Dockerfile.uring

# VectorMBE — multi-stage build with io_uring support
#
# Produces a minimal Debian bookworm-slim image. The build stage compiles from
# source so there are no pre-built artifact requirements on the host.
#
# io_uring requirements:
#   - Host kernel >= 5.1 (io_uring available); >= 5.10 recommended (stable ABI)
#   - Docker seccomp profile must allow syscalls 425/426/427 (io_uring_setup /
#     io_uring_enter / io_uring_register). Docker 20.10.18+ allows these by
#     default. For older Docker, use --security-opt seccomp=seccomp-uring.json
#     or see docker-compose.uring.yml.
#
# Build:
#   docker build -f Dockerfile.uring -t radsilent/vectormbe:uring .
#
# Run (minimal):
#   docker run --rm -p 8080:8080 \
#     -e VECTORMBE_TELEMETRY_LOG=/data/telemetry.log \
#     -v vectormbe_telemetry:/data \
#     --security-opt seccomp=seccomp-uring.json \
#     --ulimit memlock=-1 \
#     radsilent/vectormbe:uring
#
# Or use docker-compose.uring.yml for the full stack.

# ── Stage 1: dependency cache ──────────────────────────────────────────────────
# Separate stage for Cargo dep compilation (including LibTorch download) so
# that source changes don't bust the slow dependency layer.
FROM rust:1.82-bookworm AS deps

# Build dependencies for ring build, SSL, and LibTorch extraction
RUN apt-get update && apt-get install -y --no-install-recommends \
    libssl-dev \
    pkg-config \
    cmake \
    python3 \
    curl \
    ca-certificates \
    unzip \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build

# Copy workspace manifests only — source is NOT copied yet so the dep
# compilation layer is not invalidated on code changes.
COPY Cargo.toml Cargo.lock ./
COPY vectormbed/Cargo.toml           vectormbed/Cargo.toml
COPY vectormbe-cli/Cargo.toml        vectormbe-cli/Cargo.toml
COPY vectormbe-keytool/Cargo.toml    vectormbe-keytool/Cargo.toml
COPY vectormbe-wasm/Cargo.toml       vectormbe-wasm/Cargo.toml
COPY src-tauri/Cargo.toml            src-tauri/Cargo.toml

# Stub source files — just enough for Cargo to resolve the workspace graph and
# compile all dependencies. The real source is compiled in the next stage.
RUN mkdir -p src \
             vectormbed/src \
             vectormbe-cli/src \
             vectormbe-keytool/src \
             vectormbe-wasm/src \
             src-tauri/src && \
    echo 'pub fn placeholder() {}' > src/lib.rs && \
    printf 'fn main() {}\n'        > vectormbed/src/main.rs && \
    printf 'fn main() {}\n'        > vectormbe-cli/src/main.rs && \
    printf 'fn main() {}\n'        > vectormbe-keytool/src/main.rs && \
    echo 'pub fn placeholder() {}' > vectormbe-wasm/src/lib.rs && \
    echo 'pub fn placeholder() {}' > src-tauri/src/lib.rs && \
    printf 'fn main() {}\n'        > src-tauri/src/main.rs

# Compile dependencies only (-p vectormbed pulls in the entire dep graph).
# This also triggers the tch download-libtorch feature which fetches ~700 MB
# of LibTorch CPU libraries into the build cache.
# Set TORCH_CUDA_VERSION=cu118 (or cu121 etc.) before this line for GPU support.
RUN cargo build --release -p vectormbed 2>&1 | \
    grep -E "^(Compiling|Downloading|error)" || true

# ── Stage 2: application build ─────────────────────────────────────────────────
FROM deps AS builder

# Remove stub sources, copy real source tree
RUN rm -rf src vectormbed/src vectormbe-cli/src vectormbe-keytool/src \
           vectormbe-wasm/src src-tauri/src

COPY src             src
COPY vectormbed      vectormbed
COPY vectormbe-cli   vectormbe-cli
COPY vectormbe-keytool vectormbe-keytool
COPY vectormbe-wasm  vectormbe-wasm
COPY src-tauri       src-tauri
COPY mcp             mcp

# Force rebuild of the workspace binary (deps are already compiled above).
RUN touch vectormbed/src/main.rs && \
    cargo build --release -p vectormbed

# Collect LibTorch shared libraries to a single well-known path for the COPY
# instruction in the runtime stage (COPY does not support glob in directory).
RUN mkdir -p /build/libtorch-export && \
    find /build/target/release/build -path "*/torch-sys*/out/libtorch/libtorch/lib" \
         -type d \
         -exec cp -a {}/ /build/libtorch-export/ \; && \
    echo "LibTorch libraries collected:" && ls /build/libtorch-export/*.so 2>/dev/null | wc -l

# Verify io_uring is available in the compiled binary
RUN nm -D /build/target/release/vectormbed | grep -c "io_uring" && \
    echo "io_uring symbols confirmed in binary"

# ── Stage 3: runtime ───────────────────────────────────────────────────────────
FROM debian:bookworm-slim AS runtime

LABEL org.opencontainers.image.title="VectorMBE"
LABEL org.opencontainers.image.description="Neuro-symbolic MBSE tool with io_uring telemetry"
LABEL org.opencontainers.image.vendor="Vector Stream Systems LLC"
LABEL vectormbe.io_uring="enabled"
LABEL vectormbe.kernel_requirement=">=5.1"

# Runtime deps: SSL for HTTP clients, libgomp for LibTorch OpenMP, curl for
# the healthcheck.
RUN apt-get update && apt-get install -y --no-install-recommends \
    libssl3 \
    libgomp1 \
    ca-certificates \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Dedicated service user
RUN useradd -m -u 1000 -s /bin/sh vectormbe

WORKDIR /app

# Binary
COPY --from=builder /build/target/release/vectormbed /usr/local/bin/vectormbed

# LibTorch shared libraries (CPU). For GPU, use docker-compose.uring.gpu.yml
# and a CUDA-enabled LibTorch variant.
COPY --from=builder /build/libtorch-export/ /usr/local/lib/libtorch/

# Demo data (loaded at startup for scenario seeding)
COPY data/demo/ /app/data/demo/

# ── Runtime environment ────────────────────────────────────────────────────────

ENV LD_LIBRARY_PATH=/usr/local/lib/libtorch
ENV VECTORMBE_HOST=0.0.0.0
ENV VECTORMBE_PORT=8080
ENV VECTORMBE_REQUIRE_TORCH_GPU=false
ENV RUST_LOG=info

# io_uring telemetry sink.
# Set VECTORMBE_TELEMETRY_LOG to a path inside a mounted volume to persist
# telemetry frames to disk via io_uring. Leave unset to disable disk logging.
# Example: VECTORMBE_TELEMETRY_LOG=/data/telemetry/telemetry.log
ENV VECTORMBE_TELEMETRY_LOG=
ENV VECTORMBE_TELEMETRY_RING_ENTRIES=512

# Create telemetry directory (may be overridden by a volume mount)
RUN mkdir -p /data/telemetry && chown vectormbe:vectormbe /data/telemetry

# Runtime checkpoint storage
RUN mkdir -p /app/data && chown -R vectormbe:vectormbe /app/data

USER vectormbe

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=10s --start-period=90s --retries=3 \
    CMD curl -sf http://localhost:8080/telemetry/status | grep -q '"backend":"io_uring"' || exit 1

CMD ["/usr/local/bin/vectormbed"]