Dockerfile.sprig

Rama main · réplica de lectura del repositorio original.

# syntax=docker/dockerfile:1.7
# Multi-arch is produced by building this file on native amd64 and arm64 runners.
# Keep both bases pinned to manifest-list digests so either architecture resolves
# to immutable source bytes.
FROM rust:1.98-alpine3.22@sha256:a1796ca6fa216d6727b5f61c69e4c665b120b1a4dcb969639e2f25f1ed309456 AS builder

RUN apk add --no-cache \
      build-base \
      cmake \
      git \
      musl-dev \
      openssl-dev \
      openssl-libs-static \
      perl \
      pkgconf \
      protoc
WORKDIR /build
COPY . .
# GCC's outlined ARM64 atomics require libgcc helpers that Rust's static musl
# link does not provide (notably __aarch64_ldadd4_sync in vendored D-Bus).
# Emit baseline ARM64 atomics inline; cc-rs applies this only to that target.
ENV CFLAGS_aarch64_unknown_linux_musl="-mno-outline-atomics"
RUN cargo build --locked --profile sprig -p sprig \
    && strip target/sprig/sprig

FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce

RUN apk add --no-cache bash ca-certificates curl git \
    && adduser -D -h /home/agent agent \
    && install -d -o agent -g agent /workspace /home/agent

COPY --from=builder --chmod=0755 /build/target/sprig/sprig /usr/local/bin/sprig
COPY --chmod=0755 scripts/sprig-entrypoint.sh /usr/local/bin/sprig-entrypoint
RUN for name in \
      buzz-acp buzz-agent buzz-dev-mcp rg tree buzz \
      git-credential-nostr git-sign-nostr; do \
        ln -s sprig "/usr/local/bin/$name"; \
    done

ENV HOME=/home/agent \
    PATH=/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
WORKDIR /home/agent
USER agent
ENTRYPOINT ["/usr/local/bin/sprig-entrypoint"]