containers/mimir-driver/Containerfile
# nordisk MIMIR DRIVER — the image `NORNIR_MIMIR_DRIVER_HOST` runs the driver in.
#
# The Mímir v2 code graph comes from a rustc driver that links `rustc_private`:
# it is built against EXACTLY one nightly and runs with that toolchain's
# `librustc_driver`. A server box must not need a rustup of its own for that
# (the host-free law of edda's cargo-toolchain.Containerfile): the pinned
# nightly, its compiler libraries, its `rust-src` (the std dump compiles the
# sysroot's sources), a linker, and the two driver binaries — built HERE, in
# the image, against the toolchain they will run with — are all in this image.
#
# podman build -t nordisk-mimir-driver -f containers/mimir-driver/Containerfile .
#
# The build context is the nornir repo root (the driver's sources are two
# crates of it). Pin what you run by DIGEST, never by tag:
#
# NORNIR_MIMIR_DRIVER_HOST="podman run --rm -v <nornir home>:<nornir home> \
# -v <a registry dir>:/usr/local/cargo/registry \
# nordisk-mimir-driver@sha256:<digest>"
#
# * The code room's directories must be visible inside under the SAME absolute
# paths (the consumer's clone, the nightly target dir, the dump dir, the std
# dump): mounting the nornir home does that.
# * `/usr/local/cargo/registry` is where cargo keeps the crates of the repos
# it checks. Mount a directory that outlives the run, or every commit
# downloads every dependency again.
# * The container needs the network the first time a lockfile's crates are
# fetched, and for a member that has git dependencies.
# * `NORNIR_MIMIR_DRIVER` need not be set: `cargo-mimir-dump` is on the PATH
# in here, and `mimir-driver` is beside it.
#
# ── the same four pins as edda's toolchain images ────────────────────────────
# the BASE — debian:trixie by digest, the digest cargo-toolchain.Containerfile
# and kernel-toolchain.Containerfile pin (one base, not three).
# the ARCHIVE — apt reads the snapshot.debian.org instant that base was built from.
# the CLOCK — SOURCE_DATE_EPOCH, and the logs deleted in the layer that makes them.
# the TOOLCHAIN — a DATED nightly: static.rust-lang.org's dated artifacts are
# immutable and rustup verifies them by sha256. The date is
# `crates/mimir-driver/rust-toolchain.toml`'s; the build FAILS
# when the ARG below and that file disagree.
# What is NOT pinned here: the driver's own dependencies come from crates.io at
# build time, by its committed `Cargo.lock` (`--locked`).
FROM debian:trixie@sha256:d63a99144861e4e460196ed93d07777490cbeab53ca660c434f2a589a6c50ea3
ENV DEBIAN_FRONTEND=noninteractive
# 2026-07-13T00:00:00Z — the Debian snapshot the base image was built from.
ENV SOURCE_DATE_EPOCH=1783900800
# The nightly the driver is linked against. ONE writer of this date:
# crates/mimir-driver/rust-toolchain.toml — asserted below.
ARG MIMIR_NIGHTLY=nightly-2026-10-05
RUN set -eu; \
printf '%s\n' \
'Types: deb' \
'URIs: http://snapshot.debian.org/archive/debian/20260713T000000Z' \
'Suites: trixie trixie-updates' \
'Components: main' \
'Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp' \
'' \
'Types: deb' \
'URIs: http://snapshot.debian.org/archive/debian-security/20260713T000000Z' \
'Suites: trixie-security' \
'Components: main' \
'Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp' \
> /etc/apt/sources.list.d/debian.sources; \
printf 'Acquire::Check-Valid-Until "false";\n' > /etc/apt/apt.conf.d/10no-check-valid-until; \
apt-get update && apt-get install -y --no-install-recommends \
`# step: TOOLCHAIN — rustup from the distro's signed archive (no curl|sh);` \
`# it then fetches the pinned nightly, verified against its manifest.` \
rustup ca-certificates \
`# step: CHECK — a cargo check still RUNS build scripts and proc macros:` \
`# rustc drives the C compiler as its linker for those, and the build` \
`# script of a -sys crate compiles C with it (znippy-zoomies: zstd-sys-rs).` \
gcc libc6-dev \
`# step: FETCH — cargo resolves git dependencies by running git.` \
git \
`# step: CHECK — pkg-config-rs locates system libraries in build scripts.` \
pkg-config \
&& rm -rf /var/lib/apt/lists/* \
&& rm -rf /var/log/apt /var/log/dpkg.log /var/log/alternatives.log \
&& rm -f /var/cache/ldconfig/aux-cache \
&& rm -rf /root/.cache
# rustup and cargo under /usr/local, not under a user's $HOME: the image
# behaves the same for whatever uid the engine runs it as.
ENV RUSTUP_HOME=/usr/local/rustup \
CARGO_HOME=/usr/local/cargo \
PATH=/usr/local/cargo/bin:$PATH
# The pinned nightly with the three components the driver needs:
# rustc-dev the compiler's libraries (`librustc_driver`) it links
# rust-src the sysroot's sources: `cargo mimir-dump --std` compiles them
# llvm-tools-preview named by crates/mimir-driver/rust-toolchain.toml
RUN rustup toolchain install "${MIMIR_NIGHTLY}" --profile minimal --no-self-update \
--component rustc-dev --component rust-src --component llvm-tools-preview \
&& rustup default "${MIMIR_NIGHTLY}" \
&& rustc --version
# The two driver binaries, built in the image against that toolchain. Only the
# two crates the driver is made of enter the image, and only to be compiled.
# BUILD_JOBS: cargo's `-j` for that one compile (empty = every core) — a box
# that builds this beside other work says how much of it the build may take.
ARG BUILD_JOBS=
COPY crates/mimir-schema /src/crates/mimir-schema
COPY crates/mimir-driver /src/crates/mimir-driver
RUN set -eu; \
pin="$(sed -n 's/^channel *= *"\(.*\)"/\1/p' /src/crates/mimir-driver/rust-toolchain.toml)"; \
test "$pin" = "${MIMIR_NIGHTLY}" || { echo "FATAL: this image installs ${MIMIR_NIGHTLY}, the driver is pinned to $pin (crates/mimir-driver/rust-toolchain.toml)"; exit 1; }; \
cd /src/crates/mimir-driver; \
CARGO_TARGET_DIR=/tmp/driver-target cargo build --release --locked --bins ${BUILD_JOBS:+-j "$BUILD_JOBS"}; \
install -m 0755 /tmp/driver-target/release/mimir-driver /tmp/driver-target/release/cargo-mimir-dump /tmp/driver-target/release/mimir-capture /tmp/driver-target/release/mimir-super /usr/local/bin/; \
rm -rf /tmp/driver-target /src "$CARGO_HOME/registry" "$CARGO_HOME/git"
# ── THE IMAGE ASSERTS ITS OWN CONTENTS ───────────────────────────────────────
# What the server's probe asks before it touches a commit, asked here so an
# image that cannot dump fails in ITS build: the compiler libraries are there,
# the sysroot's sources are there, and the driver itself starts against them
# and names the compiler it is linked with.
RUN set -eu; \
sysroot="$(rustc --print sysroot)"; \
ls "$sysroot"/lib/librustc_driver-*.so > /dev/null || { echo "FATAL: no librustc_driver under $sysroot/lib (component rustc-dev)"; exit 1; }; \
test -f "$sysroot/lib/rustlib/src/rust/library/std/src/lib.rs" || { echo "FATAL: no rust-src under $sysroot (the std dump needs it)"; exit 1; }; \
out="$(LD_LIBRARY_PATH="$sysroot/lib" mimir-driver rustc -vV)"; \
v="$(printf '%s\n' "$out" | head -1)"; \
case "$v" in "rustc "*) echo "driver OK: $v";; *) echo "FATAL: the driver does not start against $sysroot: $v"; exit 1;; esac; \
command -v cargo-mimir-dump > /dev/null
# The registry of the repos the driver checks: mount a directory here.
VOLUME /usr/local/cargo/registry
WORKDIR /work