Dockerfile

# SPDX-License-Identifier: MPL-2.0 OR LGPL-3.0-or-later
#
# libpathrs: safe path resolution on Linux
# Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
#
# == MPL-2.0 ==
#
#  This Source Code Form is subject to the terms of the Mozilla Public
#  License, v. 2.0. If a copy of the MPL was not distributed with this
#  file, You can obtain one at https://mozilla.org/MPL/2.0/.
#
# Alternatively, this Source Code Form may also (at your option) be used
# under the terms of the GNU Lesser General Public License Version 3, as
# described below:
#
# == LGPL-3.0-or-later ==
#
#  This program is free software: you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation, either version 3 of the License, or (at
#  your option) any later version.
#
#  This program is distributed in the hope that it will be useful, but
#  WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
#  or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
#  for more details.
#
#  You should have received a copy of the GNU Lesser General Public License
#  along with this program. If not, see <https://www.gnu.org/licenses/>.

ARG DEBIAN_RELEASE=trixie
ARG RUST_VERSION=1.96

# --------------------------------------------------------------------------- #
# build: builds libpathrs for use by CI and the "install" image.
# --------------------------------------------------------------------------- #
FROM rust:${RUST_VERSION}-${DEBIAN_RELEASE} AS build

RUN apt-get update -y && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
        clang \
        lld \
        make \
        pkg-config && \
    apt-get clean -y && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /usr/src/libpathrs
COPY . /usr/src/libpathrs
RUN make release && \
    DESTDIR=/opt/libpathrs ./install.sh --prefix=/usr --libdir=/usr/lib

# ----------------------------------------------------------------------------
# install: minimal runtime image with libpathrs installed system-wide.
# Intended to be used as a base image by downstream projects on distros that do
# not ship a libpathrs package yet.
# ----------------------------------------------------------------------------
FROM debian:${DEBIAN_RELEASE} AS install

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update -y && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
        pkg-config && \
    apt-get clean -y && \
    rm -rf /var/lib/apt/lists/*

COPY --from=build /opt/libpathrs/ /
# debian doesn't use /usr/lib for the native architecture so we need to make
# sure it gets searched by the link loader with ldconfig.
RUN ldconfig

# ----------------------------------------------------------------------------
# ci: full test runner for CI and local test runs.
# This can run the Rust unit/integration tests and the e2e tests.
# ----------------------------------------------------------------------------
ARG RUST_VERSION=1.96
FROM rust:${RUST_VERSION}-${DEBIAN_RELEASE} AS ci

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update -y && \
    apt-get install -y --no-install-recommends \
        bats \
        curl \
        clang \
        git \
        golang-go \
        jq \
        lld \
        llvm \
        moreutils \
        python3 \
        python3-build \
        python3-dev \
        python3-pip \
        python3-setuptools \
        python3-venv \
        sudo && \
    apt-get clean -y && \
    rm -rf /var/lib/apt/lists/*

# Use a globally-writable place for Go caches.
ENV GOCACHE=/tmp/go-cache/build
ENV GOMODCACHE=/tmp/go-cache/mod

ARG CARGO_BINSTALL_VERSION=1.19.1
RUN CARGO_BINSTALL_VERSION="$CARGO_BINSTALL_VERSION" \
        curl -L --proto '=https' --tlsv1.2 -sSf \
            "https://raw.githubusercontent.com/cargo-bins/cargo-binstall/v$CARGO_BINSTALL_VERSION/install-from-binstall-release.sh" | bash

ARG CARGO_LLVM_COV_VERSION=0.8.7
ARG CARGO_HACK_VERSION=0.6.45
ARG CARGO_NEXTEST_VERSION=0.9.137
RUN cargo binstall --no-confirm \
        "cargo-llvm-cov@$CARGO_LLVM_COV_VERSION" \
        "cargo-hack@$CARGO_HACK_VERSION" \
        "cargo-nextest@$CARGO_NEXTEST_VERSION"

ARG RUST_NIGHTLY=nightly-2026-06-03
RUN rustup toolchain install "$RUST_NIGHTLY" && \
    rustup component add llvm-tools llvm-tools-preview && \
    rustup component add --toolchain "$RUST_NIGHTLY" llvm-tools llvm-tools-preview
ENV CARGO_NIGHTLY="cargo +$RUST_NIGHTLY"

# We want the installed libpathrs library for the Python and Go tests.
COPY --from=build /opt/libpathrs/ /
# Debian doesn't use /usr/lib for the native architecture so we need to make
# sure it gets searched by the link loader with ldconfig.
RUN ldconfig

WORKDIR /usr/src/libpathrs
COPY . /usr/src/libpathrs

# Populate the cache for test runs and make sure the ownership is friendly for
# non-root.
FROM ci AS ci-with-cache
RUN cargo test --workspace --all-features --no-run && \
    $CARGO_NIGHTLY llvm-cov --workspace --doc --all-features --no-report && \
    find "$CARGO_HOME" /usr/src/libpathrs -type d -print0 | xargs -0 -P$(nproc) chmod a+rwx && \
    find "$CARGO_HOME" /usr/src/libpathrs -type f -print0 | xargs -0 -P$(nproc) chmod a+rw