440709829d
The image the bridge is built and mutated in existed nowhere in the repository, and the recipe that stood in for it installed a C++ toolchain and no JavaScript runtime — so the container could not run the harness that checks the bridge it had just built. It is a file now, pinned to the same debian:13 digest as the release workflow, carrying ninja, Node, setarch and MsQuic's four runtime dependencies. The harness configures with `-G Ninja` on linux-x64, which is what scripts/build-quic-native.sh uses. CMake's Linux default is Makefiles, the image carries ninja rather than make, and the default configured nothing at all: the first run in the committed container died in cmake. It said so, because the control now prints what the child said, which is the whole point of that change. The seccomp requirement is stated where someone hitting it will read it — the bridge's README, beside the recipe — rather than being knowledge the runner assumes its caller already has. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
38 lines
2 KiB
Docker
38 lines
2 KiB
Docker
# The linux-x64 development loop for the CultMesh native QUIC bridge: build it,
|
|
# run its scenarios, and run the mutation harness over it. Not a release
|
|
# builder — the shipped Linux artifact comes from the workflow (see
|
|
# docs/typescript-quic-realtime-cut.md).
|
|
#
|
|
# This image is what the harness's linux-x64 entries are honest about. Before it
|
|
# was committed, the recipe in the cut map installed a C++ toolchain and no
|
|
# JavaScript runtime, so the container the bridge was built in could not run the
|
|
# runner that mutates it at all.
|
|
#
|
|
# docker build -t cultlib-quic-native-dev -f scripts/quic-native-linux-dev.Dockerfile scripts
|
|
# docker run --rm --security-opt seccomp=unconfined -v F:\Projects\CultLib:/src -w /src \
|
|
# cultlib-quic-native-dev bash -lc "scripts/build-quic-native.sh && node scripts/mutate-cultmesh.mjs native"
|
|
#
|
|
# `--security-opt seccomp=unconfined` is not optional and not caution. The
|
|
# ThreadSanitizer configuration needs the process's address space where it
|
|
# expects it, so the harness re-executes it under `setarch -R`, which asks the
|
|
# kernel for personality(ADDR_NO_RANDOMIZE). Docker's default seccomp profile
|
|
# denies that call, and without it ThreadSanitizer dies before main with
|
|
# "unexpected memory mapping" — a whole configuration failing to start, which a
|
|
# mutation harness reads as every mutant being killed.
|
|
#
|
|
# Pinned by digest, not by the moving tag: the artifact is the toolchain that
|
|
# made it.
|
|
FROM debian:13@sha256:f324c7ff54321e8d9c588493a20244965938ce0aa50bbd1022d38010e9ffc4b1
|
|
|
|
# cmake, ninja and g++ build the bridge and its scenario runner; curl,
|
|
# ca-certificates and dpkg fetch and unpack the pinned libmsquic deb;
|
|
# util-linux carries setarch; nodejs runs scripts/mutate-cultmesh.mjs. The four
|
|
# libraries are MsQuic's own runtime dependencies, which the bridge does not
|
|
# vendor.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
bash ca-certificates cmake curl dpkg g++ ninja-build nodejs util-linux \
|
|
libssl3t64 libnuma1 libxdp1 libnl-route-3-200 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /src
|