infra-docker-cpp-containerization

Answer

Root cause: the fork had no container path at all. The fix is a multi-stage Dockerfile (Ubuntu 24.04 builder → slim runtime), a non-root entrypoint, and a compose file with a pull-first/build-fallback strategy plus env-overridable ports. Files written to the workspace:

Dockerfile:

# syntax=docker/dockerfile:1
# RT-GAP-010 — C++ fork with no container path
#   Stage 1 (builder): ubuntu:24.04 + apt deps (incl. libboost-all-dev)
#                      + ./configure --allow-fetch + make -j4
#   Stage 2 (runtime): ~360MB dynamically-linked binary + same libs,
#                      non-root user, /data volume, healthcheck.
# Traps encoded: libboost-all-dev REQUIRED (bundled boost fetch broken);
# configure REJECTS CC=/--cc=; cold build ~8 min on 16 cores.

FROM ubuntu:24.04 AS builder

ENV DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC

# libboost-all-dev is REQUIRED. On noble the ncurses dev package is
# libncurses-dev (ncurses 6) — libncurses5-dev no longer exists.
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates curl git m4 build-essential \
      libssl-dev libprotobuf-dev protobuf-compiler \
      libncurses-dev libjemalloc-dev libboost-all-dev \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /src
COPY . .                     # fork checkout (see .dockerignore)

# Verified configure line: do NOT pass --cc= / CC= — configure detects
# gcc/g++ itself and rejects an explicit compiler override.
RUN ./configure --allow-fetch \
 && make -j4 \
 && ls -lh build/release/rethinkdb

FROM ubuntu:24.04 AS runtime

ENV DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC

# "Same libs" as the builder — the binary is dynamically linked against
# these exact sonames; verified present in noble main/universe.
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates \
      libssl3t64 libprotobuf32t64 \
      libncurses6 libncursesw6 libtinfo6 \
      libjemalloc2 \
      libboost-system1.83.0 libboost-filesystem1.83.0 \
      libboost-program-options1.83.0 libboost-thread1.83.0 \
      libboost-regex1.83.0 libboost-coroutine1.83.0 \
      libgcc-s1 libstdc++6 \
 && rm -rf /var/lib/apt/lists/*

COPY --from=builder /src/build/release/rethinkdb /usr/bin/rethinkdb
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

RUN chmod +x /usr/local/bin/docker-entrypoint.sh \
 && useradd --system --uid 999 --create-home --home-dir /var/lib/rethinkdb rethinkdb \
 && mkdir -p /data \
 && chown -R rethinkdb:rethinkdb /data /var/lib/rethinkdb

USER rethinkdb
VOLUME ["/data"]
EXPOSE 8080 28015 29015

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=5 \
  CMD bash -c 'exec 3<>/dev/tcp/<ip-address>/28015'

ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["rethinkdb"]

docker-entrypoint.sh:

#!/bin/sh
set -e
# --data-dir /data        : persistent named volume
# --bind all              : reachable from host/containers
# --initial-password auto : RethinkDB >= 2.4; admin password printed to
#                           log on first init (drop for pre-2.4 forks)
if [ "$1" = 'rethinkdb' ]; then
    shift
    exec rethinkdb --data-dir /data --bind all --initial-password auto "$@"
fi
exec "$@"

docker-compose.yml:

name: rethinkdb

services:
  rethinkdb:
    # Pull-first, build-fallback. GHCR packages default to PRIVATE and
    # there is NO REST endpoint to query visibility anymore (verified
    # against the OpenAPI spec) — set it in the GHCR web UI/org settings.
    # The build: fallback covers anonymous users when the pull fails.
    image: ghcr.io/totalwindupflightsystems/rethinkdb:latest
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    ports:
      - "${RETHINKDB_WEB_PORT:-8080}:8080"       # web UI — override if busy on host
      - "${RETHINKDB_CLIENT_PORT:-28015}:28015"  # client driver
      - "${RETHINKDB_CLUSTER_PORT:-29015}:29015" # cluster
    volumes:
      - rethinkdb-data:/data

volumes:
  rethinkdb-data: