OpenShell/deploy/docker/Dockerfile.driver-vm-macos

# syntax=docker/dockerfile:1.6

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Cross-compile the openshell-driver-vm binary for macOS aarch64 (Apple
# Silicon) using the osxcross toolchain.
#
# openshell-driver-vm loads libkrun/libkrunfw at runtime via dlopen, so it
# does NOT need Hypervisor.framework headers at build time. Pre-compressed
# runtime artifacts (libkrun, libkrunfw, bundled sandbox/supervisor) are injected via
# the vm-runtime-compressed build context and embedded into the binary via
# include_bytes!().
#
# Usage:
#   docker buildx build -f deploy/docker/Dockerfile.driver-vm-macos \
#     --build-arg OPENSHELL_CARGO_VERSION=0.6.0 \
#     --build-context vm-runtime-compressed=/path/to/compressed-dir \
#     --output type=local,dest=out/ .

ARG OSXCROSS_IMAGE=ghcr.io/crazy-max/osxcross:latest
ARG PYTHON_IMAGE=public.ecr.aws/docker/library/python:3.12-slim

FROM ${OSXCROSS_IMAGE} AS osxcross

FROM ${PYTHON_IMAGE} AS builder

ARG CARGO_TARGET_CACHE_SCOPE=default

ENV PATH="/root/.cargo/bin:/usr/local/bin:/osxcross/bin:${PATH}"
ENV LD_LIBRARY_PATH="/osxcross/lib"

COPY --from=osxcross /osxcross /osxcross

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    ca-certificates \
    clang \
    cmake \
    curl \
    pkg-config \
    && rm -rf /var/lib/apt/lists/*

RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.95.0

RUN rustup target add aarch64-apple-darwin

WORKDIR /build

ENV CC_aarch64_apple_darwin=oa64-clang
ENV CXX_aarch64_apple_darwin=oa64-clang++
ENV AR_aarch64_apple_darwin=aarch64-apple-darwin25.1-ar
ENV CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=oa64-clang
ENV CARGO_TARGET_AARCH64_APPLE_DARWIN_AR=aarch64-apple-darwin25.1-ar

# aws-lc-sys workaround (in case it ends up in the dep tree via feature unification)
RUN ln -sf /osxcross/bin/arm64-apple-darwin25.1-ld /usr/local/bin/arm64-apple-macosx-ld

# ---------------------------------------------------------------------------
# Stage 1: dependency caching — copy only manifests, create dummy sources,
# build dependencies. This layer is cached unless Cargo.toml/lock changes.
# ---------------------------------------------------------------------------
COPY Cargo.toml Cargo.lock ./
COPY crates/openshell-driver-vm/Cargo.toml crates/openshell-driver-vm/Cargo.toml
COPY crates/openshell-driver-vm/build.rs   crates/openshell-driver-vm/build.rs
COPY crates/openshell-core/Cargo.toml      crates/openshell-core/Cargo.toml
COPY crates/openshell-core/build.rs        crates/openshell-core/build.rs
COPY proto/ proto/

# Scope workspace to the driver + its only internal dep.
RUN sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-driver-vm", "crates/openshell-core"]|' Cargo.toml

RUN mkdir -p crates/openshell-driver-vm/src \
             crates/openshell-core/src && \
    echo "fn main() {}" > crates/openshell-driver-vm/src/main.rs && \
    touch crates/openshell-driver-vm/src/lib.rs && \
    touch crates/openshell-core/src/lib.rs

# Build deps only (cached layer). The 2>/dev/null || true is a warm-cache
# technique; real source is copied in stage 2.
RUN --mount=type=cache,id=cargo-registry-driver-vm-macos,sharing=locked,target=/root/.cargo/registry \
    --mount=type=cache,id=cargo-git-driver-vm-macos,sharing=locked,target=/root/.cargo/git \
    --mount=type=cache,id=cargo-target-driver-vm-macos-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \
    cargo build --release --target aarch64-apple-darwin -p openshell-driver-vm 2>/dev/null || true

# ---------------------------------------------------------------------------
# Stage 2: real build with compressed runtime artifacts
# ---------------------------------------------------------------------------
COPY crates/ crates/

# Copy compressed VM runtime artifacts for embedding.
# These are passed in via --build-context vm-runtime-compressed=...
COPY --from=vm-runtime-compressed / /build/vm-runtime-compressed/

# Touch source files to ensure they're rebuilt (not the cached dummy).
RUN touch crates/openshell-driver-vm/src/main.rs \
    crates/openshell-driver-vm/src/lib.rs \
    crates/openshell-driver-vm/build.rs \
    crates/openshell-core/src/lib.rs \
    crates/openshell-core/build.rs \
    proto/*.proto

# Declare version ARGs here (not earlier) so the git-hash-bearing values do not
# invalidate the expensive dependency-build layers above on every commit.
ARG OPENSHELL_CARGO_VERSION
ARG OPENSHELL_IMAGE_TAG
RUN --mount=type=cache,id=cargo-registry-driver-vm-macos,sharing=locked,target=/root/.cargo/registry \
    --mount=type=cache,id=cargo-git-driver-vm-macos,sharing=locked,target=/root/.cargo/git \
    --mount=type=cache,id=cargo-target-driver-vm-macos-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \
    if [ -n "${OPENSHELL_CARGO_VERSION:-}" ]; then \
      sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${OPENSHELL_CARGO_VERSION}"'"/}' Cargo.toml; \
    fi && \
    OPENSHELL_VM_RUNTIME_COMPRESSED_DIR=/build/vm-runtime-compressed \
    OPENSHELL_IMAGE_TAG="${OPENSHELL_IMAGE_TAG:-dev}" \
    cargo build --release --target aarch64-apple-darwin -p openshell-driver-vm && \
    cp target/aarch64-apple-darwin/release/openshell-driver-vm /openshell-driver-vm

FROM scratch AS binary
COPY --from=builder /openshell-driver-vm /openshell-driver-vm