Dockerfile

# QUICK- TCP-over-QUIC Tunnel - Linux Build (multi-arch)
#
# Build (native):
#   docker build -t quick-tunnel .
#
# Build (multi-arch via buildx):
#   docker buildx build --platform linux/amd64,linux/arm64 -t quick-tunnel .
#
# Build (quinn fallback):
#   docker build --build-arg TRANSPORT=quinn -t quick-tunnel .
#
# Extract binaries:
#   docker create --name quick-build quick-tunnel
#   docker cp quick-build:/app/target/release/quick-entry ./
#   docker cp quick-build:/app/target/release/quick-exit ./
#   docker rm quick-build

FROM rust:1.85-bookworm AS builder

# Install build dependencies for quiche (BoringSSL)
RUN apt-get update && apt-get install -y \
    cmake \
    ninja-build \
    nasm \
    pkg-config \
    libssl-dev \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy manifests first for dependency caching
COPY Cargo.toml Cargo.lock* ./
COPY .cargo ./.cargo
COPY crates/quick-core/Cargo.toml ./crates/quick-core/
COPY crates/quick-protocol/Cargo.toml ./crates/quick-protocol/
COPY crates/quick-fec/Cargo.toml ./crates/quick-fec/
COPY crates/quick-kcp/Cargo.toml ./crates/quick-kcp/
COPY crates/quick-transport/Cargo.toml ./crates/quick-transport/
COPY crates/quick-config/Cargo.toml ./crates/quick-config/
COPY crates/quick-metrics/Cargo.toml ./crates/quick-metrics/
COPY crates/quick-container/Cargo.toml ./crates/quick-container/
COPY crates/quick-reload/Cargo.toml ./crates/quick-reload/
COPY crates/quick-dpi/Cargo.toml ./crates/quick-dpi/
COPY crates/quick-dpi-storage/Cargo.toml ./crates/quick-dpi-storage/
COPY crates/quick-logging/Cargo.toml ./crates/quick-logging/
COPY bins/quick-entry/Cargo.toml ./bins/quick-entry/
COPY bins/quick-exit/Cargo.toml ./bins/quick-exit/

# Create dummy src files for dependency caching
RUN for crate in quick-core quick-protocol quick-fec quick-kcp quick-transport \
        quick-config quick-metrics quick-container quick-reload quick-dpi \
        quick-dpi-storage quick-logging; do \
        mkdir -p "crates/$crate/src" && echo "pub fn dummy() {}" > "crates/$crate/src/lib.rs"; \
    done && \
    mkdir -p crates/quick-protocol/benches && echo "fn main() {}" > crates/quick-protocol/benches/protocol_bench.rs && \
    mkdir -p crates/quick-fec/benches && echo "fn main() {}" > crates/quick-fec/benches/fec_bench.rs && \
    mkdir -p bins/quick-entry/src && echo "fn main() {}" > bins/quick-entry/src/main.rs && \
    mkdir -p bins/quick-exit/src && echo "fn main() {}" > bins/quick-exit/src/main.rs

# Build dependencies (cached layer) - use --locked to respect Cargo.lock
ARG TRANSPORT=quiche
RUN if [ "$TRANSPORT" = "quinn" ]; then \
        cargo build --release --locked --no-default-features --features quinn-backend 2>/dev/null || true; \
    else \
        cargo build --release --locked 2>/dev/null || true; \
    fi

# Copy actual source
COPY crates ./crates
COPY bins ./bins

# Touch source files to ensure timestamps are newer than cached dep builds
# This forces Cargo to rebuild only the workspace crates (not dependencies)
RUN find . -name "*.rs" -newer /app/Cargo.toml -exec touch {} \; 2>/dev/null || true

# Build for real - use --locked to respect Cargo.lock
RUN if [ "$TRANSPORT" = "quinn" ]; then \
        cargo build --release --locked --no-default-features --features quinn-backend; \
    else \
        cargo build --release --locked; \
    fi

# Runtime image
FROM debian:bookworm-slim AS runtime

RUN apt-get update && apt-get install -y \
    ca-certificates \
    wget \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user for runtime
RUN groupadd -r quick && useradd -r -g quick -d /nonexistent -s /usr/sbin/nologin quick

WORKDIR /app

COPY --from=builder --chmod=755 /app/target/release/quick-entry /app/
COPY --from=builder --chmod=755 /app/target/release/quick-exit /app/

# Switch to non-root user
USER quick

# Health check against metrics endpoint (entry=9091, exit=9090)
# Tries entry port first, then exit port; succeeds if either responds
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget -q --spider http://localhost:9091/health || wget -q --spider http://localhost:9090/health || exit 1

# Default to entry proxy
ENTRYPOINT ["/app/quick-entry"]
CMD ["--help"]

# Labels
LABEL org.opencontainers.image.title="QUICK- Tunnel"
LABEL org.opencontainers.image.description="TCP-over-QUIC tunnel optimized for satellite networks"
LABEL org.opencontainers.image.authors="YANDO FOTSO Noel Junior"