From 221b32d66f6f9573aab6ee36f02cbc690f443c98 Mon Sep 17 00:00:00 2001
From: Lewis <lu5a@proton.me>
Date: Thu, 18 Jun 2026 17:45:36 +0300
Subject: [PATCH] build: smaller faster prod container

Lewis: May this revision serve well! <lu5a@proton.me>
---
 Cargo.lock               |  1 +
 Cargo.toml               | 13 +++++++++++--
 Dockerfile               | 37 ++++++++++++++++++++++++++++---------
 docker-compose.prod.yaml |  2 +-
 4 files changed, 41 insertions(+), 12 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index eaa9b51..40a2ea2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8056,6 +8056,7 @@ dependencies = [
  "hyper-util",
  "quinn",
  "rcgen",
+ "reqwest",
  "rustls 0.23.37",
  "rustls-pemfile",
  "thiserror 2.0.18",
diff --git a/Cargo.toml b/Cargo.toml
index fc77ee0..6fa2a0c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -154,11 +154,20 @@ wiremock = "0.6"
 curve25519-dalek = { git = "https://github.com/signalapp/curve25519-dalek", tag = "signal-curve25519-4.1.3" }
 
 [profile.release]
-lto = "fat"
+opt-level = "s"
 strip = true
-codegen-units = 1
 panic = "abort"
+codegen-units = 256
+
+[profile.lewis]
+inherits = "release"
+opt-level = 3
+lto = "fat"
+codegen-units = 1
 
 [profile.bench]
+opt-level = 3
+lto = "fat"
+codegen-units = 1
 debug = 1
 strip = false
diff --git a/Dockerfile b/Dockerfile
index 04814b8..81fa0b9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,5 @@
+ARG DISTROLESS_IMAGE=gcr.io/distroless/cc-debian13:latest@sha256:1e3c6d9c255be500eb680cdea0ad07554f52ae92dfcbdf07043a2a435b4c1fe3
+
 FROM node:24-trixie-slim AS frontend
 RUN corepack enable && corepack prepare pnpm@latest --activate
 WORKDIR /app
@@ -8,8 +10,26 @@ RUN pnpm build
 
 FROM rust:1.96-slim-trixie AS builder
 RUN apt-get update && apt-get install -y --no-install-recommends \
-      ca-certificates pkg-config libssl-dev mold clang protobuf-compiler \
+      ca-certificates pkg-config libssl-dev mold clang protobuf-compiler curl xz-utils \
     && rm -rf /var/lib/apt/lists/*
+ARG COMPRESS="true"
+RUN set -eux; \
+    if [ "$COMPRESS" = "true" ]; then \
+      arch="$(uname -m)"; \
+      case "$arch" in \
+        x86_64)  upx_arch=amd64; upx_sha=ddc2654063fe4dc80d95b420788494e4db078ebb01a650692d623b5a9906e61e ;; \
+        aarch64) upx_arch=arm64; upx_sha=100310f74eb6f67694d1d0377f1c729b6a49238ce8c4de21ea2e7d3406186f8b ;; \
+        *) echo "upx: no prebuilt binary for $arch, skipping compression"; upx_arch="" ;; \
+      esac; \
+      if [ -n "$upx_arch" ]; then \
+        curl -fsSL -o /tmp/upx.tar.xz "https://github.com/upx/upx/releases/download/v5.0.2/upx-5.0.2-${upx_arch}_linux.tar.xz"; \
+        echo "${upx_sha}  /tmp/upx.tar.xz" | sha256sum -c -; \
+        tar -xJf /tmp/upx.tar.xz -C /tmp; \
+        install -m0755 "/tmp/upx-5.0.2-${upx_arch}_linux/upx" /usr/local/bin/upx; \
+        rm -rf /tmp/upx.tar.xz "/tmp/upx-5.0.2-${upx_arch}_linux"; \
+      fi; \
+    fi
+RUN mkdir -p /stage/var/lib/tranquil-pds/blobs /stage/var/lib/tranquil-pds/store
 ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
 WORKDIR /app
 ARG SLIM="false"
@@ -46,16 +66,15 @@ RUN --mount=type=cache,id=cargo-registry,target=/usr/local/cargo/registry \
     else \
       SQLX_OFFLINE=true cargo build --release -p tranquil-server; \
     fi && \
-    cp target/release/tranquil-server /tmp/tranquil-pds
+    cp target/release/tranquil-server /tmp/tranquil-pds && \
+    if [ "$COMPRESS" = "true" ] && command -v upx >/dev/null 2>&1; then upx --best --lzma /tmp/tranquil-pds; fi
 
-FROM debian:trixie-slim
-RUN apt-get update && apt-get install -y --no-install-recommends \
-      ca-certificates libssl3 \
-    && rm -rf /var/lib/apt/lists/*
+FROM ${DISTROLESS_IMAGE}
 COPY --from=builder /tmp/tranquil-pds /usr/local/bin/tranquil-pds
-COPY --from=frontend /app/dist /var/lib/tranquil-pds/frontend
-WORKDIR /app
+COPY --from=builder --chown=65532:65532 /stage/var/lib/tranquil-pds /var/lib/tranquil-pds
+COPY --from=frontend --chown=65532:65532 /app/dist /var/lib/tranquil-pds/frontend
+WORKDIR /var/lib/tranquil-pds
 ENV SERVER_HOST=[::]
 ENV SERVER_PORT=3000
 EXPOSE 3000
-CMD ["tranquil-pds"]
+ENTRYPOINT ["/usr/local/bin/tranquil-pds"]
diff --git a/docker-compose.prod.yaml b/docker-compose.prod.yaml
index 2176aeb..fc9a43d 100644
--- a/docker-compose.prod.yaml
+++ b/docker-compose.prod.yaml
@@ -13,7 +13,7 @@ services:
       db:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "tranquil-pds", "healthcheck"]
+      test: ["CMD", "/usr/local/bin/tranquil-pds", "healthcheck"]
       interval: 30s
       timeout: 10s
       retries: 3
-- 
2.51.2