Dockerfile.runtime-base

# syntax=docker/dockerfile:1.4

# Shared runtime base for all cardano-toa services (statically-linked binaries).
# Only runtime essentials — no build toolchain.
FROM --platform=$TARGETPLATFORM alpine:3.20

RUN apk add --no-cache \
    bash \
    curl \
    ca-certificates \
    ncurses-libs \
    libsodium \
    libsecp256k1 \
    libstdc++ \
    gmp \
    libgcc \
    xz-libs \
    postgresql-libs

# libsodium 1.0.19 (for libsodium.so.26)
RUN apk add --no-cache --virtual .build-deps \
      build-base curl autoconf automake libtool && \
    curl -LO https://download.libsodium.org/libsodium/releases/libsodium-1.0.19.tar.gz && \
    tar xvf libsodium-1.0.19.tar.gz && \
    cd libsodium-stable && \
    ./configure --prefix=/usr --enable-shared --disable-static && \
    make && make install && \
    cd / && rm -rf libsodium-stable libsodium-1.0.19.tar.gz

# secp256k1 (schnorr)
RUN apk add --no-cache --virtual .secp-deps \
      build-base git autoconf automake libtool && \
    git clone --depth 1 --branch 'v0.3.2' https://github.com/bitcoin-core/secp256k1 && \
    cd secp256k1 && \
    ./autogen.sh && \
    ./configure --enable-module-schnorrsig --enable-experimental && \
    make && make check && make install && \
    cd / && rm -rf secp256k1

# BLST
ARG BLST_REF=v0.3.15
COPY libblst.pc /usr/lib/pkgconfig/
RUN apk add --no-cache --virtual .blst-deps build-base git && \
    git clone https://github.com/supranational/blst && \
    cd blst && \
    git checkout ${BLST_REF} && \
    ./build.sh && \
    cp bindings/blst_aux.h bindings/blst.h bindings/blst.hpp /usr/include/ && \
    cp libblst.a /usr/lib/ && \
    chmod u=rw,go=r /usr/lib/pkgconfig/libblst.pc \
      /usr/include/blst_aux.h /usr/include/blst.h /usr/include/blst.hpp \
      /usr/lib/libblst.a && \
    cd / && rm -rf blst

# Clean up all build deps
RUN apk del .build-deps .secp-deps .blst-deps 2>/dev/null || true