balddev_voting_program/Dockerfile at main · orithellama/balddev_voting_program · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# ==============================================================
# balddev DAO Voting Program — Multi-stage Dockerfile
# ==============================================================
#
# Stages
#   toolchain  — Rust + Solana CLI + Node.js + Anchor CLI
#   deps       — Cargo dependency cache layer
#   builder    — compiled BPF/SBF program
#   test       — Anchor / TypeScript test runner
#   kani       — Kani formal verification (nightly Rust)
#
# Build a specific stage:
#   docker build --target builder -t balddev-dao-voting:builder .
#   docker build --target kani    -t balddev-dao-voting:kani    .
# ==============================================================

ARG RUST_VERSION=1.83
ARG SOLANA_VERSION=2.1.0
ARG ANCHOR_VERSION=0.31.1
ARG NODE_MAJOR=20

# ── toolchain ────────────────────────────────────────────────────────────────
FROM debian:bookworm-slim AS toolchain

ARG RUST_VERSION
ARG SOLANA_VERSION
ARG ANCHOR_VERSION
ARG NODE_MAJOR

ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:/root/.local/share/solana/install/active_release/bin:$PATH \
    DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
        curl ca-certificates git \
        pkg-config libudev-dev libssl-dev \
        clang build-essential make && \
    rm -rf /var/lib/apt/lists/*

# Rust stable toolchain
RUN curl https://sh.rustup.rs -sSf | \
    sh -s -- -y \
        --default-toolchain ${RUST_VERSION} \
        --profile minimal \
        --no-modify-path && \
    rustup component add rustfmt clippy && \
    rustup show

# Solana CLI (anza.xyz CDN)
RUN curl -sSfL "https://release.anza.xyz/v${SOLANA_VERSION}/install" | sh && \
    solana --version

# Node.js (for Anchor CLI and future TS tests)
RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - && \
    apt-get install -y --no-install-recommends nodejs && \
    rm -rf /var/lib/apt/lists/*

# Anchor CLI
RUN npm install -g @coral-xyz/anchor-cli@${ANCHOR_VERSION} && \
    anchor --version

# Ephemeral Solana keypair (testing only — never use for mainnet)
RUN solana-keygen new --no-bip39-passphrase --silent \
        --outfile /root/.config/solana/id.json

# ── deps: cache Cargo dependencies ───────────────────────────────────────────
FROM toolchain AS deps

WORKDIR /app

# Copy workspace and program manifests only so Docker can cache the dep layer
# independently of source changes.
COPY Cargo.toml Cargo.lock ./
COPY programs/balddev_dao_voting/Cargo.toml \
     programs/balddev_dao_voting/Cargo.toml

# Stub src so cargo can resolve the dependency graph
RUN mkdir -p programs/balddev_dao_voting/src && \
    printf '#![allow(unused)]\nfn placeholder() {}\n' \
        > programs/balddev_dao_voting/src/lib.rs && \
    cargo fetch

# ── builder: compile the BPF/SBF program ─────────────────────────────────────
FROM deps AS builder

COPY . .

RUN anchor build && \
    ls -lh target/deploy/balddev_dao_voting.so

# ── test: Anchor / TypeScript test runner ─────────────────────────────────────
FROM builder AS test

# Install Node dependencies when package.json is present
COPY package*.json ./
RUN [ -f package.json ] && npm ci || true

# Default: run tests against a validator managed by this container.
# Override with ANCHOR_PROVIDER_URL to target an external validator.
CMD ["anchor", "test"]

# ── kani: formal verification ──────────────────────────────────────────────────
# Uses a fresh Rust nightly image — no Solana toolchain needed.
FROM debian:bookworm-slim AS kani

ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:$PATH \
    DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
        curl ca-certificates git \
        pkg-config libssl-dev build-essential \
        python3 && \
    rm -rf /var/lib/apt/lists/*

# cargo-kani manages its own nightly pinning; install stable first,
# then let kani setup pull the required nightly.
RUN curl https://sh.rustup.rs -sSf | \
    sh -s -- -y \
        --default-toolchain stable \
        --profile minimal \
        --no-modify-path

RUN cargo install kani-verifier --locked && \
    cargo kani setup

WORKDIR /app/kani_verification

COPY kani_verification/ .

CMD ["./verify.sh"]