Skip to content

feat(docker): add containerized support for dev and deployment [signoff] #151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Fmstrat wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(docker): add containerized support for dev and deployment [signoff] #151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
target/
**/*.backup
**/*.jsonl
.DS_Store
*.swp
*.swo

# Secrets and credentials
.env
.env.*
*.pem
*.key
*.p12
environments.json

# IDE
.idea/
.vscode/

# Logs and OS artifacts
*.log
Thumbs.db

# Docker
.dockerignore
docker/
*.md
.git
.github
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -404,6 +404,10 @@ git commit -m "signed with my DID"

See the [did-git-sign README](./did-git-sign/README.md) for full documentation.

## Containerization

Details on containerization, development, and use inside of Docker can be found in the [DOCKER.md](./docker/DOCKER.md) file.

## Additional Resources

Additional resources to learn more about the Open Verifiable Trust Community (OpenVTC) Tool.
Expand Down
39 changes: 39 additions & 0 deletions docker/DOCKER.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# OpenVTC in Docker

The `docker` folder contains `Dockerfile`s that can be used for generating a build environment and a slim, deployable OpenVTC container.

## Containerized deployment

To build the OpenVTC containerized deployment:

```bash
docker build -t openvtc -f ./docker/Dockerfile .
```

To run OpenVTC in the container:

```bash
docker run \
--rm \
-ti \
-v "${PWD}/.vscode/data/root:/root" \

@stormer78 stormer78 Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please move the persistent-data path out of .vscode/ — that's a VS Code settings directory, and users without VS Code (or with it, syncing settings) will find app data hidden there surprising. Something like .docker-data/ in the repo (gitignored) or ~/.openvtc-docker/ would be cleaner. Same applies to the .vscode/data/home path in the cargo alias below. Whatever directory is chosen should be added to .gitignore, since running the deploy image as root leaves root-owned files that pollute git status.

Also worth a note that --network host behaves differently on Docker Desktop (macOS/Windows), which matters since this tool talks to live VTA/VTC services.

--network host \
openvtc
```

## Containerized build environment

To build the container for development:

```bash
docker build -t openvtc-builder -f ./docker/builder.Dockerfile .
```

To utilize cargo inside the build environment as your current user, while keeping the cargo cache and user home directory in a centralized folder under `.vscode/data`, use:

```bash
alias cargo='docker run --rm -ti -v "/etc/passwd:/etc/passwd:ro" -v "${PWD}/.vscode/data/home:${HOME}" -v "${PWD}:${PWD}" -w "${PWD}" -e CARGO_HOME=${HOME}/cargo --user $(id -u):$(id -g) -e HOME=${HOME} --network host openvtc-builder cargo'
```

From here out, all use of `cargo` will work just like using a standard Rust dev environment.

27 changes: 27 additions & 0 deletions docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
FROM rust:1 AS builder

ENV DEBIAN_FRONTEND=noninteractive

RUN \
addgroup --system messagebus &&\
apt update &&\
apt install -y libdbus-1-dev pkg-config libpcsclite-dev

@stormer78 stormer78 Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: prefer apt-get over apt in scripts (apt warns it has an unstable CLI interface — the runtime stage below already uses apt-get). Also, a one-line comment explaining the addgroup --system messagebus workaround (dbus package postinst in containers?) would save the next reader a puzzle — it appears in both Dockerfiles.


ADD . /build

@stormer78 stormer78 Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two notes here:

  1. Because ADD . /build runs before cargo fetch, any source edit invalidates the fetch layer and re-downloads all dependencies — the "Cache a build layer for downloads" comment below doesn't actually hold. Either copy Cargo.toml/Cargo.lock (+ member manifests) first and cargo fetch before copying the rest, or use RUN --mount=type=cache,target=/usr/local/cargo/registry, which is simpler for a workspace.
  2. Prefer COPY over ADD for plain directory copies (Docker's own lint flags this; ADD has extra URL/tar-extraction behaviors you don't want here).

WORKDIR /build

# Cache a build layer for downloads
RUN cargo fetch
RUN cargo build

@stormer78 stormer78 Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This builds a debug binary, so the "slim deployment image" ships an unoptimized, symbol-heavy build. Suggest:

RUN cargo build --release -p openvtc

and copying from /build/target/release/openvtc below. -p openvtc also skips building did-git-sign, which isn't shipped in this image.


# Create the actual image
FROM debian:trixie-slim
ARG DEBIAN_FRONTEND=noninteractive
RUN \
apt-get update &&\
apt-get install -y ca-certificates libpcsclite1 &&\

@stormer78 stormer78 Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suspected blocker: the runtime image is likely missing libdbus-1-3. The workspace pulls in dbus-secret-service → libdbus-sys for the Linux keyring, and the lockfile has libdbus-sys 0.2.7 with only a pkg-config dependency (i.e. dynamic linking, not the vendored build) — that's why the builder stage needs libdbus-1-dev. A dynamically linked binary will fail at load time in debian:trixie-slim with error while loading shared libraries: libdbus-1.so.3.

Suggested fix: add libdbus-1-3 next to libpcsclite1, and verify with:

docker run --rm --entrypoint ldd openvtc /openvtc

(no not found lines should appear).

apt-get clean &&\
rm -rf /var/lib/apt/lists/*
COPY --from=builder /build/target/debug/openvtc /openvtc
WORKDIR /data

@stormer78 stormer78 Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WORKDIR /data is set but nothing mounts or writes /data — the docs persist /root instead (config lives under $HOME). Either document mounting /data for something or drop this line so it doesn't imply it matters.

ENTRYPOINT ["/openvtc"]
8 changes: 8 additions & 0 deletions docker/builder.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
FROM rust:1

ENV DEBIAN_FRONTEND=noninteractive

RUN \
addgroup --system messagebus &&\
apt update &&\
apt install -y libdbus-1-dev pkg-config libpcsclite-dev
Loading