feat: Dockerfile for Debian bookworm pipelines

Author: Paul Belt

docker/Dockerfile.bookworm

@@ -0,0 +1,82 @@
+ARG GITOXIDE_VERSION=0.36.0
+
+FROM rust:1-slim-bookworm AS bootstrap_os
+  ENV DEBIAN_FRONTEND="noninteractive"
+
+  # hadolint ignore=DL3008,DL3009
+  RUN apt-get update -y \
+      && apt-get upgrade -y --no-install-recommends --no-install-suggests ca-certificates \
+      && apt-get install -y --no-install-recommends libssl3 zlib1g \
+      && apt-mark showmanual > /tmp/runtime_apt_mark.txt
+
+FROM bootstrap_os AS bootstrap_build_deps
+  # hadolint ignore=SC2046
+  RUN apt-mark auto '.*' > /dev/null \
+      && apt-get upgrade -y --no-install-recommends libssl-dev clang cmake make pkg-config \
+      && apt-mark manual $(cat /tmp/runtime_apt_mark.txt) > /dev/null
+
+
+FROM bootstrap_build_deps AS bootstrap_builder
+  ARG GITOXIDE_VERSION
+
+  ENV RUST_BACKTRACE=1 \
+      CC=clang \
+      CXX=clang++ \
+      MAKEOPTS="-j$(getconf _NPROCESSORS_ONLN)"
+
+  RUN cargo install gitoxide --version "${GITOXIDE_VERSION}" --message-format short \
+      && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
+      && rm -rf /var/lib/apt/lists/* /tmp/runtime_apt_mark.txt
+
+
+# contain minimally required bits
+FROM debian:bookworm-slim
+  COPY --from=bootstrap_os /etc/apt/sources.list.d/debian.mirrored.sources.list /etc/apt/sources.list.d/
+  COPY --from=bootstrap_os /tmp/runtime_apt_mark.txt /tmp
+
+  ENV DEBIAN_FRONTEND="noninteractive"
+
+  # hadolint ignore=DL3008,SC2016
+  RUN apt-get update -y \
+    && apt-get install -y --no-install-recommends --no-install-suggests ca-certificates \
+    && apt-mark manual $(cat /tmp/runtime_apt_mark.txt) > /dev/null \
+    && { \
+         echo '#!/bin/sh'; \
+         echo 'set -eu'; \
+         echo 'if [ "${#}" -gt 0 ] && [ "${1#-}" = "${1}" ] \'; \
+         echo '  && command -v "${1}" > "/dev/null" 2>&1; then'; \
+         echo '  exec "${@}"'; \
+         echo 'else exec /bin/shfmt "${@}"; fi'; \
+         echo 'exit 0'; \
+       } > /init && chmod +x /init
+
+  COPY --from=bootstrap_builder /usr/local/cargo/bin/gix /usr/local/cargo/bin
+  COPY --from=bootstrap_builder /usr/local/cargo/bin/ein /usr/local/cargo/bin
+
+  WORKDIR /usr/local/cargo/bin
+
+  SHELL [ "/bin/bash", "-e", "-o", "pipefail", "-c" ]
+
+  # hadolint ignore=SC2046,DL3008
+  RUN find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' \
+      | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); print so }' \
+      | xargs -r dpkg-query --search | cut -d: -f1 | sort -u | xargs -r apt-mark manual \
+    && apt-get upgrade -y --no-install-recommends --no-install-suggests \
+    && rm -rf /var/lib/apt/lists/* /tmp/runtime_apt_mark.txt
+
+  ENV PATH="/usr/local/cargo/bin:${PATH}"
+
+  HEALTHCHECK --retries=1 --timeout=15s CMD gix help
+
+  ENTRYPOINT [ "/init" ]
+
+
+FROM scratch
+  COPY --from=bootstrap_builder /usr/local/cargo/bin/gix /bin/
+  COPY --from=bootstrap_builder /usr/local/cargo/bin/ein /bin/
+
+  ENTRYPOINT [ "/bin/gix" ]
+
+  CMD [ "/bin/gix" ]
+
+# vi: nospell