Dockerfile.rbuilder

# syntax=docker/dockerfile:1.7
# =============================================================================
#  rbuilder, built from source at a pinned commit.
# =============================================================================
#  DEFAULT SOURCE: the Boost+ fork
#      https://github.com/hackingdecentralized/rbuilder  branch boost+
#      pinned at db8e5b57f7d3d086131eb9f48502fde85763fae6
#
#  That branch forks the official Flashbots rbuilder at
#  6037fa728b13bf1806e16fff2586414216f6b8fa (which is also the fork's
#  `develop` head, so the two share an exact merge base) and adds the Boost+
#  work: a third SpecificBuilderConfig variant `DefaultBuilder`
#  (TOML: algo = "default-builder"), a rewritten parallel_builder
#  (conflict_resolvers, compute_budget, default_helper) and extra backtest
#  instrumentation (--graph-stats-csv, --candidate-threads, CSV export).
#
#  To build the official upstream rbuilder instead, set in .env:
#      RBUILDER_REPO=https://github.com/flashbots/rbuilder.git
#      RBUILDER_COMMIT=6037fa728b13bf1806e16fff2586414216f6b8fa
#  That upstream revision does not contain `default-builder`; use a baseline-
#  only config with it. The image tag embeds the commit, so both images can
#  coexist.
# =============================================================================
#  Produces one image containing everything the devnet needs:
#
#    /usr/local/bin/rbuilder                   live builder
#    /usr/local/bin/backtest-fetch             pinned-fork history fetcher
#    /usr/local/bin/backtest-build-block       pinned-fork replay driver
#    /usr/local/bin/backtest-build-range       pinned-fork range replay
#    /usr/local/bin/orderflow-report-decoder   order-flow trace decoder
#    /usr/local/bin/local-backtest             local devnet -> backtest sqlite
#
#  This project does not patch the checkout: the only build-time change is
#  adding the small `local-backtest` crate to the cargo workspace. The rbuilder
#  binaries are exactly what the pinned RBUILDER_COMMIT produces and therefore
#  already contain the Boost+ changes.
#
#  Expect a long first build (upstream rbuilder pulls in the whole reth tree).
#  Cargo registry/git and target directories are BuildKit cache mounts, so
#  rebuilds after a commit bump are much faster.
# =============================================================================

ARG RUST_IMAGE=rust:1.95-bookworm
ARG RUNTIME_IMAGE=debian:bookworm-20260713-slim

# -----------------------------------------------------------------------------
# Stage 1: fetch the pinned rbuilder source and graft in local-backtest
# -----------------------------------------------------------------------------
FROM ${RUST_IMAGE} AS source

ARG RBUILDER_REPO=https://github.com/hackingdecentralized/rbuilder.git
ARG RBUILDER_COMMIT=db8e5b57f7d3d086131eb9f48502fde85763fae6

WORKDIR /src
RUN set -eux; \
    git init -q rbuilder; \
    cd rbuilder; \
    git remote add origin "${RBUILDER_REPO}"; \
    git fetch -q --depth 1 origin "${RBUILDER_COMMIT}"; \
    git checkout -q FETCH_HEAD; \
    git submodule update --init --recursive --depth 1 || true; \
    echo "rbuilder checked out at $(git rev-parse HEAD)"; \
    test "$(git rev-parse HEAD)" = "${RBUILDER_COMMIT}"

# The local replay helper lives outside the upstream tree in this repo and is
# copied in as an extra workspace member.
COPY local-backtest /src/rbuilder/local-backtest

RUN set -eux; \
    cd /src/rbuilder; \
    # Insert the crate as the first workspace member. `^members = \[$` cannot
    # match `default-members = [`, so only the real member list is touched.
    sed -i '0,/^members = \[$/s//members = [\n    "local-backtest",/' Cargo.toml; \
    grep -q '"local-backtest"' Cargo.toml; \
    # Pin the toolchain to the one baked into the pinned rust base image
    # instead of whatever "stable" resolves to on the day of the build.
    printf '[toolchain]\nchannel = "%s"\ncomponents = ["rustfmt", "clippy"]\n' \
        "$(rustc --version | awk '{print $2}')" > rust-toolchain.toml; \
    cat rust-toolchain.toml

# -----------------------------------------------------------------------------
# Stage 2: compile
# -----------------------------------------------------------------------------
FROM ${RUST_IMAGE} AS builder

# libprotobuf-dev is NOT optional here. rbuilder's build script generates the
# bloxroute gRPC bindings with
#     tonic_build::configure().compile_protos(&["proto/bloxroute.proto"], &["proto"])
# and that proto imports google/protobuf/timestamp.proto. tonic-build passes
# only rbuilder's own `proto/` as an include dir, so the well-known types have
# to come from protoc's default include path (/usr/include/google/protobuf).
# On Debian those files ship in libprotobuf-dev, which protobuf-compiler merely
# *Recommends* — so with --no-install-recommends protoc is installed without
# them and the build fails with:
#     protoc failed: google/protobuf/timestamp.proto: File not found.
# Naming it explicitly keeps --no-install-recommends (small image) while making
# the real dependency visible.
RUN set -eux; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
        clang libclang-dev cmake protobuf-compiler libprotobuf-dev pkg-config libssl-dev; \
    rm -rf /var/lib/apt/lists/*; \
    # Fail here, loudly, rather than 11 minutes into the cargo build.
    test -f /usr/include/google/protobuf/timestamp.proto

WORKDIR /app
COPY --from=source /src/rbuilder /app

# Adding Cargo.lock updates for the new workspace member requires a writable
# lock file; --locked is therefore not used here.
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
    --mount=type=cache,target=/app/target,sharing=locked \
    set -eux; \
    # local-backtest FIRST, deliberately. It depends on the rbuilder library, so
    # this compiles the expensive part of the tree and then immediately checks
    # the one crate in this repo that can actually be wrong. Building rbuilder's
    # binaries first would instead link five optimized binaries before ever
    # looking at our code, so a one-line type error costs the whole link stage.
    # The rbuilder library is shared, so nothing is compiled twice.
    cargo build --release --package local-backtest --bin local-backtest; \
    cargo build --release \
        --package rbuilder \
        --bin rbuilder \
        --bin backtest-fetch \
        --bin backtest-build-block \
        --bin backtest-build-range \
        --bin orderflow-report-decoder; \
    mkdir -p /out; \
    cp target/release/rbuilder \
       target/release/backtest-fetch \
       target/release/backtest-build-block \
       target/release/backtest-build-range \
       target/release/orderflow-report-decoder \
       target/release/local-backtest \
       /out/; \
    ls -l /out

# -----------------------------------------------------------------------------
# Stage 3: runtime
# -----------------------------------------------------------------------------
# A slim Debian (rather than distroless) so the container has bash, curl, jq
# and sqlite3 for the entrypoint, healthchecks, replay scripts and debugging.
FROM ${RUNTIME_IMAGE} AS runtime

ARG RBUILDER_REPO=https://github.com/hackingdecentralized/rbuilder.git
ARG RBUILDER_COMMIT=db8e5b57f7d3d086131eb9f48502fde85763fae6
LABEL org.opencontainers.image.title="boostplus-devnet/rbuilder" \
      org.opencontainers.image.source="${RBUILDER_REPO}" \
      org.opencontainers.image.revision="${RBUILDER_COMMIT}" \
      org.opencontainers.image.description="Boost+ rbuilder artifact for a local test devnet. Test keys only."

RUN set -eux; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
        ca-certificates bash curl jq sqlite3 gettext-base libssl3 procps; \
    rm -rf /var/lib/apt/lists/*

COPY --from=builder /out/rbuilder                 /usr/local/bin/rbuilder
COPY --from=builder /out/backtest-fetch           /usr/local/bin/backtest-fetch
COPY --from=builder /out/backtest-build-block     /usr/local/bin/backtest-build-block
COPY --from=builder /out/backtest-build-range     /usr/local/bin/backtest-build-range
COPY --from=builder /out/orderflow-report-decoder /usr/local/bin/orderflow-report-decoder
COPY --from=builder /out/local-backtest           /usr/local/bin/local-backtest

ENV RBUILDER_COMMIT=${RBUILDER_COMMIT}
WORKDIR /app

EXPOSE 8645 6060 6070
ENTRYPOINT ["/usr/local/bin/rbuilder"]
CMD ["version"]