# The remote executor's image. # # buck2 fetches its own toolchains — zig, rustc, the Rust standard library, the # NDK — from the pins in scripts/*.dotslash, so almost nothing here has to be # installed. Almost: a handful of `-sys` crates ask pkg-config where a system # library is, and one of them then links against it. # # That is why this image exists rather than gcr.io/flame-public/rbe-ubuntu24-04, # which carries neither. Without pkg-config, alsa-sys's build script panics # before it can emit a single link directive; without libasound2-dev, the flags # it emits name a library the linker cannot find. # # 24.04 for the same reason the public image was pinned to it: a build script is # compiled here and *run* on the worker, and 22.04's glibc 2.35 is old enough to # fail that before a crate is compiled. FROM ubuntu:24.04 # ca-certificates because an action fetches over TLS, and python3 because the # prelude's own Rust rules shell out to it — a dep-file pass runs on the worker, # not here. The rest is the system half of what the graph's build scripts look # for: alsa-sys asks pkg-config for libasound, and v4l2r runs bindgen over # `linux/videodev2.h`, which needs libclang to parse it and the kernel's own # headers to find it — and libc's own, since videodev2.h includes . A cargo build takes both from the justfile's environment, # which names this machine's zig headers — nothing a remote action inherits, so # the worker has to carry them. # # libclang1 and its builtin headers rather than libclang-dev, which drags the # whole clang toolchain in and took the image from 130 MB to 731 MB. bindgen # loads the library and reads those headers; it has no use for the compiler. # # Kept to what a build has actually asked for: an unused package here is an # image every action pulls. RUN apt-get update && apt-get install --no-install-recommends -y \ ca-certificates \ libasound2-dev \ libc6-dev \ libclang1-18 \ libclang-common-18-dev \ linux-libc-dev \ pkg-config \ python3 \ && rm -rf /var/lib/apt/lists/*