👷(docker) add arm64 platform support for image builds

[StephanMeijer]

Purpose / Proposal

Adding support for linux/arm64 when building Docker images.

This is important because:

1. It enables to run La Suite on devices like the Raspberry Pi and Mac Mini. It will also make it easier for developers to contribute, as many are using Apple MacBooks with arm64 chips.
2. More and more providers (such as Hetzner) for infrastructure are offering arm64 support.
3. Sustainability is a point of interest (and sometimes condition) for organizations, commercially but specifically also governments, when they are buying infrastructure.

External contributions

• I have read and followed the contributing guidelines
• I have read and agreed to the Code of Conduct
• I have signed off my commits with git commit --signoff (DCO compliance)
• I have signed my commits with my SSH or GPG key (git commit -S)
• My commit messages follow the required format: <gitmoji>(type) title description
• I have added a changelog entry under ## [Unreleased] section (if noticeable change)
• I have added corresponding tests for new features or bug fixes (if applicable)

Testing happens when GitHub Workflows are being executed.

Summary by CodeRabbit

• New Features
  • Docker images now support ARM64 architecture, expanding platform compatibility alongside existing AMD64 support for deployments across diverse hardware configurations and ARM-based systems.

[coderabbitai]

📝 Walkthrough

Walkthrough

This change extends Docker image builds to support the ARM64 architecture alongside the existing AMD64 platform. The CI workflow is updated to configure QEMU and Docker Buildx, enabling multi-platform image construction. A corresponding changelog entry documents this new capability.

Changes

Cohort / File(s)	Summary
CI/CD Workflow Configuration .github/workflows/docker-publish.yml	Added setup steps for QEMU and Docker Buildx; extended Docker build-push action to target multiple platforms (linux/amd64, linux/arm64).
Documentation CHANGELOG.md	Added entry under Unreleased/Added section documenting ARM64 platform support for Docker image builds.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A rabbit's delight, in platforms we build,
AMD and ARM, both bases are filled,
With Buildx and QEMU, we spread far and wide,
Multi-arch Docker images, hopping with pride! 🏗️

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding ARM64 platform support for Docker image builds, which is directly reflected in the workflow and changelog modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[StephanMeijer]

This PR relates to other PR's, namely:

• calc: 👷(docker) add arm64 platform support for image builds calc#14
• containers: 👷(docker) add arm64 platform support for image builds containers#1
• conversations: 👷(docker) add arm64 platform support for image builds conversations#296
• docs: 👷(docker) add arm64 platform support for image builds docs#1901
• drive: 👷(docker) add arm64 platform support for image builds drive#551
• e2esdk: 👷(docker) add arm64 platform support for image builds e2esdk#1
• find: 👷(docker) add arm64 platform support for image builds find#54
• meet: 👷(docker) add arm64 platform support for image builds meet#981
• meet-kyutai-moshi-stt: 👷(docker) add arm64 platform support for image builds meet-kyutai-moshi-stt#2
• meet-whisperx: 👷(docker) add arm64 platform support for image builds meet-whisperx#26
• messages: 👷(docker) add arm64 platform support for image builds #554
• people: 👷(docker) add arm64 platform support for image builds people#1070

[coderabbitai]

🧹 Nitpick comments (2)

.github/workflows/docker-publish.yml (2)

62-62: Expect significantly longer build times from QEMU-emulated ARM64.

With ubuntu-latest (AMD64), the linux/arm64 platform is built entirely under QEMU emulation, which typically runs 3–10× slower than native. For large or complex images this can substantially increase CI wall-clock time.

Two mitigations to consider:

• GitHub Actions cache — add cache-from/cache-to to the build-push step to avoid re-building unchanged layers:

📦 Optional: add layer cache

       - name: Build and push Docker image
         id: push
         uses: docker/build-push-action@v6
         with:
           context: ${{ inputs.context }}
           target: ${{ inputs.target }}
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

• Native ARM64 runner — if build time becomes unacceptable, a matrix strategy with runs-on: [ubuntu-24.04-arm] (GitHub-hosted ARM64 runner) can build each platform natively and merge manifests with docker buildx imagetools create.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/docker-publish.yml at line 62, The workflow currently
builds linux/arm64 under QEMU (platforms: linux/amd64,linux/arm64) which slows
CI; update the build-push step to add Buildx layer cache (use cache-from and
cache-to with the same registry/cache key) so unchanged layers are reused,
and/or switch to a matrix that builds ARM64 natively by adding a job variant
with runs-on: ubuntu-24.04-arm and then merge multi-arch manifests using docker
buildx imagetools create; modify the job that references the platforms list and
the build-push invocation to include these cache options or the matrix/manifest
merge as appropriate.

---

37-40: LGTM — correct placement and standard approach for multi-platform builds.

QEMU and Buildx are set up before login and the build step, which is the required order. Using setup-qemu-action@v3 + setup-buildx-action@v3 is the canonical way to enable multi-architecture builds on GitHub Actions.

Optionally, you can scope QEMU to only the platform(s) that actually need emulation (linux/amd64 is native on the runner):

🔧 Optional: restrict QEMU to arm64 only

-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/docker-publish.yml around lines 37 - 40, The workflow
currently enables multi-arch via docker/setup-qemu-action@v3 and
docker/setup-buildx-action@v3 which is correct; optionally narrow QEMU emulation
to only the non-native platform(s) (e.g., arm64) by configuring the
docker/setup-qemu-action invocation to target specific platforms instead of all
platforms — update the setup step that references docker/setup-qemu-action@v3 to
include a platforms option (targeting linux/arm64) so QEMU runs only where
needed while leaving docker/setup-buildx-action@v3 unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/docker-publish.yml:
- Line 62: The workflow currently builds linux/arm64 under QEMU (platforms:
linux/amd64,linux/arm64) which slows CI; update the build-push step to add
Buildx layer cache (use cache-from and cache-to with the same registry/cache
key) so unchanged layers are reused, and/or switch to a matrix that builds ARM64
natively by adding a job variant with runs-on: ubuntu-24.04-arm and then merge
multi-arch manifests using docker buildx imagetools create; modify the job that
references the platforms list and the build-push invocation to include these
cache options or the matrix/manifest merge as appropriate.
- Around line 37-40: The workflow currently enables multi-arch via
docker/setup-qemu-action@v3 and docker/setup-buildx-action@v3 which is correct;
optionally narrow QEMU emulation to only the non-native platform(s) (e.g.,
arm64) by configuring the docker/setup-qemu-action invocation to target specific
platforms instead of all platforms — update the setup step that references
docker/setup-qemu-action@v3 to include a platforms option (targeting
linux/arm64) so QEMU runs only where needed while leaving
docker/setup-buildx-action@v3 unchanged.

[StephanMeijer]

Some executions of CI steps could show an error.

The actions docker/setup-qemu-action@v3 and docker/setup-buildx-action@v3 are not allowed in suitenumerique/people because all actions must be from a repository owned by suitenumerique, created by GitHub, or match one of the patterns: actions/cache@v4, actions/checkout@v4, actions/deploy-pages@*, actions/setup-node@v4, actions/setup-python@v3, actions/setup-python@v5, actions/setup-python@v6, actions/upload-artifact@v4, aquasecurity/setup-trivy@v0.2.2, aquasecurity/trivy-action@0.29.0, astral-sh/setup-uv@v6, azure/setup-helm@v4, crowdin/github-action@v2, docker/build-push-action@v6, docker/login-action@v3, docker/metadata-action@v5, jsdaniell/create-json@v1.2.3, numerique-gouv/action-argocd-webhook-notification@main, numerique-gouv/action-trivy-cache@main, numerique-gouv/helm-gh-pages@add-overwrite-option, peter-evans/create-pull-request@v7.

The allowed actions list is configured in the organization's GitHub Settings. As I am an external contributor, I do not have access to modify these. I request the reviewer of this pull request to contact one of the people in this list: https://github.com/orgs/suitenumerique/people

This pull request introduces QEMU (for emulation) and buildx (for cross-platform docker builds). These are needed because GitHub Actions runners are linux/amd64. To build Docker images for linux/arm64 on an amd64 runner:

1. QEMU (docker/setup-qemu-action) provides CPU emulation so the runner can execute arm64 instructions
2. Buildx (docker/setup-buildx-action) extends Docker with multi-platform build support, using QEMU under the hood

Without these, the platforms: linux/amd64,linux/arm64 parameter on docker/build-push-action would fail. Therefore docker/setup-qemu-action@v3 and docker/setup-buildx-action@v3 should be whitelisted on organizational level before merging this pull request.

You can read more about it on github.com/docker/build-push-action.

[sylvinus]

thanks!