Build and push Docker image to Gitlab's registry.

.gitlab-ci.yml

@@ -185,6 +185,39 @@ windows-msvc-cng:
   variables:
     CFLAGS: "" # Silence some C warnings when compiling with MSVC
 
+docker-build-push:
+  # Official docker image.
+  image: docker:stable
+  stage: build
+  services:
+    - docker:dind
+  tags:
+    - docker
+    - self-hosted
+  before_script:
+    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
+  script:
+    - >
+      docker build
+      --no-cache
+      --target sq
+      --tag "$IMAGE":latest
+      .
+    # smoke test
+    - docker run "$IMAGE":latest --help
+    - docker push "$IMAGE":latest
+  after_script: []
+  only:
+    refs:
+      - /docker/i # refs containing 'docker' keyword
+      - tags
+      - web
+      - schedules
+  variables:
+    CI_REGISTRY: "registry.gitlab.com"
+    IMAGE: "$CI_REGISTRY/sequoia-pgp/sequoia"
+    DOCKER_HOST: tcp://docker:2376
+
 variables:
   DEBIAN_FRONTEND: noninteractive
   CARGO_HOME: $CI_PROJECT_DIR/../cargo

Dockerfile

@@ -0,0 +1,60 @@
+# See https://gitlab.com/sequoia-pgp/sequoia/-/blob/main/README.md#debian
+# for system requirements
+FROM debian:bookworm AS build
+
+# create a sandbox user for the build (in ~builder) and install (in /opt)
+# give it permissions to the build dir and home
+# upgrade everything
+# add dependencies, as specified by the Sequoia README.md file
+RUN groupadd builder && \
+    useradd --no-log-init --create-home --gid builder builder && \
+    apt-get update && \
+    apt-get upgrade --assume-yes && \
+    apt-get install --assume-yes --no-install-recommends \
+        ca-certificates \
+        capnproto \
+        cargo \
+        git \
+        libclang-dev \
+        libsqlite3-dev \
+        libssl-dev \
+        make \
+        nettle-dev \
+        pkg-config \
+        rustc \
+        && \
+    apt-get clean && \
+    chown builder /opt
+
+COPY --chown=builder:builder . /home/builder/sequoia
+
+# switch to the sandbox user
+USER builder
+
+# retry build because cargo sometimes segfaults during download (#918854)
+#
+# the `build-release` target is used instead of the default because
+# `install` calls it after anyways
+RUN cd /home/builder/sequoia && \
+    CARGO_TARGET_DIR=target cargo build -p sequoia-sq --release && \
+    install --strip -D --target-directory /opt/usr/local/bin \
+                  target/release/sq
+
+FROM debian:bookworm-slim AS sq-base
+
+RUN groupadd user && \
+    useradd --no-log-init -g user user && \
+    mkdir /home/user && \
+    chown -R user:user /home/user && \
+    apt-get update && \
+    apt-get upgrade --assume-yes && \
+    apt-get install --assume-yes ca-certificates libssl3 libsqlite3-0 && \
+    apt-get clean && \
+    rm -fr -- /var/lib/apt/lists/* /var/cache/*
+
+FROM sq-base AS sq
+
+COPY --from=build /opt/usr/local/bin/sq /usr/local/bin/sq
+COPY --from=build /etc/ssl/certs /etc/ssl/certs
+
+ENTRYPOINT ["/usr/local/bin/sq"]