Dockerfile

# syntax=docker/dockerfile:1.7
# =============================================================================
# rust — Coverage-Guided Semantic Fuzzer
# =============================================================================
# Multi-stage build. The same image is used for runtime / runner / client;
# pick a binary at build time via `--build-arg BIN=fuzz-runtime`.
#
# `ARCP_SDK_VERSION` is honoured at the workspace level: if the local
# arcp-stubs crate is replaced with the real `arcp` crate, set the version
# in the workspace Cargo.toml. The build-arg is wired through so future
# work can pin it.
# -----------------------------------------------------------------------------
FROM rust:1.83-slim AS build

ARG ARCP_SDK_VERSION=latest
ARG BIN=fuzz-runtime

ENV CARGO_NET_RETRY=10 \
    CARGO_HTTP_MULTIPLEXING=true

RUN apt-get update \
 && apt-get install -y --no-install-recommends pkg-config ca-certificates \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /src

# Copy the whole workspace. The example is small so caching layer-by-layer
# isn't worth the manifest gymnastics.
COPY Cargo.toml ./
COPY crates ./crates
COPY examples ./examples

# Build the requested binary plus the demo target. The target is built
# without instrumentation here — see runner/src/main.rs for why libFuzzer
# counters are stubbed.
RUN cargo build --release --bin ${BIN} \
 && cargo build --release --manifest-path examples/target_cbor/Cargo.toml \
 && mkdir -p /out \
 && cp target/release/${BIN} /out/app \
 && cp target/release/target_cbor /out/target

# -----------------------------------------------------------------------------
FROM debian:bookworm-slim AS runtime

RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates tini netcat-openbsd \
 && rm -rf /var/lib/apt/lists/*

COPY --from=build /out/app /usr/local/bin/app
# The runner needs the target on PATH at /work/target; the runtime / client
# don't strictly need it but shipping the same image keeps things simple.
COPY --from=build /out/target /work/target

ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["/usr/local/bin/app"]