Dockerfile

# syntax=docker/dockerfile:1.4
#
# Multi-stage Dockerfile for Arbitrage Bot with cargo-chef + BuildKit
# cache mounts for fast incremental builds on resource-constrained
# build hosts.
#
# Requires BuildKit (Docker ≥ 18.09). Docker Compose v2 enables it by
# default. If you see "unknown flag: --mount" run with:
#   DOCKER_BUILDKIT=1 docker compose up -d --build
#
# Cache mount strategy:
#   1. `cargo-chef` produces a minimal `recipe.json` of workspace
#      dependencies so the cook step doesn't need source code.
#   2. The cook step AND the final build step share identical cache
#      mounts on $CARGO_HOME/{registry,git} and /app/target, so the
#      first step's fetched crates and compiled dependencies are
#      visible to the second step.
#   3. Cache mounts are NOT persisted into image layers, so the
#      final binary is `cp`-ed out of /app/target onto the filesystem
#      before the last stage's `COPY --from=builder` grabs it.

ARG RUST_VERSION=1.92

FROM lukemathwalker/cargo-chef:latest-rust-${RUST_VERSION}-alpine AS chef
WORKDIR /app

# ─── Planner stage ─────────────────────────────────────────────────
# Fast (seconds). Only needs to re-run when Cargo.toml / Cargo.lock
# change, which is rare. Produces recipe.json that captures the full
# dependency graph.
FROM chef AS planner
COPY . .
RUN cargo chef prepare --recipe-path recipe.json

# ─── Builder stage ─────────────────────────────────────────────────
# The slow one. Two sub-steps, both using the same cache mounts so
# state persists between them.
FROM chef AS builder
RUN apk add --no-cache musl-dev openssl-dev pkgconfig

ENV CARGO_BUILD_JOBS=1

# Step 1: cook dependencies only, using recipe.json. This builds
# every workspace dep with --release and populates /app/target with
# fingerprinted artifacts. Cache mounts persist across invocations
# so the second `docker build` sees the compiled deps from the first.
COPY --from=planner /app/recipe.json recipe.json
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
    --mount=type=cache,target=/app/target,sharing=locked \
    cargo chef cook --release --recipe-path recipe.json

# Step 2: copy the source, build the final binary. Because the
# /app/target cache mount is shared with step 1, incremental compile
# kicks in and only the workspace crates (not deps) are re-built.
COPY . .

# Cache-bust marker: the GIT_SHA build arg below makes this layer's
# hash change whenever the deployed git revision changes. Without this,
# BuildKit can cache-hit the build layer even after `git pull`, because
# the cache mount that holds /app/target is not part of the layer hash —
# meaning BuildKit thinks "same source, same env, same command → reuse
# previous output" and ships the OLD binary in a fresh-looking image.
# See 2026-05-12 silent-broadcast-stall incident: image_created stayed
# 5/9 07:41 across a 5/12 `--build` invocation, and the dispatch_watchdog
# fix never reached production until --no-cache forced a rebuild.
# Pass the SHA from compose.yml: `build.args.GIT_SHA: ${GIT_SHA:-unknown}`
# and set GIT_SHA=$(git rev-parse HEAD) before `docker compose up -d --build`.
ARG GIT_SHA=unknown
ENV BUILD_GIT_SHA=$GIT_SHA
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
    --mount=type=cache,target=/app/target,sharing=locked \
    cargo build --release --bin arbitrage-bot && \
    cp target/release/arbitrage-bot /app/arbitrage-bot && \
    echo "built from git $BUILD_GIT_SHA at $(date -u +%FT%TZ)" > /app/BUILD_INFO

# ─── Runtime stage ─────────────────────────────────────────────────
# Minimal alpine image. The binary was copied out of the cache mount
# in the previous step, so this COPY sees it as a real filesystem
# object.
FROM alpine:3.20

LABEL maintainer="arbitrage-bot"
LABEL version="0.1.1"
LABEL description="Cryptocurrency arbitrage monitoring bot with multi-exchange support"

RUN apk add --no-cache ca-certificates libgcc curl
WORKDIR /app
COPY --from=builder /app/arbitrage-bot /app/arbitrage-bot
# Fingerprint file written at build time in the builder stage. Used by
# scripts/deploy.sh to verify the running container holds the binary
# built from the expected git SHA (defends against BuildKit cache hits).
COPY --from=builder /app/BUILD_INFO /app/BUILD_INFO

# Non-root user
RUN adduser -D -u 1000 appuser
USER appuser

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:8080/healthz || exit 1

CMD ["/app/arbitrage-bot"]