Unified Container Build with Cache Mounts

.containerignore

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: Yair Podemsky <ypodemsk@redhat.com>
+#
+# SPDX-License-Identifier: CC0-1.0
+
+
+target/
+.git/
+bin/
+tests/
+test_utils/
+must-gather/
+bundle/
+.github/
+*.tar

Cargo.toml

@@ -30,4 +30,5 @@ serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
 tokio = { version = "1.52.3", features = ["macros", "rt-multi-thread"] }
 uuid = { version = "1.23", features = ["v4", "serde"] }
+reference-values = { git = "https://github.com/trusted-execution-clusters/reference-values" }
 warp = { version = "0.3", default-features = false }

Containerfile

@@ -1,34 +1,102 @@
 # SPDX-FileCopyrightText: Alice Frosi <afrosi@redhat.com>
 # SPDX-FileCopyrightText: Jakob Naucke <jnaucke@redhat.com>
+# SPDX-FileCopyrightText: Yair Podemsky <ypodemsk@redhat.com>
 #
 # SPDX-License-Identifier: CC0-1.0
 
-ARG build_type
-# Dependency build stage
+ARG build_type=release
+
+# Unified builder stage — compiles all binaries in a single cargo invocation.
 FROM ghcr.io/trusted-execution-clusters/buildroot:fedora AS builder
+LABEL project=trusted-cluster-operator
 ARG build_type
 WORKDIR /build
 
 COPY Makefile Cargo.toml Cargo.lock go.mod go.sum .
+
 COPY api api
 COPY lib lib
+
+# Copy Cargo.toml and lib.rs stubs for dependency pre-build caching.
 COPY operator/Cargo.toml operator/
 COPY operator/src/lib.rs operator/src/
+COPY compute-pcrs/Cargo.toml compute-pcrs/
+COPY compute-pcrs/src/lib.rs compute-pcrs/src/
+COPY register-server/Cargo.toml register-server/
+COPY register-server/src/lib.rs register-server/src/
+COPY attestation-key-register/Cargo.toml attestation-key-register/
+COPY attestation-key-register/src/lib.rs attestation-key-register/src/
 
-# Set only required crates as members to minimize rebuilds upon changes.
-RUN sed -i 's/members = .*/members = ["lib", "operator"]/' Cargo.toml && \
+RUN sed -i 's/members = .*/members = ["lib", "operator", "compute-pcrs", "register-server", "attestation-key-register"]/' Cargo.toml && \
     sed -i '/\[dev-dependencies\]/,$d' operator/Cargo.toml && \
-    sed -i '/trusted-cluster-operator-test-utils/d' lib/Cargo.toml && \
+    sed -i '/\[dev-dependencies\]/,$d' register-server/Cargo.toml && \
+    sed -i '/trusted-cluster-operator-test-utils/d' lib/Cargo.toml
+
+RUN --mount=type=cache,target=/build/target \
+    --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/root/go/pkg/mod \
     make crds-rs
 
-# In debug builds, build dependencies to avoid full rebuild.
-RUN if [ "$build_type" = debug ]; then cargo build -p operator; fi
+# In debug builds, pre-build dependencies to avoid full rebuild on source changes.
+RUN --mount=type=cache,target=/build/target \
+    --mount=type=cache,target=/usr/local/cargo/registry \
+    if [ "$build_type" = debug ]; then \
+      cargo build -p operator -p compute-pcrs -p register-server -p attestation-key-register; \
+    fi
 
-# Target build stage
 COPY operator/src operator/src
-RUN cargo build -p operator $(if [ "$build_type" = release ]; then echo --release; fi)
+COPY compute-pcrs/src compute-pcrs/src
+COPY register-server/src register-server/src
+COPY attestation-key-register/src attestation-key-register/src
 
-# Distribution stage
-FROM quay.io/fedora/fedora:43
-ARG build_type
-COPY --from=builder "/build/target/$build_type/operator" /usr/bin
+RUN --mount=type=cache,target=/build/target \
+    --mount=type=cache,target=/usr/local/cargo/registry \
+    release_flag="" && \
+    if [ "$build_type" = release ]; then release_flag="--release"; fi && \
+    cargo build \
+      -p operator \
+      -p compute-pcrs \
+      -p register-server \
+      -p attestation-key-register \
+      $release_flag
+
+RUN --mount=type=cache,target=/build/target \
+    profile_dir="debug" && \
+    if [ "$build_type" = release ]; then profile_dir="release"; fi && \
+    mkdir -p /output && \
+    cp /build/target/${profile_dir}/operator /output/ && \
+    cp /build/target/${profile_dir}/compute-pcrs /output/ && \
+    cp /build/target/${profile_dir}/register-server /output/ && \
+    cp /build/target/${profile_dir}/attestation-key-register /output/
+
+# Distribution stages
+FROM quay.io/fedora/fedora:43 AS operator
+COPY --from=builder /output/operator /usr/bin
+ENTRYPOINT ["/usr/bin/operator"]
+
+FROM quay.io/fedora/fedora:43 AS attestation-key-register
+COPY --from=builder /output/attestation-key-register /usr/bin
+EXPOSE 8001
+ENTRYPOINT ["/usr/bin/attestation-key-register"]
+
+FROM quay.io/fedora/fedora:43 AS register-server
+COPY --from=builder /output/register-server /usr/bin
+EXPOSE 3030
+ENTRYPOINT ["/usr/bin/register-server"]
+
+
+FROM builder AS compute-pcrs-data
+RUN rv_line=$(cargo metadata --format-version=1 | jq -r '.packages[] | select(.name == "reference-values") | .source') && \
+    rv_repo=$(echo "$rv_line" | sed 's/^git+//;s/[?#].*//') && \
+    rv_commit=$(echo "$rv_line" | sed 's/.*#//') && \
+    git clone "$rv_repo" reference-values && \
+    git -C reference-values checkout "$rv_commit"
+RUN mkdir -p /output/reference-values && \
+    mv /build/reference-values/efivars /output/reference-values/ && \
+    mv /build/reference-values/mok-variables /output/reference-values/
+
+FROM quay.io/fedora/fedora:43 AS compute-pcrs
+COPY --from=compute-pcrs-data /output/compute-pcrs /usr/bin
+COPY --from=compute-pcrs-data /output/reference-values /reference-values
+ENTRYPOINT ["/usr/bin/compute-pcrs"]

Makefile

@@ -126,13 +126,13 @@ CONTAINER_CLI ?= podman
 RUNTIME ?= podman
 
 operator-image:
-	$(CONTAINER_CLI) build $(IMAGE_BUILD_OPTIONS) -t $(OPERATOR_IMAGE) -f Containerfile .
+	$(CONTAINER_CLI) build $(IMAGE_BUILD_OPTIONS) --target operator -t $(OPERATOR_IMAGE) -f Containerfile .
 compute-pcrs-image:
-	$(CONTAINER_CLI) build $(IMAGE_BUILD_OPTIONS) -t $(COMPUTE_PCRS_IMAGE) -f compute-pcrs/Containerfile .
+	$(CONTAINER_CLI) build $(IMAGE_BUILD_OPTIONS) --target compute-pcrs -t $(COMPUTE_PCRS_IMAGE) -f Containerfile .
 reg-server-image:
-	$(CONTAINER_CLI) build $(IMAGE_BUILD_OPTIONS) -t $(REG_SERVER_IMAGE) -f register-server/Containerfile .
+	$(CONTAINER_CLI) build $(IMAGE_BUILD_OPTIONS) --target register-server -t $(REG_SERVER_IMAGE) -f Containerfile .
 attestation-key-register-image:
-	$(CONTAINER_CLI) build $(IMAGE_BUILD_OPTIONS) -t $(ATTESTATION_KEY_REGISTER_IMAGE) -f attestation-key-register/Containerfile .
+	$(CONTAINER_CLI) build $(IMAGE_BUILD_OPTIONS) --target attestation-key-register -t $(ATTESTATION_KEY_REGISTER_IMAGE) -f Containerfile .
 
 image: operator-image compute-pcrs-image reg-server-image attestation-key-register-image
 
@@ -220,6 +220,13 @@ clean:
 	cargo clean
 	rm -rf bin manifests $(CRD_YAML_PATH) $(CRD_RS_PATH)
 	rm -f trusted-cluster-gen config/rbac/role.yaml .crates.toml .crates2.json
+	$(CONTAINER_CLI) image prune --all --force --filter label=project=trusted-cluster-operator
+	# Prune --mount=type=cache data: podman uses --build-cache, docker uses builder prune (no label filter supported by either)
+	@if $(CONTAINER_CLI) image prune --help 2>&1 | grep -q -- '--build-cache'; then \
+		$(CONTAINER_CLI) image prune --force --build-cache; \
+	else \
+		$(CONTAINER_CLI) builder prune --force --filter type=exec.cachemount; \
+	fi
 
 fmt-check:
 	cargo fmt -- --check

compute-pcrs/Cargo.toml

@@ -19,3 +19,5 @@ k8s-openapi.workspace = true
 kube.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
+# Pins the reference-values repo+commit in Cargo.lock for the container build (see Containerfile).
+reference-values.workspace = true