[xover-rs]

Summary

The default CROSS_IMAGE in Dockerfile is pinned to a private registry, so anyone outside the project's network fails on the builder stage with a connection timeout. This adds docker-bake.hcl, which builds the cross stage of Dockerfile.ci and links it in as the builder base. Dockerfile, the pin and the release workflows are unchanged, so release builds behave as before.

docker buildx bake --file docker-bake.hcl --load image

The --file flag matters because bake otherwise also reads docker-compose.yml.

User-visible behaviour

None for users of the published images. Contributors without registry access get a supported way to build the real Dockerfile, documented in docs/DEVELOPMENT.md.

Compatibility

None.

Tests

No Rust or frontend code changed, so the cargo and npm checks were not run. ci/migration-policy.sh passes.

Tested on an arm64 Linux VM with the Docker 29 docker-container builder:

• The bake build completed: the toolchain from Dockerfile.ci ran under amd64 emulation and produced an arm64 runtime image.
• The container started, /api/health returned {"status":"ok"}, / served the web UI, and rustnzb --version, unrar and 7z all ran.
• On the default docker builder, only a trivial two-stage bake with the same linked-target setup was run, not this build.
• A native amd64 host was not tested.

--load did not complete on this VM, for a reason outside this change: the VM refuses to create character devices, and lscr.io/linuxserver/baseimage-alpine ships /dev nodes, so a plain docker pull of that image also fails with failed to register layer: operation not permitted. For the container test above, I loaded a copy of the image flattened without those nodes.

• cargo fmt --all --check (not run, no Rust changes)
• cargo clippy --workspace --all-targets -- -D warnings (not run, no Rust changes)
• cargo test --workspace (not run, no Rust changes)
• Frontend npm test -- --watch=false and production build, if apps/rustnzb/frontend changed (not changed)
• UI changes checked at 1440px and 390px against DESIGN.md (no UI changes)

Checklist

• No credentials, NZB URLs, private hostnames or personal paths in the diff, fixtures or logs.
• Behaviour changes have tests. (no runtime behaviour change)
• Docs updated where behaviour or setup changed.

The diagnosis and this change were produced with Claude Code.

🤖 Generated with Claude Code

[thedancingdeveloper]

Landed on main as ca205b1 via #297 — thank you, @xover-rs! Changes here land through our graft tooling, which re-creates the commit, so GitHub can't mark this PR merged. You're credited as co-author in the commit message, and you'll get a changelog entry and a mention in the next release notes.