Build the orchestrator in Docker

Author: shepmaster

compiler/base/.dockerignore

@@ -1,2 +1,3 @@
 asm-cleanup/target
 modify-cargo-toml/target
+orchestrator/target

compiler/base/Dockerfile

@@ -59,11 +59,39 @@ FROM bare-sources as munge
 ADD --chown=playground modify-cargo-toml /playground/modify-cargo-toml
 RUN cargo build --release --manifest-path=/playground/modify-cargo-toml/Cargo.toml
 
+# Set up cargo-chef for faster builds
+
+FROM bare-sources as chef-available
+
+RUN cargo install cargo-chef
+
+WORKDIR /orchestrator
+
+# Prepare the orchestrator's dependencies
+
+FROM chef-available as prepare-orchestrator
+
+COPY --chown=playground --link orchestrator /orchestrator
+RUN cargo chef prepare
+
+# Build the orchestrator
+
+FROM chef-available as build-orchestrator
+
+COPY --chown=playground --link asm-cleanup /asm-cleanup
+COPY --chown=playground --link modify-cargo-toml /modify-cargo-toml
+COPY --chown=playground --link --from=prepare-orchestrator /orchestrator/recipe.json /orchestrator/recipe.json
+RUN cargo chef cook --release
+
+COPY --chown=playground --link orchestrator /orchestrator
+RUN cargo install --path .
+
 # Compiler and sources
 
 FROM bare-sources as sources
 
 COPY --from=munge /playground/modify-cargo-toml/target/release/modify-cargo-toml /playground/.cargo/bin
+COPY --link --from=build-orchestrator /playground/.cargo/bin/worker /playground/.cargo/bin/worker
 
 # Compiler and pre-compiled crates
 

compiler/base/entrypoint.sh

@@ -2,10 +2,14 @@
 
 set -eu
 
-timeout=${PLAYGROUND_TIMEOUT:-10}
+if [[ -z "${PLAYGROUND_ORCHESTRATOR:-}" ]]; then
+    timeout=${PLAYGROUND_TIMEOUT:-10}
 
-modify-cargo-toml
+    modify-cargo-toml
 
-# Don't use `exec` here. The shell is what prints out the useful
-# "Killed" message
-timeout --signal=KILL ${timeout} "$@"
+    # Don't use `exec` here. The shell is what prints out the useful
+    # "Killed" message
+    timeout --signal=KILL ${timeout} "$@"
+else
+    exec "$@"
+fi

compiler/base/orchestrator/src/coordinator.rs

@@ -346,6 +346,12 @@ where
     }
 }
 
+impl Coordinator<DockerBackend> {
+    pub async fn new_docker() -> Result<Self, Error> {
+        Self::new(DockerBackend(())).await
+    }
+}
+
 #[derive(Debug)]
 struct Container {
     task: JoinHandle<Result<()>>,
@@ -819,6 +825,63 @@ where
     }
 }
 
+macro_rules! docker_command {
+    ($($arg:expr),* $(,)?) => ({
+        let mut cmd = Command::new("docker");
+        $( cmd.arg($arg); )*
+        cmd
+    });
+}
+
+#[cfg(target_arch = "x86_64")]
+const DOCKER_ARCH: &str = "linux/amd64";
+
+#[cfg(target_arch = "aarch64")]
+const DOCKER_ARCH: &str = "linux/arm64";
+
+fn basic_secure_docker_command() -> Command {
+    docker_command!(
+        "run",
+        "--platform",
+        DOCKER_ARCH,
+        "--cap-drop=ALL",
+        "--net",
+        "none",
+        "--memory",
+        "512m",
+        "--memory-swap",
+        "640m",
+        "--pids-limit",
+        "512",
+    )
+}
+
+pub struct DockerBackend(());
+
+impl Backend for DockerBackend {
+    fn prepare_worker_command(&self, channel: Channel) -> Command {
+        let mut command = basic_secure_docker_command();
+        command
+            .arg("-i")
+            .args(["-a", "stdin", "-a", "stdout", "-a", "stderr"])
+            .arg("--rm")
+            .arg(channel.to_container_name())
+            .arg("worker")
+            .arg("/playground");
+        command
+    }
+}
+
+impl Channel {
+    fn to_container_name(self) -> &'static str {
+        match self {
+            Channel::Stable => "rust-stable",
+            Channel::Beta => "rust-beta",
+            Channel::Nightly => "rust-nightly",
+        }
+    }
+}
+
 pub type Result<T, E = Error> = ::std::result::Result<T, E>;
 
 #[derive(Debug, Snafu)]
@@ -988,6 +1051,7 @@ mod tests {
 
     async fn new_coordinator() -> Result<Coordinator<impl Backend>> {
         Coordinator::new(TestBackend::new()).await
+        //Coordinator::new_docker().await
     }
 
     fn new_compile_request() -> CompileRequest {
@@ -1207,6 +1271,29 @@ mod tests {
         Ok(())
     }
 
+    #[tokio::test]
+    #[snafu::report]
+    async fn test_compile_wasm() -> Result<()> {
+        // cargo-wasm only exists inside the container
+        let coordinator = Coordinator::new_docker().await?;
+
+        let response = coordinator
+            .compile(new_compile_wasm_request())
+            .with_timeout()
+            .await
+            .unwrap();
+
+        assert!(response.success, "stderr: {}", response.stderr);
+        assert_contains!(
+            response.code,
+            r#"(func $inc (export "inc") (type $t0) (param $p0 i32) (result i32)"#
+        );
+
+        coordinator.shutdown().await?;
+
+        Ok(())
+    }
+
     trait TimeoutExt: Future + Sized {
         #[allow(clippy::type_complexity)]
         fn with_timeout(