Containerfile

# syntax=docker/dockerfile:1.7
#
# Two-stage image for generic upstream llvm-project development.
#
# ┌── worker ─────────────────────────────────────────────────────────┐
# │  Minimal toolchain for distccd workers. Pinned `clang` (the only  │
# │  package that affects build artifacts across the LAN) and         │
# │  `distcc-server` (protocol is stable; daemon does not touch .o).  │
# └───────────────────────────────────────────────────────────────────┘
# ┌── dev (FROM worker, final, default stage) ────────────────────────┐
# │  Full interactive development environment. Everything here floats │
# │  to latest-stable Fedora, except pinned direct downloads and the  │
# │  Copilot CLI which lives on its own layer for easy refresh.       │
# └───────────────────────────────────────────────────────────────────┘
#
# Build an explicit stage with `podman build --target=worker|dev`.
# Pinned by digest; bump intentionally.

ARG DEV_UID=25372
ARG DEV_GID=25372

########################################################################
# stage: worker
########################################################################
FROM docker.io/library/fedora:42@sha256:7e09f4db0ebdd29667156230ccb7e0f3791e50e28ce04ab6e6825f00d2a63b95 AS worker

LABEL org.opencontainers.image.title="llvm-project-worker"
LABEL org.opencontainers.image.description="Minimal distccd worker for llvm-project"

# distcc only dispatches compile (cc1) invocations, so the compiler binary
# on the worker must match what the client would have run locally. Pin it
# here; `dev` inherits the same clang via `FROM worker`. Bump in one PR
# and rebuild both sides.
ARG CLANG_VERSION=20.1.8

# hadolint ignore=DL3041
RUN dnf install -y --setopt=install_weak_deps=False \
      "clang-${CLANG_VERSION}-*" \
      "compiler-rt-${CLANG_VERSION}-*" \
      distcc-server \
 && dnf clean all \
 && rm -rf /var/cache/dnf

ARG DEV_UID
ARG DEV_GID
RUN groupadd -g "${DEV_GID}" dev \
 && useradd -l -m -u "${DEV_UID}" -g "${DEV_GID}" -s /bin/bash dev

USER dev
WORKDIR /home/dev

########################################################################
# stage: dev
########################################################################
FROM worker AS dev

LABEL org.opencontainers.image.title="llvm-project-dev"
LABEL org.opencontainers.image.description="Upstream llvm-project development environment"

USER root

# Build toolchain + developer tools in a single layer.
# hadolint ignore=DL3041
RUN dnf install -y --setopt=install_weak_deps=False \
      bear \
      binutils \
      ccache \
      clang-tools-extra \
      cmake \
      cvise \
      distcc \
      doxygen \
      findutils \
      gdb \
      git \
      glibc-langpack-en \
      graphviz \
      hyperfine \
      just \
      lcov \
      libatomic \
      libcxx \
      libcxx-devel \
      libcxxabi \
      libcxxabi-devel \
      lld \
      lldb \
      mold \
      ninja-build \
      patch \
      perf \
      procps-ng \
      python3 \
      python3-lit \
      python3-pip \
      unzip \
      uv \
      valgrind \
      which \
      zlib-ng-compat-devel \
      zstd \
 && dnf clean all \
 && rm -rf /var/cache/dnf

# FlameGraph (not packaged). Pinned commit.
ARG FLAMEGRAPH_REV=cd9ee4c4449775a2f867acf31c84b7fe4b132ad5
RUN curl -fsSL "https://github.com/brendangregg/FlameGraph/archive/${FLAMEGRAPH_REV}.tar.gz" -o /tmp/fg.tgz \
 && mkdir -p /opt/flamegraph \
 && tar -xzf /tmp/fg.tgz -C /opt/flamegraph --strip-components=1 \
 && ln -s /opt/flamegraph/flamegraph.pl /usr/local/bin/flamegraph \
 && ln -s /opt/flamegraph/stackcollapse-perf.pl /usr/local/bin/stackcollapse-perf \
 && rm /tmp/fg.tgz

# hadolint (Dockerfile/Containerfile linter). Pinned.
ARG HADOLINT_VERSION=2.12.0
RUN curl -fsSL "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-Linux-x86_64" \
      -o /usr/local/bin/hadolint \
 && chmod +x /usr/local/bin/hadolint

# cmake-format / cmake-lint for .cmake cache files.
ARG CMAKELANG_VERSION=0.6.13
RUN pip install --no-cache-dir "cmakelang==${CMAKELANG_VERSION}"

# Official clangd build with remote-index support (https://clangd-index.llvm.org/).
# The Fedora clang-tools-extra clangd is built without -DCLANGD_ENABLE_REMOTE=On.
# Overlays /usr/bin/clangd via /usr/local/bin precedence.
ARG CLANGD_VERSION=22.1.0
ARG CLANGD_SHA256=c54e57dbff3ccc9e8352367ddb7030ad3f624073ec58c7477424e7919f578572
RUN curl -fsSL "https://github.com/clangd/clangd/releases/download/${CLANGD_VERSION}/clangd-linux-${CLANGD_VERSION}.zip" \
      -o /tmp/clangd.zip \
 && echo "${CLANGD_SHA256}  /tmp/clangd.zip" > /tmp/clangd.zip.sha256 \
 && sha256sum -c /tmp/clangd.zip.sha256 \
 && unzip -q /tmp/clangd.zip -d /opt \
 && mv "/opt/clangd_${CLANGD_VERSION}" /opt/clangd \
 && ln -sf /opt/clangd/bin/clangd /usr/local/bin/clangd \
 && rm /tmp/clangd.zip /tmp/clangd.zip.sha256

# Expose helper scripts that Fedora installs outside PATH.
RUN ln -s /usr/share/clang/clang-tidy-diff.py /usr/local/bin/clang-tidy-diff.py \
 && ln -s /usr/bin/lit /usr/local/bin/llvm-lit

ENV LANG=en_US.UTF-8 \
    LC_ALL=en_US.UTF-8 \
    LLVM_BUILD_ENV=native

RUN mkdir -p /home/dev/.cache/ccache /home/dev/.cache/clangd \
 && chown -R dev:dev /home/dev

# GitHub Copilot CLI. MUST remain the last RUN: it sits on its own layer,
# gated by COPILOT_CACHEBUST so `just update-copilot` can refresh it
# without invalidating anything else.
ARG COPILOT_CACHEBUST=1
# hadolint ignore=DL4006
RUN echo "copilot-cachebust=${COPILOT_CACHEBUST}" >/dev/null \
 && curl -fsSL https://gh.io/copilot-install -o /tmp/copilot-install.sh \
 && PREFIX=/usr/local bash /tmp/copilot-install.sh \
 && rm /tmp/copilot-install.sh

USER dev
WORKDIR /home/dev