ci: build docker images from prebuilt binaries, on a distroless base

[radiosilence]

Follow-up to #53. Same shape as radiosilence/nano-web#21, adapted to the fact that this binary can't be static. Also bumps to v3.3.1, so merging this cuts a release and exercises the new publish path end to end.

What

The image build compiled the whole crate a second time inside Docker and was the slowest thing in the pipeline:

job	before
Build arm64 Image	677s
Build amd64 Image	530s
Build linux-x86_64 (same compile)	345s

With lto = true and codegen-units = 1 those are the most expensive compiles in the repo, and we paid for two of them twice per push.

Load-bearing decisions

One job, one compile, two outputs. build-image compiles the Linux target, copies the binary to dist/, uploads it as the release asset, and feeds the same file to the Docker build. A separate build job would cost a runner handoff and an artifact round-trip, and upload-artifact drops the executable bit. One job makes both problems disappear.

Distroless runtime. The binary is the only thing the image needs to contain — no shell, no package manager, no apt layer. It's gcr.io/distroless/cc-debian13 rather than scratch because three things rule scratch out, each verified against the actual image:

need	why
/etc/ssl/certs/ca-certificates.crt	reqwest resolves roots via rustls-native-certs, which reads the system trust store
libstdc++ / libgcc_s / loader	kreuzberg embeds pdfium and dlopens it at runtime — also why static musl is out
/tmp	where pdfium is extracted on first use (std::env::temp_dir())

This is a visible change for anyone exec'ing into the container — noted in the changelog, with the :debug tag as the escape hatch.

Runners are pinned, and that's load-bearing. glibc symbol versioning is forward-compatible only, so building against a newer glibc than the base links fine and dies at exec time. Measured:

image	glibc
debian:bookworm-slim (source-path builder)	2.36	✅
ubuntu-24.04 (CI runner)	2.39	✅ newest usable
distroless/cc-debian13 (base)	2.41	— ceiling
ubuntu:25.10	2.42	✗
ubuntu:26.04	2.43	✗

A floating ubuntu-latest would break the image the day it rolls over, so it's ubuntu-24.04 / ubuntu-24.04-arm explicitly. (cc-debian12 is 2.36 and wouldn't clear the runners at all.) #55 tracks decoupling this properly.

docker build . still works from a clean clone. A global ARG BIN_SOURCE=source selects between a source-compiled stage and a copy-the-artifact stage; BuildKit only builds the stage that resolves, so CI's --build-arg BIN_SOURCE=prebuilt never touches the Rust builder. Two constraints found the hard way: the ARG must precede the first FROM to be usable in one, and the selection must route through a FROM — COPY --from= rejects variable expansion outright (variable expansion is not supported for --from).

Caching

• Dropped cache-from/cache-to: type=gha,mode=max on the Docker build. Nothing compiles in the image now, and mode=max was stuffing Rust build layers into the same repo-wide 10GB budget Swatinem/rust-cache uses — the two evicted each other.
• Compile jobs now save-if: github.ref == 'refs/heads/main'. Branch-scoped caches aren't readable from other branches, so PR runs were writing entries whose only effect was evicting the main entry they restore from.

Other

• Images build on PRs — nothing else builds the image, so a broken Dockerfile only surfaced after merge. Includes a docker run --rm <image> --version smoke test per arch.
• Darwin binaries stay main-only — no image consumes them.
• Adds linux-aarch64 to the release assets, which the arm64 image needed anyway.

Verifying

Locally, both Dockerfile paths:

• --build-arg BIN_SOURCE=prebuilt in a context with no Cargo.toml → succeeds and never pulls rust:1-bookworm, confirming the source stage is pruned.
• Default → zero dist/ references in the build log, proceeds into the builder stage, full build exits 0.
• Exec on distroless checked with a real glibc-2.36-linked ELF running on the 2.41 base (a shell script wouldn't prove anything, since there's no shell). Runs clean.

On merge, Publish runs for real: pushes both arch images, creates the :main/:sha-/semver manifests, then cuts v3.3.1 last. Worth watching, since it's the first exercise of the load-and-push path and of the release-gating-on-latest-release logic from #53.

The --version smoke test is now the only thing between a broken image and the registry, and there's no shell in there to debug with afterwards.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EHzrrbZuVjY9PsBEnKMcFq