Dockerfile.gateway

# syntax=docker/dockerfile:1.7
# Forked OpenShell gateway image (st-gr/OpenShell).
#
# Differs from upstream NVIDIA/OpenShell only by the
# --compute-driver-socket patch on this branch. Image:
# ghcr.io/st-gr/openshell-gateway:{<sha>,<tag>,latest}
ARG RUST_VERSION=1.95.0

FROM rust:${RUST_VERSION}-slim-bookworm AS chef
# Native build deps a few transitive crates of `openshell-server` need:
#   - `libclang-dev` for the `bindgen`-using deps (bindgen links libclang.so).
#   - `libz3-dev`   for `z3-sys` (the OPA / policy-engine path pulls this in;
#                    the build script `cargo:include` looks for `z3.h`).
# Both were introduced when upstream rolled in additional policy-engine
# functionality. Removing either re-surfaces the corresponding build
# failures.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        protobuf-compiler libprotobuf-dev pkg-config build-essential ca-certificates \
        libclang-dev libz3-dev \
    && rm -rf /var/lib/apt/lists/*
RUN cargo install --locked cargo-chef
WORKDIR /app

FROM chef AS planner
COPY . .
RUN cargo chef prepare --recipe-path recipe.json

FROM chef AS builder
COPY --from=planner /app/recipe.json recipe.json
RUN cargo chef cook --release --recipe-path recipe.json -p openshell-server
COPY . .
RUN cargo build --release --bin openshell-gateway \
 && strip target/release/openshell-gateway

FROM gcr.io/distroless/cc-debian12:nonroot
# z3-sys links libz3 dynamically; the prover crate is pulled into
# openshell-server, so the gateway binary needs libz3.so.4 at runtime.
# distroless/cc includes glibc + libstdc++ but not libz3 — copy from builder.
COPY --from=builder /usr/lib/x86_64-linux-gnu/libz3.so.4 /usr/lib/x86_64-linux-gnu/libz3.so.4
COPY --from=builder /app/target/release/openshell-gateway /usr/local/bin/openshell-gateway
USER 65532:65532
ENTRYPOINT ["/usr/local/bin/openshell-gateway"]