Dockerfile.bytehound

# =============================================================================
# NOTE: This image is intentionally OUTSIDE the Nix flake's hermeticity
# guarantee. It uses `cargo +nightly` and clones bytehound from upstream
# (a moving HEAD), and pulls a debian:bookworm rust toolchain image whose
# apt-package set is not pinned. Reproducibility is best-effort, not
# bit-exact.
#
# This is acceptable because the image is used only for memory profiling
# (developer-facing diagnostics), never for producing release artifacts
# or signing material. Anything that ships to users goes through the
# `flake.nix` hermetic build path.
#
# If you need a reproducible memory-profiling environment, pin both the
# base image digest and the bytehound git revision below.
# =============================================================================

FROM rust:1.90-bookworm

# Install dependencies
RUN apt-get update && \
    apt-get install -y build-essential gcc git && \
    rm -rf /var/lib/apt/lists/*

# Install Rust nightly for building ByteHound
RUN rustup toolchain install nightly

# Build ByteHound
RUN git clone https://github.com/koute/bytehound.git /bytehound && \
    cd /bytehound && \
    cargo +nightly build --release -p bytehound-preload && \
    cargo +nightly build --release -p bytehound-cli && \
    cp target/release/libbytehound.so /usr/local/lib/ && \
    cp target/release/bytehound /usr/local/bin/

# Switch to stable Rust for building project
RUN rustup default stable

WORKDIR /workspace

# Copy project files
COPY . .

# Build the project
RUN cargo build --release

# Set environment for ByteHound
ENV MEMORY_PROFILER_LOG=warn
ENV LD_PRELOAD=/usr/local/lib/libbytehound.so

CMD ["cargo", "test", "--release", "--", "--test-threads=1", "--nocapture"]