -S --source=${git_checkout} .
-EOF
diff --git a/docker/Dockerfile.source b/docker/Dockerfile.source
index dd2ea815..1278fc3f 100644
--- a/docker/Dockerfile.source
+++ b/docker/Dockerfile.source
@@ -28,23 +28,18 @@ ARG CARGO_TARGET
 ARG CARGO_TERM_VERBOSE=0
 ARG RUST_BACKTRACE
 ARG JEMALLOC_OVERRIDE
-#ARG ZSTD_SYS_USE_PKG_CONFIG=0
 ARG ROCKSDB_LIB_DIR
 
 WORKDIR /
 COPY --link --from=input . .
-
-WORKDIR /
 COPY --link --from=rust ${RUST_HOME} ${RUST_HOME}
+COPY --link --from=source /usr/src/tuwunel /usr/src/tuwunel
 
 WORKDIR /usr/src/tuwunel
-COPY --link --from=source /usr/src/tuwunel .
-
 ENV PATH="${CARGO_HOME}/bin:$PATH"
 ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
 ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
 ENV JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
-#ENV ZSTD_SYS_USE_PKG_CONFIG="${ZSTD_SYS_USE_PKG_CONFIG}"
 ENV ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
 RUN \
 --mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
diff --git a/docker/bake.hcl b/docker/bake.hcl
index 6466843d..b46c8c32 100644
--- a/docker/bake.hcl
+++ b/docker/bake.hcl
@@ -834,7 +834,7 @@ target "docs" {
         elem("build", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     ]
     contexts = {
-        input = (use_chef == "true"?
+        deps = (use_chef == "true"?
             elem("target:deps-build", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]):
             elem("target:ingredients", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
         )
@@ -857,7 +857,7 @@ target "build-bins" {
         elem("build", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     ]
     contexts = {
-        input = (use_chef == "true"?
+        deps = (use_chef == "true"?
             elem("target:deps-build-bins", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]):
             elem("target:build", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
         )
@@ -879,7 +879,7 @@ target "build-tests" {
         elem("build", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     ]
     contexts = {
-        input = (use_chef == "true"?
+        deps = (use_chef == "true"?
             elem("target:deps-build-tests", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]):
             elem("target:build", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
         )
@@ -901,7 +901,7 @@ target "build" {
         elem("cargo", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     ]
     contexts = {
-        input = (use_chef == "true"?
+        deps = (use_chef == "true"?
             elem("target:deps-build", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]):
             elem("target:ingredients", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
         )
@@ -923,7 +923,7 @@ target "clippy" {
         elem("cargo", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     ]
     contexts = {
-        input = (use_chef == "true"?
+        deps = (use_chef == "true"?
             elem("target:deps-clippy", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]):
             elem("target:ingredients", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
         )
@@ -945,7 +945,7 @@ target "check" {
         elem("cargo", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
     ]
     contexts = {
-        input = (use_chef == "true"?
+        deps = (use_chef == "true"?
             elem("target:deps-check", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]):
             elem("target:ingredients", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
         )
@@ -1029,14 +1029,20 @@ target "fmt" {
 
 target "cargo" {
     name = elem("cargo", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
-    target = "cargo"
     output = ["type=cacheonly,compression=zstd,mode=min,compression-level=${cache_compress_level}"]
     cache_to = ["type=local,compression=zstd,mode=max,compression-level=${cache_compress_level}"]
-    dockerfile = "${docker_dir}/Dockerfile.cargo"
     matrix = cargo_rust_feat_sys
     inherits = [
         elem("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     ]
+	contexts = {
+        deps = elem("target:deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+	}
+    args = {
+        recipe_args = ""
+        cargo_args = ""
+        color_args = "--color=always"
+    }
 }
 
 #
@@ -1063,7 +1069,7 @@ target "deps-build-bins" {
         elem("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     ]
     args = {
-        cook_args = "--bins"
+        cargo_cmd = "chef cook --bins"
     }
 }
 
@@ -1077,7 +1083,7 @@ target "deps-build-tests" {
         elem("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     ]
     args = {
-        cook_args = (cargo_profile == "bench"? "--benches": "--tests")
+        cargo_cmd = (cargo_profile == "bench"? "chef cook --benches": "chef cook --tests")
     }
 }
 
@@ -1091,7 +1097,7 @@ target "deps-build" {
         elem("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     ]
     args = {
-        cook_args = "--all-targets"
+        cargo_cmd = "chef cook --all-targets"
     }
 }
 
@@ -1105,7 +1111,7 @@ target "deps-clippy" {
         elem("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     ]
     args = {
-        cook_args = "--all-targets --clippy"
+        cargo_cmd = "chef cook --all-targets --clippy"
     }
 }
 
@@ -1119,7 +1125,7 @@ target "deps-check" {
         elem("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     ]
     args = {
-        cook_args = "--all-targets --check"
+        cargo_cmd = "chef cook --all-targets --check"
     }
 }
 
@@ -1132,22 +1138,26 @@ target "deps-base" {
     tags = [
         elem_tag("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest")
     ]
-    target = "deps"
+    target = "cargo"
     output = ["type=cacheonly,compression=zstd,mode=min,compression-level=${cache_compress_level}"]
     cache_to = ["type=local,compression=zstd,mode=max,compression-level=${cache_compress_level}"]
-    dockerfile = "${docker_dir}/Dockerfile.cargo.deps"
+    dockerfile = "${docker_dir}/Dockerfile.cargo"
     matrix = cargo_rust_feat_sys
     inherits = [
+        elem("kitchen", [feat_set, sys_name, sys_version, sys_target]),
+        elem("rust", [rust_toolchain, rust_target, sys_name, sys_version, sys_target]),
         elem("recipe", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     ]
     contexts = {
-        input = elem("target:ingredients", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
-        recipe = elem("target:recipe", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+        input = elem("target:kitchen", [feat_set, sys_name, sys_version, sys_target])
+        deps = elem("target:preparing", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
         rocksdb = elem("target:rocksdb", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     }
     args = {
         cargo_profile = cargo_profile
-        cook_args = "--all-targets --no-build"
+        cargo_cmd = "chef cook --all-targets --no-build"
+        recipe_args = "--recipe-path=recipe.json"
+        color_args = ""
 
         # Base path
         CARGO_TARGET_DIR = "${cargo_tgt_dir_base}"
@@ -1322,6 +1332,7 @@ target "recipe" {
     ]
     contexts = {
         input = elem("target:preparing", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+        preparing = elem("target:preparing", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     }
 }
 
@@ -1337,6 +1348,7 @@ target "preparing" {
     ]
     contexts = {
         input = elem("target:ingredients", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+        ingredients = elem("target:ingredients", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     }
 }
 
@@ -1345,17 +1357,18 @@ target "ingredients" {
     tags = [
         elem_tag("ingredients", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
     ]
-    target =  "ingredients"
     cache_to = ["type=local,compression=zstd,mode=max"]
+    target =  "ingredients"
+    dockerfile = "${docker_dir}/Dockerfile.source"
     matrix = rust_feat_sys
     inherits = [
+        elem("source", [sys_name, sys_version, sys_target]),
         elem("kitchen", [feat_set, sys_name, sys_version, sys_target]),
         elem("rust", [rust_toolchain, rust_target, sys_name, sys_version, sys_target]),
-        elem("source", [sys_name, sys_version, sys_target]),
     ]
     contexts = {
-        rust = elem("target:rust", [rust_toolchain, rust_target, sys_name, sys_version, sys_target])
         input = elem("target:kitchen", [feat_set, sys_name, sys_version, sys_target])
+        rust = elem("target:rust", [rust_toolchain, rust_target, sys_name, sys_version, sys_target])
         source = elem("target:source", [sys_name, sys_version, sys_target])
     }
     args = {