e4e81d1628
Finding 8(c): the dev image builds the Node bridge's own libmsquic copy into a build-local directory (scripts/build-quic-native.sh), which is never on the loader's search path. .NET's System.Net.Quic resolves "libmsquic" through that path independently and failed with PlatformNotSupportedException before this. The smallest honest fix: dpkg -i the same pinned 2.5.9 deb (same URL, same SHA-256 as the build script) system-wide and run ldconfig, so both the Node bridge's own copy and .NET's independent resolution find a libmsquic. Changes the image; the new tag is cultlib-quic-native-dev:75cb89e73850 (first 12 hex of this file's sha256), built fresh on Yggdrasil. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
75 lines
4 KiB
Docker
75 lines
4 KiB
Docker
# The linux-x64 development loop for the CultMesh native QUIC bridge: build it
|
|
# and run its runtime-lifetime scenarios directly. Not a release builder — the
|
|
# shipped Linux artifact comes from the workflow (see
|
|
# docs/typescript-quic-realtime-cut.md).
|
|
#
|
|
# See native/GameCult.Mesh.Quic.Native/README.md for the build and run commands
|
|
# (CULTMESH_QUIC_BUILD_TESTS, CULTMESH_QUIC_DEBUG_ASSERTS, and the scenario
|
|
# names the built binary takes as its first argument).
|
|
#
|
|
# docker build -t cultlib-quic-native-dev -f scripts/quic-native-linux-dev.Dockerfile scripts
|
|
#
|
|
# From the repository root; the mount for `docker run` is that root wherever it
|
|
# is: `${PWD}` in PowerShell, `$(pwd)` in a POSIX shell.
|
|
#
|
|
# `--security-opt seccomp=unconfined` is not optional and not caution. A
|
|
# ThreadSanitizer configuration needs the process's address space where it
|
|
# expects it, so a TSan run is re-executed under `setarch -R`, which asks the
|
|
# kernel for personality(ADDR_NO_RANDOMIZE). Docker's default seccomp profile
|
|
# denies that call, and without it ThreadSanitizer dies before main with
|
|
# "unexpected memory mapping" — a configuration that never starts, not a
|
|
# scenario that passed.
|
|
#
|
|
# Pinned by digest, not by the moving tag: the artifact is the toolchain that
|
|
# made it.
|
|
FROM debian:13@sha256:f324c7ff54321e8d9c588493a20244965938ce0aa50bbd1022d38010e9ffc4b1
|
|
|
|
# cmake, ninja and g++ build the bridge and its scenario runner; curl,
|
|
# ca-certificates and dpkg fetch and unpack the pinned libmsquic deb;
|
|
# util-linux carries setarch, needed to re-execute the TSan scenarios under
|
|
# ADDR_NO_RANDOMIZE. The four libraries are MsQuic's own runtime dependencies,
|
|
# which the bridge does not vendor. gnupg is needed only to fetch the NodeSource
|
|
# key below.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
bash ca-certificates cmake curl dpkg g++ ninja-build util-linux gnupg \
|
|
libssl3t64 libnuma1 libxdp1 libnl-route-3-200 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Node 24 and the .NET 10 SDK: the Cut 4 QUIC realtime plane's own npm tests
|
|
# and the C#-to-TS interop lane run in this image too, so it needs to build the
|
|
# bridge and then exercise it from both runtimes without a second image.
|
|
RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh \
|
|
&& bash /tmp/dotnet-install.sh --channel 10.0 --install-dir /usr/share/dotnet \
|
|
&& rm /tmp/dotnet-install.sh \
|
|
&& ln -s /usr/share/dotnet/dotnet /usr/local/bin/dotnet
|
|
ENV DOTNET_ROOT=/usr/share/dotnet
|
|
ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
|
|
|
|
# .NET's own System.Net.Quic P/Invokes into "libmsquic" and resolves it
|
|
# through the loader's normal search path, not through this repo's
|
|
# CULTMESH_QUIC_NATIVE_DIR (that is the Node bridge's own binary directory,
|
|
# never the system loader path). Without this, the interop lane's C# peer
|
|
# fails QuicListener.IsSupported with PlatformNotSupportedException. `dpkg -i`
|
|
# (rather than the build script's `dpkg-deb -x` into a build-local directory)
|
|
# installs the same pinned package into /usr/lib/x86_64-linux-gnu and runs
|
|
# ldconfig, so it is resolvable process-wide. Same version, same digest as
|
|
# scripts/build-quic-native.sh.
|
|
RUN curl -fsSL -o /tmp/libmsquic.deb \
|
|
https://packages.microsoft.com/debian/13/prod/pool/main/libm/libmsquic/libmsquic_2.5.9_amd64.deb \
|
|
&& echo "1baa61ade0b7b4a99f6dcb6b00d9aedb12b5566d00918a325be7425e878e51ba /tmp/libmsquic.deb" | sha256sum -c - \
|
|
&& dpkg -i /tmp/libmsquic.deb \
|
|
&& rm /tmp/libmsquic.deb \
|
|
&& ldconfig
|
|
# This minimal Debian image carries no ICU package, and .NET's runtime
|
|
# FailFasts on startup without one. The interop peer already parses every
|
|
# argument through CultureInfo.InvariantCulture, so globalization-invariant
|
|
# mode costs it nothing; installing an ICU package would be the alternative,
|
|
# but Microsoft's own guidance for a minimal container is this flag.
|
|
ENV DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
|
|
|
|
WORKDIR /src
|