From e589388755f0edaf77bda5996ac052fde8e1e155 Mon Sep 17 00:00:00 2001
From: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
Date: Thu, 22 May 2025 12:49:09 +1200
Subject: [PATCH 1/5] chore: `Dockerfile` use HereDoc syntax

---
 Dockerfile | 136 +++++++++++++++++++++++++++++++----------------------
 1 file changed, 80 insertions(+), 56 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 784b5c5..2e7cf37 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,7 @@
 # syntax=docker/dockerfile:1
 FROM ubuntu:noble
+SHELL ["/bin/bash", "-eux", "-o", "pipefail", "-c"]
+
 LABEL maintainer="Eirik Albrigtsen <sszynrae@gmail.com>"
 LABEL org.opencontainers.image.create="$(date --utc --iso-8601=seconds)"
 LABEL org.opencontainers.image.documentation="https://github.com/clux/muslrust"
@@ -15,91 +17,113 @@ LABEL org.opencontainers.image.description="Docker environment for building musl
 # - file - needed by rustup.sh install
 # - automake autoconf libtool - support crates building C deps as part cargo build
 # NB: does not include cmake atm
-RUN apt-get update && apt-get install -y \
-  musl-dev \
-  musl-tools \
-  file \
-  git \
-  openssh-client \
-  make \
-  cmake \
-  g++ \
-  curl \
-  pkgconf \
-  ca-certificates \
-  automake \
-  autoconf \
-  libtool \
-  libprotobuf-dev \
-  unzip \
-  --no-install-recommends && \
+RUN <<HEREDOC
+  apt-get update
+  apt-get install --no-install-recommends -y \
+      musl-dev \
+      musl-tools \
+      file \
+      git \
+      openssh-client \
+      make \
+      cmake \
+      g++ \
+      curl \
+      pkgconf \
+      ca-certificates \
+      automake \
+      autoconf \
+      libtool \
+      libprotobuf-dev \
+      unzip
+
   rm -rf /var/lib/apt/lists/*
+HEREDOC
 
 # Common arg for arch used in urls and triples
 ARG AARCH
 # Install rust using rustup
 ARG CHANNEL
-ENV RUSTUP_VER="1.28.2" \
-    RUST_ARCH="${AARCH}-unknown-linux-gnu" \
-    CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
+ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
 
-RUN curl "https://static.rust-lang.org/rustup/archive/${RUSTUP_VER}/${RUST_ARCH}/rustup-init" -o rustup-init && \
-    chmod +x rustup-init && \
-    ./rustup-init -y --default-toolchain ${CHANNEL} --profile minimal --no-modify-path && \
-    rm rustup-init && \
-    ~/.cargo/bin/rustup target add ${AARCH}-unknown-linux-musl
+ARG RUSTUP_VER="1.28.2"
+ARG RUST_ARCH="${AARCH}-unknown-linux-gnu"
+RUN <<HEREDOC
+    curl -fsSL -o rustup-init "https://static.rust-lang.org/rustup/archive/${RUSTUP_VER}/${RUST_ARCH}/rustup-init"
+    chmod +x rustup-init
+    ./rustup-init -y --default-toolchain "${CHANNEL}" --profile minimal --no-modify-path
+    rm rustup-init
+    ~/.cargo/bin/rustup target add "${AARCH}-unknown-linux-musl"
+HEREDOC
 
 # Allow non-root access to cargo
 RUN chmod a+X /root
 
 # Convenience list of versions and variables for compilation later on
 # This helps continuing manually if anything breaks.
-ENV ZLIB_VER="1.3.1" \
-    SQLITE_VER="3490200" \
-    PROTOBUF_VER="31.0" \
-    SCCACHE_VER="0.10.0" \
-    CC=musl-gcc \
+ENV CC=musl-gcc \
     PREFIX=/musl \
-    PATH=/usr/local/bin:/root/.cargo/bin:$PATH \
+    PATH=/usr/local/bin:/root/.cargo/bin:${PATH} \
     PKG_CONFIG_PATH=/usr/local/lib/pkgconfig \
-    LD_LIBRARY_PATH=$PREFIX
+    LD_LIBRARY_PATH=${PREFIX}
 
-# Install a more recent release of protoc (protobuf-compiler in jammy is 4 years old and misses some features)
-RUN cd /tmp && \
-    curl -sSL https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_VER}/protoc-${PROTOBUF_VER}-linux-$([ "$AARCH" = "aarch64" ] && echo "aarch_64" || echo "$AARCH").zip -o protoc.zip && \
-    unzip protoc.zip && \
-    cp bin/protoc /usr/bin/protoc && \
+# Install a more recent release of protoc (protobuf-compiler in Ubuntu Noble is v21.12 from Dec 2022)
+ARG PROTOBUF_VER="31.0"
+RUN <<HEREDOC
+    ASSET_NAME="protoc-${PROTOBUF_VER}-linux-$([ "${AARCH}" = "aarch64" ] && echo "aarch_64" || echo "{$AARCH}")"
+    curl -fsSL -o /tmp/protoc.zip "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_VER}/${ASSET_NAME}.zip"
+
+    cd /tmp && unzip protoc.zip
+    cp bin/protoc /usr/bin/protoc
     rm -rf *
+HEREDOC
 
 # Install prebuilt sccache based on platform
-RUN curl -sSL https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VER}/sccache-v${SCCACHE_VER}-${AARCH}-unknown-linux-musl.tar.gz | tar xz && \
-    mv sccache-v${SCCACHE_VER}-*-unknown-linux-musl/sccache /usr/local/bin/ && \
-    chmod +x /usr/local/bin/sccache && \
+ARG SCCACHE_VER="0.10.0"
+RUN <<HEREDOC
+    ASSET_NAME="sccache-v${SCCACHE_VER}-${AARCH}-unknown-linux-musl"
+    curl -fsSL "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VER}/${ASSET_NAME}.tar.gz" | tar -xz
+    mv "${ASSET_NAME}/sccache" /usr/local/bin/
+    chmod +x /usr/local/bin/sccache
     rm -rf sccache-v${SCCACHE_VER}-*-unknown-linux-musl
+HEREDOC
 
 # Build zlib
-RUN curl -sSL https://zlib.net/zlib-$ZLIB_VER.tar.gz | tar xz && \
-    cd zlib-$ZLIB_VER && \
-    CC="musl-gcc -fPIC -pie" LDFLAGS="-L$PREFIX/lib" CFLAGS="-I$PREFIX/include" ./configure --static --prefix=$PREFIX && \
-    make -j$(nproc) && make install && \
-    cd .. && rm -rf zlib-$ZLIB_VER
+ARG ZLIB_VER="1.3.1"
+RUN <<HEREDOC
+    curl -fsSL "https://zlib.net/zlib-${ZLIB_VER}.tar.gz" | tar -xz
+    cd "zlib-${ZLIB_VER}"
+
+    CC="musl-gcc -fPIC -pie"
+    CFLAGS="-I${PREFIX}/include"
+    LDFLAGS="-L${PREFIX}/lib"
+    ./configure --static --prefix="${PREFIX}"
+    make -j$(nproc) && make install
+
+    cd .. && rm -rf "zlib-${ZLIB_VER}"
+HEREDOC
 
 # Build libsqlite3 using same configuration as the alpine linux main/sqlite package
-RUN curl -sSL https://www.sqlite.org/2025/sqlite-autoconf-$SQLITE_VER.tar.gz | tar xz && \
-    cd sqlite-autoconf-$SQLITE_VER && \
-    CFLAGS="-DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS5 -DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_SECURE_DELETE -DSQLITE_ENABLE_UNLOCK_NOTIFY -DSQLITE_ENABLE_RTREE -DSQLITE_USE_URI -DSQLITE_ENABLE_DBSTAT_VTAB -DSQLITE_ENABLE_JSON1" \
-    CC="musl-gcc -fPIC -pie" \
-    ./configure --prefix=$PREFIX --host=x86_64-unknown-linux-musl --enable-threadsafe --disable-shared && \
-    make && make install && \
-    cd .. && rm -rf sqlite-autoconf-$SQLITE_VER
-
-ENV PATH=/root/.cargo/bin:$PREFIX/bin:$PATH \
+ARG SQLITE_VER="3490200"
+RUN <<HEREDOC
+    curl -fsSL "https://www.sqlite.org/2025/sqlite-autoconf-${SQLITE_VER}.tar.gz" | tar -xz
+    cd "sqlite-autoconf-${SQLITE_VER}"
+
+    CC="musl-gcc -fPIC -pie"
+    CFLAGS="-DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS5 -DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_SECURE_DELETE -DSQLITE_ENABLE_UNLOCK_NOTIFY -DSQLITE_ENABLE_RTREE -DSQLITE_USE_URI -DSQLITE_ENABLE_DBSTAT_VTAB -DSQLITE_ENABLE_JSON1"
+    ./configure --prefix="${PREFIX}" --host=x86_64-unknown-linux-musl --enable-threadsafe --disable-shared
+    make && make install
+
+    cd .. && rm -rf "sqlite-autoconf-${SQLITE_VER}"
+HEREDOC
+
+ENV PATH=/root/.cargo/bin:${PREFIX}/bin:${PATH} \
     RUSTUP_HOME=/root/.rustup \
     CARGO_BUILD_TARGET=${AARCH}-unknown-linux-musl \
     CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-Clink-self-contained=yes -Clinker=rust-lld -Ctarget-feature=+crt-static" \
     PKG_CONFIG_ALLOW_CROSS=true \
     PKG_CONFIG_ALL_STATIC=true \
-    PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig \
+    PKG_CONFIG_PATH=${PREFIX}/lib/pkgconfig \
     PG_CONFIG_X86_64_UNKNOWN_LINUX_GNU=/usr/bin/pg_config \
     PG_CONFIG_AARCH64_UNKNOWN_LINUX_GNU=/usr/bin/pg_config \
     # Rust libz-sys support

From 600eb1ab2430d22c961216b1201a935d4ae2f7d5 Mon Sep 17 00:00:00 2001
From: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
Date: Thu, 22 May 2025 15:19:00 +1200
Subject: [PATCH 2/5] chore: Revise `Dockerfile`

- Remove `ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse` it's the default since Rust 1.70.0 (June 2023)
- Revise the rustup `RUN` and relocate relevant changes associated to it with additional PR references for maintainers as docs.
- Handle `PATH` updates properly, remove any redundancy.
- Remove `LD_LIBRARY_PATH`, it was misconfigured and seems redundant?
- Improve the `protoc` + `sccache` bin retrieval + extraction `RUN` instructions.
- Change `zlib` + `sqlite` steps into their own build stages. They each extract the source into their respective `WORKDIR`. No cleanup necessary due to separate stage.
---
 Dockerfile | 126 +++++++++++++++++++++++++++++------------------------
 1 file changed, 69 insertions(+), 57 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 2e7cf37..47acc8f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,108 +18,120 @@ LABEL org.opencontainers.image.description="Docker environment for building musl
 # - automake autoconf libtool - support crates building C deps as part cargo build
 # NB: does not include cmake atm
 RUN <<HEREDOC
-  apt-get update
-  apt-get install --no-install-recommends -y \
-      musl-dev \
-      musl-tools \
-      file \
-      git \
-      openssh-client \
-      make \
-      cmake \
-      g++ \
-      curl \
-      pkgconf \
-      ca-certificates \
-      automake \
-      autoconf \
-      libtool \
-      libprotobuf-dev \
-      unzip
-
-  rm -rf /var/lib/apt/lists/*
+    apt-get update
+    apt-get install --no-install-recommends -y \
+        musl-dev \
+        musl-tools \
+        file \
+        git \
+        openssh-client \
+        make \
+        cmake \
+        g++ \
+        curl \
+        pkgconf \
+        ca-certificates \
+        automake \
+        autoconf \
+        libtool \
+        libprotobuf-dev \
+        unzip
+
+    rm -rf /var/lib/apt/lists/*
 HEREDOC
 
 # Common arg for arch used in urls and triples
 ARG AARCH
+
 # Install rust using rustup
 ARG CHANNEL
-ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
-
+# Use specific version of Rustup:
+# https://github.com/clux/muslrust/pull/63
 ARG RUSTUP_VER="1.28.2"
-ARG RUST_ARCH="${AARCH}-unknown-linux-gnu"
+# Better support for running container user as non-root:
+# https://github.com/clux/muslrust/pull/101
+# Uses `--no-modify-path` with PATH update + chmod on `/root` for access
+ENV CARGO_BUILD_TARGET=${AARCH}-unknown-linux-musl
+ENV RUSTUP_HOME=/root/.rustup
+ENV PATH=/root/.cargo/bin:${PATH}
 RUN <<HEREDOC
+    # Allow non-root access to cargo/rustup:
+    chmod a+X /root
+
+    RUST_ARCH="${AARCH}-unknown-linux-gnu"
     curl -fsSL -o rustup-init "https://static.rust-lang.org/rustup/archive/${RUSTUP_VER}/${RUST_ARCH}/rustup-init"
     chmod +x rustup-init
-    ./rustup-init -y --default-toolchain "${CHANNEL}" --profile minimal --no-modify-path
+
+    ./rustup-init -y \
+      --default-toolchain "${CHANNEL}" \
+      --profile minimal \
+      --no-modify-path \
+      --target "${AARCH}-unknown-linux-musl"
+
     rm rustup-init
-    ~/.cargo/bin/rustup target add "${AARCH}-unknown-linux-musl"
 HEREDOC
 
-# Allow non-root access to cargo
-RUN chmod a+X /root
-
-# Convenience list of versions and variables for compilation later on
+# Convenience list of variables for later compilation stages.
 # This helps continuing manually if anything breaks.
 ENV CC=musl-gcc \
     PREFIX=/musl \
-    PATH=/usr/local/bin:/root/.cargo/bin:${PATH} \
-    PKG_CONFIG_PATH=/usr/local/lib/pkgconfig \
-    LD_LIBRARY_PATH=${PREFIX}
+    PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
 
-# Install a more recent release of protoc (protobuf-compiler in Ubuntu Noble is v21.12 from Dec 2022)
+# Install a more recent release of protoc
+# NOTE: `protobuf-compiler` in Ubuntu Noble is v21.12 (Dec 2022):
+# https://launchpad.net/ubuntu/noble/+package/protobuf-compiler
 ARG PROTOBUF_VER="31.0"
 RUN <<HEREDOC
     ASSET_NAME="protoc-${PROTOBUF_VER}-linux-$([ "${AARCH}" = "aarch64" ] && echo "aarch_64" || echo "{$AARCH}")"
-    curl -fsSL -o /tmp/protoc.zip "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_VER}/${ASSET_NAME}.zip"
+    curl -fsSL -o protoc.zip "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_VER}/${ASSET_NAME}.zip"
 
-    cd /tmp && unzip protoc.zip
-    cp bin/protoc /usr/bin/protoc
-    rm -rf *
+    unzip -j -d /usr/local/bin protoc.zip bin/protoc
+    rm -rf protoc.zip
 HEREDOC
 
 # Install prebuilt sccache based on platform
 ARG SCCACHE_VER="0.10.0"
 RUN <<HEREDOC
     ASSET_NAME="sccache-v${SCCACHE_VER}-${AARCH}-unknown-linux-musl"
-    curl -fsSL "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VER}/${ASSET_NAME}.tar.gz" | tar -xz
-    mv "${ASSET_NAME}/sccache" /usr/local/bin/
-    chmod +x /usr/local/bin/sccache
-    rm -rf sccache-v${SCCACHE_VER}-*-unknown-linux-musl
+    curl -fsSL "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VER}/${ASSET_NAME}.tar.gz" \
+      | tar -xz -C /usr/local/bin --strip-components=1 --no-same-owner "${ASSET_NAME}/sccache"
 HEREDOC
 
 # Build zlib
+FROM base AS build-zlib
 ARG ZLIB_VER="1.3.1"
+WORKDIR /src/zlib
 RUN <<HEREDOC
-    curl -fsSL "https://zlib.net/zlib-${ZLIB_VER}.tar.gz" | tar -xz
-    cd "zlib-${ZLIB_VER}"
+    curl -fsSL "https://zlib.net/zlib-${ZLIB_VER}.tar.gz" | tar -xz --strip-components=1
+
+    export CC="musl-gcc -fPIC -pie"
+    export CFLAGS="-I${PREFIX}/include"
+    export LDFLAGS="-L${PREFIX}/lib"
 
-    CC="musl-gcc -fPIC -pie"
-    CFLAGS="-I${PREFIX}/include"
-    LDFLAGS="-L${PREFIX}/lib"
     ./configure --static --prefix="${PREFIX}"
     make -j$(nproc) && make install
-
-    cd .. && rm -rf "zlib-${ZLIB_VER}"
 HEREDOC
 
 # Build libsqlite3 using same configuration as the alpine linux main/sqlite package
+FROM base AS build-sqlite
 ARG SQLITE_VER="3490200"
+WORKDIR /src/sqlite
 RUN <<HEREDOC
-    curl -fsSL "https://www.sqlite.org/2025/sqlite-autoconf-${SQLITE_VER}.tar.gz" | tar -xz
-    cd "sqlite-autoconf-${SQLITE_VER}"
+    curl -fsSL "https://www.sqlite.org/2025/sqlite-autoconf-${SQLITE_VER}.tar.gz" | tar -xz --strip-components=1
+
+    export CC="musl-gcc -fPIC -pie"
+    export CFLAGS="-DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS5 -DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_SECURE_DELETE -DSQLITE_ENABLE_UNLOCK_NOTIFY -DSQLITE_ENABLE_RTREE -DSQLITE_USE_URI -DSQLITE_ENABLE_DBSTAT_VTAB -DSQLITE_ENABLE_JSON1"
 
-    CC="musl-gcc -fPIC -pie"
-    CFLAGS="-DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS5 -DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_SECURE_DELETE -DSQLITE_ENABLE_UNLOCK_NOTIFY -DSQLITE_ENABLE_RTREE -DSQLITE_USE_URI -DSQLITE_ENABLE_DBSTAT_VTAB -DSQLITE_ENABLE_JSON1"
     ./configure --prefix="${PREFIX}" --host=x86_64-unknown-linux-musl --enable-threadsafe --disable-shared
     make && make install
-
-    cd .. && rm -rf "sqlite-autoconf-${SQLITE_VER}"
 HEREDOC
 
-ENV PATH=/root/.cargo/bin:${PREFIX}/bin:${PATH} \
-    RUSTUP_HOME=/root/.rustup \
-    CARGO_BUILD_TARGET=${AARCH}-unknown-linux-musl \
+FROM base AS release
+COPY --link --from=build-zlib ${PREFIX} ${PREFIX}
+COPY --link --from=build-sqlite ${PREFIX} ${PREFIX}
+
+# NOTE: PATH prepends `${PREFIX}/bin` for `sqlite3`
+ENV PATH=${PREFIX}/bin:${PATH} \
     CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-Clink-self-contained=yes -Clinker=rust-lld -Ctarget-feature=+crt-static" \
     PKG_CONFIG_ALLOW_CROSS=true \
     PKG_CONFIG_ALL_STATIC=true \

From 538edee0f610ad19b3bf55973688acf0e3acdebf Mon Sep 17 00:00:00 2001
From: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
Date: Thu, 22 May 2025 15:39:58 +1200
Subject: [PATCH 3/5] chore: `Dockerfile` - Use a separate stage for rustup

Primary change is rustup `RUN` in it's own separate stage. This may not be as friendly to cache storage? Additionally breaking change that moved rustup and cargo install to `/opt` instead of in `/root`.
---
 Dockerfile | 85 +++++++++++++++++++++++++++++-------------------------
 1 file changed, 46 insertions(+), 39 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 47acc8f..34b1fad 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,13 +2,6 @@
 FROM ubuntu:noble
 SHELL ["/bin/bash", "-eux", "-o", "pipefail", "-c"]
 
-LABEL maintainer="Eirik Albrigtsen <sszynrae@gmail.com>"
-LABEL org.opencontainers.image.create="$(date --utc --iso-8601=seconds)"
-LABEL org.opencontainers.image.documentation="https://github.com/clux/muslrust"
-LABEL org.opencontainers.image.licenses="MIT"
-LABEL org.opencontainers.image.url="https://github.com/clux/muslrust"
-LABEL org.opencontainers.image.description="Docker environment for building musl based static rust binaries"
-
 # Required packages:
 # - musl-dev, musl-tools - the musl toolchain
 # - curl, g++, make, pkgconf, cmake - for fetching and building third party libs
@@ -43,34 +36,6 @@ HEREDOC
 # Common arg for arch used in urls and triples
 ARG AARCH
 
-# Install rust using rustup
-ARG CHANNEL
-# Use specific version of Rustup:
-# https://github.com/clux/muslrust/pull/63
-ARG RUSTUP_VER="1.28.2"
-# Better support for running container user as non-root:
-# https://github.com/clux/muslrust/pull/101
-# Uses `--no-modify-path` with PATH update + chmod on `/root` for access
-ENV CARGO_BUILD_TARGET=${AARCH}-unknown-linux-musl
-ENV RUSTUP_HOME=/root/.rustup
-ENV PATH=/root/.cargo/bin:${PATH}
-RUN <<HEREDOC
-    # Allow non-root access to cargo/rustup:
-    chmod a+X /root
-
-    RUST_ARCH="${AARCH}-unknown-linux-gnu"
-    curl -fsSL -o rustup-init "https://static.rust-lang.org/rustup/archive/${RUSTUP_VER}/${RUST_ARCH}/rustup-init"
-    chmod +x rustup-init
-
-    ./rustup-init -y \
-      --default-toolchain "${CHANNEL}" \
-      --profile minimal \
-      --no-modify-path \
-      --target "${AARCH}-unknown-linux-musl"
-
-    rm rustup-init
-HEREDOC
-
 # Convenience list of variables for later compilation stages.
 # This helps continuing manually if anything breaks.
 ENV CC=musl-gcc \
@@ -126,23 +91,65 @@ RUN <<HEREDOC
     make && make install
 HEREDOC
 
+# Install rust using rustup
+FROM base AS install-rustup
+ARG CHANNEL
+# Use specific version of Rustup:
+# https://github.com/clux/muslrust/pull/63
+ARG RUSTUP_VER="1.28.2"
+# Better support for running container user as non-root:
+# https://github.com/clux/muslrust/pull/101
+# Uses `--no-modify-path` as `PATH` is set explicitly
+ENV RUSTUP_HOME=/opt/rustup
+ENV CARGO_HOME=/opt/cargo
+RUN <<HEREDOC
+    RUST_ARCH="${AARCH}-unknown-linux-gnu"
+    curl -fsSL -o rustup-init "https://static.rust-lang.org/rustup/archive/${RUSTUP_VER}/${RUST_ARCH}/rustup-init"
+    chmod +x rustup-init
+    mkdir -p /opt/{cargo,rustup}
+
+    ./rustup-init -y \
+      --default-toolchain "${CHANNEL}" \
+      --profile minimal \
+      --no-modify-path \
+      --target "${AARCH}-unknown-linux-musl"
+
+    rm rustup-init
+HEREDOC
+
 FROM base AS release
+COPY --link --from=install-rustup /opt /opt
 COPY --link --from=build-zlib ${PREFIX} ${PREFIX}
 COPY --link --from=build-sqlite ${PREFIX} ${PREFIX}
 
-# NOTE: PATH prepends `${PREFIX}/bin` for `sqlite3`
-ENV PATH=${PREFIX}/bin:${PATH} \
-    CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-Clink-self-contained=yes -Clinker=rust-lld -Ctarget-feature=+crt-static" \
+ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-C link-self-contained=yes -C linker=rust-lld -C target-feature=+crt-static" \
     PKG_CONFIG_ALLOW_CROSS=true \
     PKG_CONFIG_ALL_STATIC=true \
     PKG_CONFIG_PATH=${PREFIX}/lib/pkgconfig \
     PG_CONFIG_X86_64_UNKNOWN_LINUX_GNU=/usr/bin/pg_config \
     PG_CONFIG_AARCH64_UNKNOWN_LINUX_GNU=/usr/bin/pg_config \
-    # Rust libz-sys support
+    # Rust `libz-sys` support:
     LIBZ_SYS_STATIC=1 \
     ZLIB_STATIC=1 \
+    # Better support for running container user as non-root:
+    # https://github.com/clux/muslrust/pull/101
+    CARGO_HOME=/opt/cargo \
+    RUSTUP_HOME=/opt/rustup \
+    # PATH prepends:
+    # - `/opt/cargo/bin` for `cargo` + `rustup`
+    # - `${PREFIX}/bin` for `sqlite3`
+    PATH=/root/.cargo/bin:${PREFIX}/bin:${PATH} \
+    # Misc:
     DEBIAN_FRONTEND=noninteractive \
     TZ=Etc/UTC
 
 # Allow ditching the -w /volume flag to docker run
 WORKDIR /volume
+
+LABEL org.opencontainers.image.authors="Eirik Albrigtsen <sszynrae@gmail.com>"
+LABEL org.opencontainers.image.create="$(date --utc --iso-8601=seconds)"
+LABEL org.opencontainers.image.documentation="https://github.com/clux/muslrust"
+LABEL org.opencontainers.image.licenses="MIT"
+LABEL org.opencontainers.image.url="https://github.com/clux/muslrust"
+LABEL org.opencontainers.image.description="Docker environment for building musl based static rust binaries"
+

From 21fd7a0cd43b1f3cbf333a8c03ffe5e740c0c144 Mon Sep 17 00:00:00 2001
From: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
Date: Thu, 22 May 2025 15:59:08 +1200
Subject: [PATCH 4/5] fix: `Dockerfile`

---
 Dockerfile | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 34b1fad..24883ff 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM ubuntu:noble
+FROM ubuntu:noble AS base
 SHELL ["/bin/bash", "-eux", "-o", "pipefail", "-c"]
 
 # Required packages:
@@ -34,14 +34,9 @@ RUN <<HEREDOC
 HEREDOC
 
 # Common arg for arch used in urls and triples
+# Effectively `uname -a` but can be used
 ARG AARCH
 
-# Convenience list of variables for later compilation stages.
-# This helps continuing manually if anything breaks.
-ENV CC=musl-gcc \
-    PREFIX=/musl \
-    PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
-
 # Install a more recent release of protoc
 # NOTE: `protobuf-compiler` in Ubuntu Noble is v21.12 (Dec 2022):
 # https://launchpad.net/ubuntu/noble/+package/protobuf-compiler
@@ -62,6 +57,12 @@ RUN <<HEREDOC
       | tar -xz -C /usr/local/bin --strip-components=1 --no-same-owner "${ASSET_NAME}/sccache"
 HEREDOC
 
+# Convenience list of variables for later compilation stages.
+# This helps continuing manually if anything breaks.
+ENV CC=musl-gcc \
+    PREFIX=/musl \
+    PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
+
 # Build zlib
 FROM base AS build-zlib
 ARG ZLIB_VER="1.3.1"
@@ -133,12 +134,13 @@ ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-C link-self-contained=ye
     ZLIB_STATIC=1 \
     # Better support for running container user as non-root:
     # https://github.com/clux/muslrust/pull/101
+    CARGO_BUILD_TARGET=${AARCH}-unknown-linux-musl \
     CARGO_HOME=/opt/cargo \
     RUSTUP_HOME=/opt/rustup \
     # PATH prepends:
     # - `/opt/cargo/bin` for `cargo` + `rustup`
     # - `${PREFIX}/bin` for `sqlite3`
-    PATH=/root/.cargo/bin:${PREFIX}/bin:${PATH} \
+    PATH=/opt/cargo/bin:${PREFIX}/bin:${PATH} \
     # Misc:
     DEBIAN_FRONTEND=noninteractive \
     TZ=Etc/UTC
@@ -147,7 +149,7 @@ ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-C link-self-contained=ye
 WORKDIR /volume
 
 LABEL org.opencontainers.image.authors="Eirik Albrigtsen <sszynrae@gmail.com>"
-LABEL org.opencontainers.image.create="$(date --utc --iso-8601=seconds)"
+#LABEL org.opencontainers.image.create="$(date --utc --iso-8601=seconds)"
 LABEL org.opencontainers.image.documentation="https://github.com/clux/muslrust"
 LABEL org.opencontainers.image.licenses="MIT"
 LABEL org.opencontainers.image.url="https://github.com/clux/muslrust"

From fa8288b6f8eb44f53d79c4a4ea2970ca6541619e Mon Sep 17 00:00:00 2001
From: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
Date: Thu, 22 May 2025 17:10:59 +1200
Subject: [PATCH 5/5] chore: `Dockerfile` - Remove requiring a `AARCH` build
 arg

---
 Dockerfile | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 24883ff..11c1a29 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,14 @@
 # syntax=docker/dockerfile:1
-FROM ubuntu:noble AS base
-SHELL ["/bin/bash", "-eux", "-o", "pipefail", "-c"]
+ARG BASE_IMAGE=ubuntu:noble
+
+# Mapping ARM64 / AMD64 naming conventions to equivalent `uname -a` output (build target specific):
+FROM ${BASE_IMAGE} AS base-amd64
+ENV DOCKER_TARGET_ARCH=x86_64
+FROM ${BASE_IMAGE} AS base-arm64
+ENV DOCKER_TARGET_ARCH=aarch64
 
+FROM base-${TARGETARCH} AS base
+SHELL ["/bin/bash", "-eux", "-o", "pipefail", "-c"]
 # Required packages:
 # - musl-dev, musl-tools - the musl toolchain
 # - curl, g++, make, pkgconf, cmake - for fetching and building third party libs
@@ -33,26 +40,24 @@ RUN <<HEREDOC
     rm -rf /var/lib/apt/lists/*
 HEREDOC
 
-# Common arg for arch used in urls and triples
-# Effectively `uname -a` but can be used
-ARG AARCH
-
-# Install a more recent release of protoc
-# NOTE: `protobuf-compiler` in Ubuntu Noble is v21.12 (Dec 2022):
-# https://launchpad.net/ubuntu/noble/+package/protobuf-compiler
+# Install a more recent release of protoc:
 ARG PROTOBUF_VER="31.0"
 RUN <<HEREDOC
-    ASSET_NAME="protoc-${PROTOBUF_VER}-linux-$([ "${AARCH}" = "aarch64" ] && echo "aarch_64" || echo "{$AARCH}")"
+    if [[ ${DOCKER_TARGET_ARCH} == 'aarch64' ]]; then
+      DOCKER_TARGET_ARCH=aarch_64
+    fi
+
+    ASSET_NAME="protoc-${PROTOBUF_VER}-linux-${DOCKER_TARGET_ARCH}"
     curl -fsSL -o protoc.zip "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOBUF_VER}/${ASSET_NAME}.zip"
 
     unzip -j -d /usr/local/bin protoc.zip bin/protoc
     rm -rf protoc.zip
 HEREDOC
 
-# Install prebuilt sccache based on platform
+# Install prebuilt sccache based on platform:
 ARG SCCACHE_VER="0.10.0"
 RUN <<HEREDOC
-    ASSET_NAME="sccache-v${SCCACHE_VER}-${AARCH}-unknown-linux-musl"
+    ASSET_NAME="sccache-v${SCCACHE_VER}-${DOCKER_TARGET_ARCH}-unknown-linux-musl"
     curl -fsSL "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VER}/${ASSET_NAME}.tar.gz" \
       | tar -xz -C /usr/local/bin --strip-components=1 --no-same-owner "${ASSET_NAME}/sccache"
 HEREDOC
@@ -104,7 +109,7 @@ ARG RUSTUP_VER="1.28.2"
 ENV RUSTUP_HOME=/opt/rustup
 ENV CARGO_HOME=/opt/cargo
 RUN <<HEREDOC
-    RUST_ARCH="${AARCH}-unknown-linux-gnu"
+    RUST_ARCH="${DOCKER_TARGET_ARCH}-unknown-linux-gnu"
     curl -fsSL -o rustup-init "https://static.rust-lang.org/rustup/archive/${RUSTUP_VER}/${RUST_ARCH}/rustup-init"
     chmod +x rustup-init
     mkdir -p /opt/{cargo,rustup}
@@ -113,7 +118,7 @@ RUN <<HEREDOC
       --default-toolchain "${CHANNEL}" \
       --profile minimal \
       --no-modify-path \
-      --target "${AARCH}-unknown-linux-musl"
+      --target "${DOCKER_TARGET_ARCH}-unknown-linux-musl"
 
     rm rustup-init
 HEREDOC
@@ -134,7 +139,7 @@ ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-C link-self-contained=ye
     ZLIB_STATIC=1 \
     # Better support for running container user as non-root:
     # https://github.com/clux/muslrust/pull/101
-    CARGO_BUILD_TARGET=${AARCH}-unknown-linux-musl \
+    CARGO_BUILD_TARGET=${DOCKER_TARGET_ARCH}-unknown-linux-musl \
     CARGO_HOME=/opt/cargo \
     RUSTUP_HOME=/opt/rustup \
     # PATH prepends: