feat: add aarch64 cross-compilation support#444
Open
tomasmach wants to merge 2 commits intospacedriveapp:mainfrom
Open
feat: add aarch64 cross-compilation support#444tomasmach wants to merge 2 commits intospacedriveapp:mainfrom
tomasmach wants to merge 2 commits intospacedriveapp:mainfrom
Conversation
Contributor
WalkthroughAdds ARM64 (aarch64) cross-compilation support: new Dockerfile to provision cross-toolchain and sysroot, a justfile build target for aarch64 release, and README guidance (duplicated block) explaining local cross-build steps and CI behaviour. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip You can customize the tone of the review comments and chat replies.Configure the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
Dockerfile.cross-aarch64 (1)
26-26: Consider whether OpenSSL and SQLite dev packages are needed.Per
build.rscontext, the codebase usesrustlsfor TLS (pure Rust) andsqlxwith the sqlite feature (also pure Rust via bundled SQLite). Theselibssl-dev:arm64andlibsqlite3-dev:arm64packages may be unnecessary.That said, keeping them is harmless and provides safety for transitive dependencies or future changes that might require native linking.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile.cross-aarch64` at line 26, The Dockerfile.cross-aarch64 installs libssl-dev:arm64 and libsqlite3-dev:arm64 which may be unnecessary because the project uses rustls and sqlx with bundled sqlite; remove those two packages from the apt-get install line (the entries libssl-dev:arm64 and libsqlite3-dev:arm64) to slim the image, or alternatively leave them with a comment explaining they are kept for transitive/native-link safety—update the apt-get install invocation accordingly and ensure the package list and trailing backslashes remain valid.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile.cross-aarch64`:
- Around line 44-46: The Dockerfile sets OPENSSL_INCLUDE_DIR and
SQLITE3_INCLUDE_DIR to incorrect Ubuntu multiarch paths
(/usr/aarch64-linux-gnu/usr/include); update the assignments for
OPENSSL_INCLUDE_DIR and SQLITE3_INCLUDE_DIR to use the standard multiarch header
directory /usr/include/aarch64-linux-gnu so that headers from libssl-dev:arm64
and libsqlite3-dev:arm64 are found during build.
---
Nitpick comments:
In `@Dockerfile.cross-aarch64`:
- Line 26: The Dockerfile.cross-aarch64 installs libssl-dev:arm64 and
libsqlite3-dev:arm64 which may be unnecessary because the project uses rustls
and sqlx with bundled sqlite; remove those two packages from the apt-get install
line (the entries libssl-dev:arm64 and libsqlite3-dev:arm64) to slim the image,
or alternatively leave them with a comment explaining they are kept for
transitive/native-link safety—update the apt-get install invocation accordingly
and ensure the package list and trailing backslashes remain valid.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 6f61d8a2-8db3-4ba7-a636-ea676fb1b538
⛔ Files ignored due to path filters (1)
Cross.tomlis excluded by!**/*.toml
📒 Files selected for processing (3)
Dockerfile.cross-aarch64README.mdjustfile
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (2)
Dockerfile.cross-aarch64 (2)
1-4: Static analysis flags root user — acceptable for build-only containers.Trivy reports DS-0002 (image should not run as root). Since this container is only used for cross-compilation (not runtime), running as root is acceptable and simplifies package installation. If the team prefers stricter container hygiene, a non-root user could be added at the end for the cargo build step.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile.cross-aarch64` around lines 1 - 4, Trivy flags the Dockerfile.cross-aarch64 for running as root (DS-0002); if you want stricter hygiene instead of accepting root for the build container, add an unprivileged user and switch to it before the cargo build step: create a user/group (e.g., builder), chown the workspace, use USER builder, and ensure any apt/installation steps that require root remain earlier in the Dockerfile (keep ENV DEBIAN_FRONTEND=noninteractive and package installation as root, then switch to the non-root user before invoking cargo build).
32-37: Add checksum verification for the protoc download.The protoc binary is downloaded over HTTPS but without verifying its integrity. Adding a SHA256 checksum check would guard against supply-chain tampering or partial downloads.
🔒 Proposed fix to add checksum verification
# protoc (x86_64 host binary for prost/lancedb build-time codegen) +ARG PROTOC_VERSION=29.3 +ARG PROTOC_SHA256=3e866620c5be27664f3d2fa2d656b5f3e09b5152b42f1bedbf427b333e90021a RUN curl -fsSL -o /tmp/protoc.zip \ - https://github.com/protocolbuffers/protobuf/releases/download/v29.3/protoc-29.3-linux-x86_64.zip \ + https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-x86_64.zip \ + && echo "${PROTOC_SHA256} /tmp/protoc.zip" | sha256sum -c - \ && unzip /tmp/protoc.zip -d /usr/local \ && chmod +x /usr/local/bin/protoc \ && rm /tmp/protoc.zip🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile.cross-aarch64` around lines 32 - 37, Add SHA256 checksum verification for the protoc download: after downloading /tmp/protoc.zip (the RUN block that fetches protoc for build-time codegen and before unzip/chmod/rm), fetch or embed the expected SHA256 value for protoc-29.3-linux-x86_64.zip, compute the checksum with sha256sum (or similar) against /tmp/protoc.zip, and abort (exit non-zero) if the checksum does not match so unzip/chmod/rm only run on a verified archive; update the RUN chain around the protoc download/unpack steps accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@Dockerfile.cross-aarch64`:
- Around line 1-4: Trivy flags the Dockerfile.cross-aarch64 for running as root
(DS-0002); if you want stricter hygiene instead of accepting root for the build
container, add an unprivileged user and switch to it before the cargo build
step: create a user/group (e.g., builder), chown the workspace, use USER
builder, and ensure any apt/installation steps that require root remain earlier
in the Dockerfile (keep ENV DEBIAN_FRONTEND=noninteractive and package
installation as root, then switch to the non-root user before invoking cargo
build).
- Around line 32-37: Add SHA256 checksum verification for the protoc download:
after downloading /tmp/protoc.zip (the RUN block that fetches protoc for
build-time codegen and before unzip/chmod/rm), fetch or embed the expected
SHA256 value for protoc-29.3-linux-x86_64.zip, compute the checksum with
sha256sum (or similar) against /tmp/protoc.zip, and abort (exit non-zero) if the
checksum does not match so unzip/chmod/rm only run on a verified archive; update
the RUN chain around the protoc download/unpack steps accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ecce3e3c-1464-492d-bde3-aeae2113e0d8
📒 Files selected for processing (1)
Dockerfile.cross-aarch64
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cross.tomlandDockerfile.cross-aarch64for local cross-compilation toaarch64-unknown-linux-gnuusing thecrosstooljust build-aarch64recipe for one-command ARM buildsMotivation
CI builds ARM binaries natively on
ubuntu-24.04-armrunners, but there's no way for developers to cross-compile for ARM locally from an x86_64 machine. This is useful for anyone deploying to Raspberry Pi or ARM servers without ARM hardware.Details
The
Dockerfile.cross-aarch64is based on Ubuntu 22.04 (required becauseort-sysbundles a prebuilt ONNX Runtime aarch64 static lib that needs glibc 2.32+ and GCC 11+ libstdc++). It includes:gcc-aarch64-linux-gnu,g++-aarch64-linux-gnu)libssl-dev:arm64,libsqlite3-dev:arm64)protocfor prost/lancedb build-time codegenUsage:
cargo install cross --locked just build-aarch64 # Output: target/aarch64-unknown-linux-gnu/release/spacebotTest plan
gate-prpasses (confirmed locally — no Rust source changes)just build-aarch64produces a validELF 64-bit LSB ... ARM aarch64binary