From aec92d3fa1d8e102d2ab763bf29a528b1569fd04 Mon Sep 17 00:00:00 2001 From: Eric Rodrigues Pires Date: Thu, 09 Jul 2026 21:28:36 +0000 Subject: [PATCH] Update Rust version and use Nix for Docker builds --- .dockerignore | 5 ----- CHANGELOG.md | 6 ++++++ Dockerfile | 33 --------------------------------- .tack/pins.lock.json | 12 ++++++------ nix/packages.nix | 6 ++++++ .github/workflows/build.yml | 72 ------------------------------------------------------------------------ .github/workflows/docker.yml | 114 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ .github/workflows/release.yml | 51 +++++++++++++++++++++++++++++++++++++++++++++------ .github/workflows/validate.yml | 2 +- 9 file(s) changed, 178 insertion(s)(+), 123 deletion(s)(-) diff --git a/.dockerignore b/.dockerignore deleted file mode 100644 --- a/.dockerignore +++ /dev/null @@ -1,5 +0,0 @@ -/book -/deploy -/target -/tests -Dockerfile \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## Unreleased + +### Changed + +- Update dependencies. + ## 0.10.2 (2026-07-05) ### Fixed diff --git a/Dockerfile b/Dockerfile deleted file mode 100644 --- a/Dockerfile +++ /dev/null @@ -1,33 +0,0 @@ -# Compile application with the official Rust image -FROM --platform=$BUILDPLATFORM rust:1.96.1-alpine3.23 AS builder -ENV PKGCONFIG_SYSROOTDIR=/ -# Add build dependencies and targets -RUN apk add --no-cache musl-dev libressl-dev perl build-base zig -RUN cargo install --locked cargo-zigbuild -RUN rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl -# Cache pre-build of dependency crates (useful for development) -WORKDIR /app -COPY Cargo.toml Cargo.lock ./ -COPY sandhole_socket ./sandhole_socket -COPY udp_over_tcp ./udp_over_tcp -RUN mkdir src \ - && echo "fn main() {}" > src/main.rs \ - && cargo zigbuild --release --locked --target x86_64-unknown-linux-musl --target aarch64-unknown-linux-musl \ - && rm src/main.rs -# Build application -COPY src ./src -COPY README.md . -RUN touch src/main.rs \ - && cargo zigbuild --release --locked --target x86_64-unknown-linux-musl --target aarch64-unknown-linux-musl - -# Export compiled binaries to a single image (for both CI artifacts and arch-specific images) -FROM --platform=$BUILDPLATFORM scratch AS binary -COPY --from=builder /app/target/x86_64-unknown-linux-musl/release/sandhole /sandhole-linux-amd64 -COPY --from=builder /app/target/aarch64-unknown-linux-musl/release/sandhole /sandhole-linux-arm64 - -# Create arch-specific versions of image -FROM scratch AS runner -ARG TARGETOS -ARG TARGETARCH -COPY --from=binary /sandhole-${TARGETOS}-${TARGETARCH} /sandhole -ENTRYPOINT [ "/sandhole" ] diff --git a/.tack/pins.lock.json b/.tack/pins.lock.json --- a/.tack/pins.lock.json +++ b/.tack/pins.lock.json @@ -11,16 +11,16 @@ "type": "github", "owner": "NixOS", "repo": "nixpkgs", - "rev": "6edbf1a6a03e75886a6609c088801a0856449e88", - "narHash": "sha256-0lkauQbtrljJqwtzTCILPAiHAJyMvn6XDo264moDv30=", - "lastModified": 1783214977 + "rev": "f205b5574fd0cb7da5b702a2da51507b7f4fdd1b", + "narHash": "sha256-/NAkDSsve+GNM0Bt6tleJdCGfsTlK89nPjkVOzZMo0s=", + "lastModified": 1783279667 }, "rust-overlay": { "type": "github", "owner": "oxalica", "repo": "rust-overlay", - "rev": "cb368fd55ced25a1fa12414b9e984cdfb1681d18", - "narHash": "sha256-cTDI249Vl2JTQ3aicT9jeJPIBlNlodpJbdO0yLigCzU=", - "lastModified": 1783231873 + "rev": "e8e9d70b96113fd49ccde6c3e08fb260b6ef5dd6", + "narHash": "sha256-zSX553aXiIKJHWzUF6nrDKgeNRlfNK/SdyNYSbs2nkM=", + "lastModified": 1783614422 } } diff --git a/nix/packages.nix b/nix/packages.nix --- a/nix/packages.nix +++ b/nix/packages.nix @@ -30,6 +30,12 @@ inherit sandhole sandhole-no_default_features udp_over_tcp; default = sandhole; + docker = pkgs.dockerTools.buildImage { + name = "sandhole"; + tag = "latest"; + config.Entrypoint = [ (lib.getExe sandhole) ]; + }; + _docs = (pkgs.nixosOptionsDoc { options = removeAttrs evalOptions.options [ "_module" ]; diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,72 +0,0 @@ -on: - workflow_call: - secrets: - dockerhub-push-token: - description: Authentication token to push images to Docker Hub. - required: true - ghcr-push-token: - description: Authentication token to push images to the Github Container Registry. - required: true - -jobs: - build-docker-image: - name: Build Docker image - runs-on: ubuntu-24.04 - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - persist-credentials: true - - name: Collect Docker metadata - id: meta - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 - with: - images: | - ${{ vars.DOCKERHUB_USERNAME }}/${{ vars.DOCKERHUB_IMAGE }} - ghcr.io/${{ github.repository }} - tags: | - type=ref,event=branch - type=sha,prefix=,suffix=,enable={{is_default_branch}} - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - - name: Set up QEMU - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - with: - cache-binary: false - - name: Login to Docker Hub - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 - with: - username: ${{ vars.DOCKERHUB_USERNAME }} - password: ${{ secrets.dockerhub-push-token }} - - name: Login to Github Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.ghcr-push-token }} - - name: Build and push - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 - with: - context: . - push: true - platforms: | - linux/amd64 - linux/arm64 - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - - name: Export binaries - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 - with: - target: binary - outputs: type=local,dest=out - - name: Upload artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: sandhole-binaries - path: out/ diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml new file mode 100644 --- /dev/null +++ b/.github/workflows/docker.yml @@ -0,0 +1,114 @@ +on: + workflow_call: + secrets: + dockerhub-push-token: + description: Authentication token to push images to Docker Hub. + required: true + ghcr-push-token: + description: Authentication token to push images to the Github Container Registry. + required: true + +jobs: + build-docker-image: + name: Build Docker image (${{ matrix.runner }}) + strategy: + fail-fast: false + matrix: + include: + - runner: ubuntu-24.04 + key: amd64 + - runner: ubuntu-24.04-arm + key: arm64 + runs-on: ${{ matrix.runner }} + permissions: + contents: read + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - name: Install Nix + uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 + with: + nix_path: nixpkgs=channel:nixpkgs-unstable + github_access_token: ${{ secrets.GITHUB_TOKEN }} + - name: Build Docker image + run: | + DOCKER_PATH=$(nix build .#docker --no-link --print-out-paths) + cp "$DOCKER_PATH" image.tar.gz + - name: Upload artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: docker-${{ matrix.key }} + path: image.tar.gz + + push-docker-image: + name: Push Docker image + runs-on: ubuntu-24.04 + needs: + - build-docker-image + permissions: + contents: read + packages: write + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - name: Collect Docker metadata + id: meta + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 + with: + images: | + ${{ vars.DOCKERHUB_USERNAME }}/${{ vars.DOCKERHUB_IMAGE }} + ghcr.io/${{ github.repository }} + tags: | + type=ref,event=branch + type=sha,prefix=,suffix=,enable={{is_default_branch}} + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + with: + cache-binary: false + - name: Login to Docker Hub + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + with: + username: ${{ vars.DOCKERHUB_USERNAME }} + password: ${{ secrets.dockerhub-push-token }} + - name: Login to Github Container Registry + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.ghcr-push-token }} + - name: Install Nix + uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 + with: + nix_path: nixpkgs=channel:nixpkgs-unstable + github_access_token: ${{ secrets.GITHUB_TOKEN }} + - name: Install skopeo + run: | + nix-env -iA skopeo -f '' + - name: Download docker-amd64 artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: docker-amd64 + path: docker-amd64/ + - name: Download docker-arm64 artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: docker-arm64 + path: docker-arm64/ + - name: Push and assemble manifests + env: + TAGS: ${{ steps.meta.outputs.tags }} + run: | + set -euo pipefail + + while IFS= read -r TAG; do + [ -z "$TAG" ] && continue + + skopeo copy docker-archive:docker-amd64/image.tar.gz "docker://${TAG}-amd64" + skopeo copy docker-archive:docker-arm64/image.tar.gz "docker://${TAG}-arm64" + + docker buildx imagetools create --tag "$TAG" "${TAG}-amd64" "${TAG}-arm64" + done <<< "$TAGS" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,7 +6,7 @@ contents: read env: - RUST_VERSION: "1.95.0" + RUST_VERSION: "1.97.0" CARGO_INCREMENTAL: "0" CARGO_PROFILE_TEST_DEBUG: "0" @@ -29,15 +29,49 @@ env: CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} - build-linux: - name: Build for Linux via Docker + build-docker: + name: Build for Docker permissions: contents: read packages: write - uses: ./.github/workflows/build.yml + uses: ./.github/workflows/docker.yml secrets: dockerhub-push-token: ${{ secrets.DOCKERHUB_PUSH_TOKEN }} ghcr-push-token: ${{ secrets.GITHUB_TOKEN }} + + build-linux: + strategy: + fail-fast: false + matrix: + include: + - runner: ubuntu-24.04 + target: x86_64-unknown-linux-musl + key: linux-amd64 + - runner: ubuntu-24.04-arm + target: aarch64-unknown-linux-musl + key: linux-arm64 + name: Build for ${{ matrix.key }} + runs-on: ${{ matrix.runner }} + steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: true + - name: Fetch MSRV and add target + run: | + rustup toolchain install ${RUST_VERSION} + rustup override set ${RUST_VERSION} + rustup target add ${{ matrix.target }} + - name: Build + run: | + cargo build --release --locked --target ${{ matrix.target }} + mkdir dist + cp target/${{ matrix.target }}/release/sandhole dist/sandhole-${{ matrix.key }} + - name: Upload artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: sandhole-${{ matrix.key }} + path: dist build-macos: strategy: @@ -121,10 +155,15 @@ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: true - - name: Download Linux artifact + - name: Download linux-amd64 artifact uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: - name: sandhole-binaries + name: sandhole-linux-amd64 + path: out/ + - name: Download linux-arm64 artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: sandhole-linux-arm64 path: out/ - name: Download macos-amd64 artifact uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -149,7 +149,7 @@ - build-msrv-no-default-features - tests-nightly - coverage-nightly - uses: ./.github/workflows/build.yml + uses: ./.github/workflows/docker.yml secrets: dockerhub-push-token: ${{ secrets.DOCKERHUB_PUSH_TOKEN }} ghcr-push-token: ${{ secrets.GITHUB_TOKEN }} -- tangled.sh