add reproducible Docker builds again (#24)

Previously, Docker builds without relying on the host were added as part of #18
but later reverted for an unrelated reason. This approach is better for two
reasons:

1. The version of Rust nightly is pinned, so it'll always work (e.g. right now
   we can't use the latest nightly).
2. We now use `sourcegraph/alpine` as our base image, which sets up a `sourcegraph`
   user for us.

Fixes #8 again.

Dockerfile

@@ -1,10 +1,33 @@
-FROM alpine:latest
+########################################
+# Rust nightly + musl in a build stage #
+########################################
+# Select specific Rust nightly version
+FROM rust:1.32@sha256:741edb658fac7ac8a978bb30f83fb5d3a7b8e8fc35105a79f424b5671cca724a as our-rust-nightly
+RUN rustup default nightly-2018-11-29
+
+# Install musl compiler toolchain
+RUN apt-get -y update && apt-get install --no-install-recommends -y musl-tools=1.1.16-3
+RUN rustup target add x86_64-unknown-linux-musl
+
+###################################
+# Build syntect_server statically #
+###################################
+FROM our-rust-nightly as ss
+COPY . /repo
+WORKDIR /repo
+RUN env 'CC_x86_64-unknown-linux-musl=musl-gcc' cargo rustc --release --target x86_64-unknown-linux-musl -- -C 'linker=musl-gcc'
+RUN cp ./target/x86_64-unknown-linux-musl/release/syntect_server /syntect_server
+
+#######################
+# Compile final image #
+#######################
+FROM sourcegraph/alpine:3.9@sha256:e9264d4748e16de961a2b973cc12259dee1d33473633beccb1dfb8a0e62c6459
+COPY --from=ss syntect_server /
 
 # Use tini (https://github.com/krallin/tini) for proper signal handling.
-RUN apk add --no-cache tini
+RUN apk add --no-cache tini=0.18.0-r0
 ENTRYPOINT ["/sbin/tini", "--"]
 
-ADD ./target/x86_64-unknown-linux-musl/release/syntect_server /
 EXPOSE 9238
 ENV ROCKET_ENV "production"
 ENV ROCKET_PORT 9238
@@ -23,7 +46,4 @@ ENV ROCKET_SECRET_KEY "+SecretKeyIsIrrelevantAndUnusedPleaseIgnore="
 # what we observed when this was enabled with the default 5s.
 ENV ROCKET_KEEP_ALIVE=0
 
-RUN addgroup -S sourcegraph && adduser -S -G sourcegraph -h /home/sourcegraph sourcegraph
-USER sourcegraph
-
 CMD ["/syntect_server"]

README.md

@@ -49,21 +49,11 @@ By default on startup, `syntect_server` will list all features (themes + file ty
 
 ## Building
 
-Invoke `cargo build --release` and an optimized binary will be built (e.g. to `./target/debug/syntect_server`).
+Invoke `cargo build --release` and an optimized binary will be built (e.g. to `./target/release/syntect_server`).
 
 ## Building docker image
 
-- MacOS
-  - `brew install filosottile/musl-cross/musl-cross`
-  - `rustup target add x86_64-unknown-linux-musl`
-  - `./build.sh` -> then `./publish.sh` to push the docker image.
-
-- Debian / Ubuntu
-  - `sudo apt-get install musl-tools`
-  - `rustup target add x86_64-unknown-linux-musl`
-  - `./build.debian.sh` -> then `./publish.sh` to push the docker image.
-
-You can then run it via `docker run -it syntect_server`.
+`./build.sh` will build your current repository checkout into a final Docker image.
 
 ## Publishing docker image
 
@@ -91,7 +81,7 @@ Run `./publish.sh` after merging your changes.
 - With a `.sublime-syntax` file:
   - Save the file anywhere under `Packages/MySyntax` [in our fork of sublimehq/Packages](https://github.com/slimsag/Packages).
   - In our fork of syntect
-    - update the git submodule 
+    - update the git submodule
     - run `make assets`
     - commit those changes and submit a PR to the syntect fork
   - Build a new binary.

build.sh

@@ -1,3 +1,2 @@
 set -ex
-env 'CC_x86_64-unknown-linux-musl=x86_64-linux-musl-gcc' cargo rustc --release --target x86_64-unknown-linux-musl -- -C 'linker=x86_64-linux-musl-gcc'
-docker build --no-cache -t sourcegraph/syntect_server .
+docker build -t sourcegraph/syntect_server .