From d2839088c3a7ddbbfc77e4303da181edebdbe72c Mon Sep 17 00:00:00 2001
From: zzstoatzz <thrast36@gmail.com>
Date: Thu, 9 Jul 2026 12:56:18 -0500
Subject: [PATCH] deploy: Dockerfile + publish-docker recipe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

multi-stage image on stable zig 0.16.0 (no toolchain patches needed —
unlike zlay, stream has no rocksdb/io_uring constraints), ReleaseSafe
x86_64-linux-gnu, vendored C deps so the builder needs no dev
packages. runtime sets MALLOC_ARENA_MAX=4 (defense in depth with the
helm values). publish-docker clones fresh from tangled so an image
tag always corresponds 1:1 to a pushed commit — zlay's dirty-tree
provenance lesson by construction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Dockerfile | 25 +++++++++++++++++++++++++
 justfile   | 16 ++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 Dockerfile

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..2bb768c
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,25 @@
+# multi-stage: compile inside x86_64 linux (glibc — matches the deploy
+# target; zstd/xxhash are vendored so no system dev packages are needed)
+FROM --platform=linux/amd64 debian:bookworm-slim AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends curl xz-utils ca-certificates git && rm -rf /var/lib/apt/lists/*
+RUN curl -fSL https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz | tar xJ -C /opt
+ENV PATH=/opt/zig-x86_64-linux-0.16.0:$PATH
+WORKDIR /build
+
+# fetch dependencies first (cacheable — only changes with build.zig.zon)
+COPY build.zig build.zig.zon ./
+RUN zig build --fetch-only 2>/dev/null || true
+
+COPY .git/ .git/
+COPY src/ src/
+RUN zig build -Doptimize=ReleaseSafe -Dcpu=baseline -Dtarget=x86_64-linux-gnu
+
+FROM --platform=linux/amd64 debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /build/zig-out/bin/stream /usr/local/bin/stream
+# glibc arena fragmentation guard (docs/lessons-from-zlay.md #8);
+# helm values set it too — defense in depth
+ENV MALLOC_ARENA_MAX=4
+EXPOSE 6008
+VOLUME /data
+ENTRYPOINT ["/usr/local/bin/stream"]
diff --git a/justfile b/justfile
index e7c8fee..8716a8f 100644
--- a/justfile
+++ b/justfile
@@ -38,3 +38,19 @@ e2e:
 package:
     zig build -Doptimize=ReleaseSafe -Dtarget=x86_64-linux-gnu
     @ls -lh zig-out/bin/stream
+
+# build + push the deploy image from a FRESH CLONE — the image tag always
+# corresponds 1:1 to a pushed commit (provenance by construction; zlay's
+# dirty-tree lesson)
+publish-docker:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    TMPDIR=$(mktemp -d)
+    trap "rm -rf $TMPDIR" EXIT
+    git clone --depth 1 https://tangled.org/zat.dev/stream "$TMPDIR"
+    cd "$TMPDIR"
+    TAG=$(git rev-parse --short HEAD)
+    IMAGE="atcr.io/zat.dev/stream:${TAG}"
+    docker build --platform linux/amd64 -t "${IMAGE}" .
+    ATCR_AUTO_AUTH=1 docker push "${IMAGE}"
+    echo "==> pushed ${IMAGE}"
-- 
2.51.2