ci(polymarket): publish bounded market recorder image

.github/workflows/acr-publish.yml

@@ -14,6 +14,7 @@ on:
           - hft-trading
           - binance-lob-archiver
           - polymarket-evidence-compiler
+          - polymarket-market-recorder
 
 permissions:
   contents: read
@@ -34,14 +35,15 @@ jobs:
           TARGET: ${{ inputs.target }}
         run: |
           case "$TARGET" in
-            all|research-runner|hft-trading|binance-lob-archiver|polymarket-evidence-compiler) ;;
+            all|research-runner|hft-trading|binance-lob-archiver|polymarket-evidence-compiler|polymarket-market-recorder) ;;
             *) echo "Unsupported publish target: $TARGET" >&2; exit 1 ;;
           esac
           matrix=$(jq -cn --arg target "$TARGET" '
             [{repository:"research-runner",file:"rust_hft/deployment/docker/Dockerfile.research",target:"prebuilt"},
              {repository:"hft-trading",file:"rust_hft/deployment/docker/Dockerfile.trading",target:"runtime"},
              {repository:"binance-lob-archiver",file:"rust_hft/deployment/docker/Dockerfile.binance-lob-archiver",target:"runtime"},
-             {repository:"polymarket-evidence-compiler",file:"rust_hft/deployment/docker/Dockerfile.polymarket-evidence-compiler",target:"runtime"}]
+             {repository:"polymarket-evidence-compiler",file:"rust_hft/deployment/docker/Dockerfile.polymarket-evidence-compiler",target:"runtime"},
+             {repository:"polymarket-market-recorder",file:"rust_hft/deployment/docker/Dockerfile.polymarket-market-recorder",target:"runtime"}]
             | {include: map(select($target == "all" or .repository == $target))}')
           echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
 
@@ -203,6 +205,25 @@ jobs:
             "$IMAGE")
           test "$actual_source_revision" = "$SOURCE_REVISION"
 
+      - name: Verify Polymarket market recorder image
+        if: matrix.repository == 'polymarket-market-recorder'
+        env:
+          IMAGE: ${{ vars.ACR_REGISTRY }}/wildcard0923/${{ matrix.repository }}@${{ steps.build.outputs.digest }}
+          SOURCE_REVISION: ${{ github.sha }}
+        run: |
+          docker pull "$IMAGE"
+          actual_source_revision=$(docker image inspect \
+            --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' \
+            "$IMAGE")
+          test "$actual_source_revision" = "$SOURCE_REVISION"
+          if output=$(docker run --rm "$IMAGE" --config /nonexistent 2>&1); then
+            echo "recorder accepted an invocation without --dry-run" >&2
+            exit 1
+          fi
+          grep -Fq 'requires --dry-run' <<<"$output"
+          docker run --rm "$IMAGE" --dry-run --help 2>&1 \
+            | grep -Fq -- '--dry-run'
+
       - name: Verify research runner image
         if: matrix.repository == 'research-runner'
         env:

rust_hft/deployment/docker/Dockerfile.polymarket-market-recorder

@@ -0,0 +1,47 @@
+# syntax=docker/dockerfile:1.7
+
+FROM rust:1.91-bookworm AS builder
+
+WORKDIR /work
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    clang \
+    cmake \
+    mold \
+    pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY . .
+WORKDIR /work/prediction-markets
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
+    --mount=type=cache,target=/work/prediction-markets/target,sharing=locked \
+    if cargo tree --locked -p new-ploy-runner --features full -e features \
+      | grep -q 'live-execution'; then \
+      echo "new-ploy-runner full feature must not enable live-execution" >&2; \
+      exit 1; \
+    fi \
+    && cargo --config 'build.rustc-wrapper=""' build \
+      --release \
+      --locked \
+      -p new-ploy-runner \
+      --features full \
+    && install -D -m 0755 target/release/new-ploy-runner \
+      /out/bin/new-ploy-runner
+
+FROM debian:bookworm-slim AS runtime
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    tini \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --uid 1000 recorder
+
+WORKDIR /work
+COPY --from=builder /out/bin/new-ploy-runner /usr/local/bin/new-ploy-runner
+COPY --chmod=0755 deployment/docker/polymarket-market-recorder-entrypoint.sh \
+    /usr/local/bin/polymarket-market-recorder-entrypoint
+
+USER recorder
+ENV RUST_LOG=info
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/polymarket-market-recorder-entrypoint"]
+CMD ["--help"]

rust_hft/deployment/docker/polymarket-market-recorder-entrypoint.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+dry_run=false
+help=false
+for arg in "$@"; do
+    case "$arg" in
+        --dry-run) dry_run=true ;;
+        --help|-h) help=true ;;
+    esac
+done
+
+if [ "$dry_run" = true ] || [ "$help" = true ]; then
+    exec /usr/local/bin/new-ploy-runner "$@"
+fi
+
+echo "polymarket-market-recorder requires --dry-run" >&2
+exit 64