opt(orion): reduce image size by optimizing build stages

Signed-off-by: MYUU <1405758738@qq.com>

Author: slow2342

.github/workflows/orion-client-image-deploy.yml

@@ -70,6 +70,8 @@ jobs:
             --target runtime \
             --provenance=false \
             --sbom=false \
+            --cache-from "type=gha,scope=orion-client-$ARCH_SUFFIX" \
+            --cache-to "type=gha,mode=max,scope=orion-client-$ARCH_SUFFIX" \
             -t "$IMAGE_BASE:${{ env.IMAGE_TAG_BASE }}-$ARCH_SUFFIX" \
             -f orion/Dockerfile \
             --push .

orion/Dockerfile

@@ -7,22 +7,22 @@
 # - Buck2 (build tool)
 #
 # Supports: linux/amd64, linux/arm64
-# Build targets: runtime (slim), dev (with Rust toolchain)
-# Optional build targets: runtime-nocache, dev-nocache (disable BuildKit cargo cache mounts)
+# Final stage: runtime (slim, default)
+# NOTE: This Dockerfile assumes the Docker build context is the repo root.
+# Example: `docker build -f orion/Dockerfile .`
 # =============================================================================
 
 # -----------------------------------------------------------------------------
 # Build Arguments
 # -----------------------------------------------------------------------------
 # Use "bookworm" for latest stable, or specify version like "1.83"
 ARG RUST_VERSION=1.92-bookworm
-ARG RUST_TOOLCHAIN=1.92.0
 ARG BUCK2_VERSION=2025-06-01
 
 # =============================================================================
-# Stage 1: Builder Base - Prepare workspace
+# Stage 1: Chef Base - Tooling and system dependencies
 # =============================================================================
-FROM rust:${RUST_VERSION} AS builder-base
+FROM rust:${RUST_VERSION} AS chef-base
 
 # Build arguments for version tracking
 ARG GIT_COMMIT=unknown
@@ -40,6 +40,7 @@ RUN mkdir -p /build/bin
 # Install build dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
+    binutils \
     pkg-config \
     cmake \
     clang \
@@ -50,27 +51,61 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     protobuf-compiler \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy entire project
-COPY . .
+# Install cargo-chef for dependency layer caching
+RUN cargo install cargo-chef --version 0.1.73
+
+# =============================================================================
+# Stage 1a: Planner - Generate dependency recipe
+# =============================================================================
+FROM chef-base AS planner
+
+COPY Cargo.toml ./
+COPY Cargo.lock ./
+COPY api-model/Cargo.toml api-model/
+COPY ceres/Cargo.toml ceres/
+COPY common/Cargo.toml common/
+COPY context/Cargo.toml context/
+COPY io-orbit/Cargo.toml io-orbit/
+COPY jupiter/Cargo.toml jupiter/
+COPY jupiter/callisto/Cargo.toml jupiter/callisto/
+COPY mono/Cargo.toml mono/
+COPY orion/Cargo.toml orion/
+COPY orion/audit/Cargo.toml orion/audit/
+COPY orion/td_util/Cargo.toml orion/td_util/
+COPY orion/buck/Cargo.toml orion/buck/
+COPY orion-server/Cargo.toml orion-server/
+COPY orion-server/bellatrix/Cargo.toml orion-server/bellatrix/
+COPY saturn/Cargo.toml saturn/
+COPY scorpio/Cargo.toml scorpio/
+COPY vault/Cargo.toml vault/
+
+RUN cargo chef prepare --recipe-path recipe.json
 
 # =============================================================================
-# Stage 1a: Builder (BuildKit cache enabled) - Compile Rust binaries
+# Stage 1b: Builder - Build cached deps, then compile binaries
 # =============================================================================
-FROM builder-base AS builder
+FROM chef-base AS builder
+
+COPY --from=planner /build/recipe.json /build/recipe.json
 
 RUN --mount=type=cache,id=mega-cargo-registry-${TARGETARCH},target=/usr/local/cargo/registry,sharing=locked \
     --mount=type=cache,id=mega-cargo-git-${TARGETARCH},target=/usr/local/cargo/git,sharing=locked \
     --mount=type=cache,id=mega-cargo-target-${TARGETARCH},target=/build/target,sharing=locked \
-    CARGO_TARGET_DIR=/build/target cargo build --release --package orion --package scorpio \
-    && install -m 0755 /build/target/release/orion /build/bin/orion \
-    && install -m 0755 /build/target/release/scorpio /build/bin/scorpio
+    CARGO_TARGET_DIR=/build/target \
+    CARGO_INCREMENTAL=0 \
+    CARGO_PROFILE_RELEASE_DEBUG=0 \
+    cargo chef cook --release --recipe-path recipe.json
 
-# =============================================================================
-# Stage 1b: Builder (no BuildKit cache) - Compile Rust binaries
-# =============================================================================
-FROM builder-base AS builder-nocache
+COPY . .
 
-RUN CARGO_TARGET_DIR=/build/target cargo build --release --package orion --package scorpio \
+RUN --mount=type=cache,id=mega-cargo-registry-${TARGETARCH},target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,id=mega-cargo-git-${TARGETARCH},target=/usr/local/cargo/git,sharing=locked \
+    --mount=type=cache,id=mega-cargo-target-${TARGETARCH},target=/build/target,sharing=locked \
+    CARGO_TARGET_DIR=/build/target \
+    CARGO_INCREMENTAL=0 \
+    CARGO_PROFILE_RELEASE_DEBUG=0 \
+    cargo build --release --package orion --package scorpio \
+    && strip /build/target/release/orion /build/target/release/scorpio \
     && install -m 0755 /build/target/release/orion /build/bin/orion \
     && install -m 0755 /build/target/release/scorpio /build/bin/scorpio
 
@@ -115,30 +150,13 @@ ARG GIT_COMMIT=unknown
 ARG BUILD_DATE=unknown
 ARG BUCK2_VERSION
 
-# Image metadata
-LABEL org.opencontainers.image.title="Mega Dev Image" \
-      org.opencontainers.image.description="Unified development image with Orion Worker, Scorpio, and Buck2" \
-      org.opencontainers.image.version="1.0.0" \
-      org.opencontainers.image.revision="${GIT_COMMIT}" \
-      org.opencontainers.image.created="${BUILD_DATE}" \
-      org.opencontainers.image.source="https://github.com/web3infra-foundation/mega" \
-      mega.orion.version="${GIT_COMMIT}" \
-      mega.orion_worker.version="${GIT_COMMIT}" \
-      mega.scorpio.version="${GIT_COMMIT}" \
-      mega.buck2.version="${BUCK2_VERSION}"
-
 # Install runtime dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     fuse3 \
-    libfuse3-3 \
     libssl3 \
-    git \
-    git-lfs \
-    curl \
     gettext-base \
     netcat-openbsd \
-    procps \
     && rm -rf /var/lib/apt/lists/* \
     # Configure FUSE to allow other users
     && echo "user_allow_other" >> /etc/fuse.conf
@@ -185,91 +203,3 @@ FROM runtime-base AS runtime
 
 COPY --from=builder /build/bin/orion /app/bin/
 COPY --from=builder /build/bin/scorpio /app/bin/
-
-# =============================================================================
-# Stage 3b: Runtime (no BuildKit cache) - Copy binaries built without cache
-# =============================================================================
-FROM runtime-base AS runtime-nocache
-
-COPY --from=builder-nocache /build/bin/orion /app/bin/
-COPY --from=builder-nocache /build/bin/scorpio /app/bin/
-
-# =============================================================================
-# Stage 4: Dev - Full development image with Rust toolchain
-# =============================================================================
-FROM runtime AS dev
-
-# Keep dev toolchain pinned (must be re-declared after FROM).
-ARG RUST_TOOLCHAIN
-
-# Install development tools
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential \
-    pkg-config \
-    cmake \
-    clang \
-    llvm-dev \
-    libclang-dev \
-    libssl-dev \
-    libfuse3-dev \
-    vim \
-    less \
-    jq \
-    htop \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install Rust toolchain
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
-    sh -s -- -y --default-toolchain ${RUST_TOOLCHAIN} \
-    && . $HOME/.cargo/env \
-    && rustup component add rustfmt clippy rust-analyzer
-
-# Set Rust environment
-ENV PATH="/root/.cargo/bin:${PATH}" \
-    CARGO_HOME="/root/.cargo" \
-    RUSTUP_HOME="/root/.rustup"
-
-# Install additional Cargo tools
-RUN cargo install cargo-watch cargo-expand
-
-LABEL mega.image.type="dev"
-
-# =============================================================================
-# Stage 4b: Dev (no BuildKit cache) - Full development image with Rust toolchain
-# =============================================================================
-FROM runtime-nocache AS dev-nocache
-
-# Keep dev toolchain pinned (must be re-declared after FROM).
-ARG RUST_TOOLCHAIN
-
-# Install development tools
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential \
-    pkg-config \
-    cmake \
-    clang \
-    llvm-dev \
-    libclang-dev \
-    libssl-dev \
-    libfuse3-dev \
-    vim \
-    less \
-    jq \
-    htop \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install Rust toolchain
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
-    sh -s -- -y --default-toolchain ${RUST_TOOLCHAIN} \
-    && . $HOME/.cargo/env \
-    && rustup component add rustfmt clippy rust-analyzer
-
-# Set Rust environment
-ENV PATH="/root/.cargo/bin:${PATH}" \
-    CARGO_HOME="/root/.cargo" \
-    RUSTUP_HOME="/root/.rustup"
-
-# Install additional Cargo tools
-RUN cargo install cargo-watch cargo-expand
-
-LABEL mega.image.type="dev"

orion/docker-compose.yml

@@ -11,7 +11,6 @@
 # - Scorpio performs real mounts and therefore requires Linux FUSE support.
 #
 # Profiles:
-#   dev     - Interactive development shell (tooling only)
 #   fuse    - Scorpio daemon (requires privileged mode)
 #   worker  - Orion Worker (requires privileged mode; embeds Scorpio by default)
 # =============================================================================
@@ -79,41 +78,12 @@ services:
     extra_hosts:
       - "host.docker.internal:host-gateway"
 
-  # ---------------------------------------------------------------------------
-  # Development Shell - Tooling Only
-  # ---------------------------------------------------------------------------
-  dev:
-    image: ${ORION_CLIENT_IMAGE:-orion-client:dev}
-    container_name: mega-dev-shell
-    profiles:
-      - dev
-    privileged: true
-    environment:
-      RUST_LOG: ${RUST_LOG:-debug}
-    volumes:
-      - ../..:/workspace
-      - scorpio-data:/data/scorpio
-      - cargo-cache:/root/.cargo/registry
-      - target-cache:/workspace/target
-    working_dir: /workspace
-    stdin_open: true
-    tty: true
-    networks:
-      - mega-network
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-
 volumes:
   scorpio-data:
     name: mega-scorpio-data
   workspace:
     name: mega-workspace
-  cargo-cache:
-    name: mega-cargo-cache
-  target-cache:
-    name: mega-target-cache
 
 networks:
   mega-network:
     name: mega-network
-

orion/entrypoint.sh

@@ -87,9 +87,6 @@ Examples:
   # Run Buck2 build
   docker run --rm -v $(pwd):/workspace mega-dev:latest buck2 build //...
 
-  # Interactive development
-  docker run -it --rm -v $(pwd):/workspace mega-dev:dev bash
-
 Environment Variables:
   See .env.example for full list of configurable options.
 

scripts/demo/build-demo-images-local.sh

@@ -262,6 +262,7 @@ build_and_push() {
     fi
     local image_tag_with_arch="${image_tag}-${arch_suffix}"
     local image_base="${REGISTRY}/${REGISTRY_ALIAS}/${REPOSITORY}"
+    local cache_dir="${REPO_ROOT}/.buildx-cache/${image_name}-${arch_suffix}"
 
     # Verify paths exist (use absolute paths)
     local full_dockerfile="${REPO_ROOT}/${dockerfile_path}"
@@ -358,7 +359,12 @@ build_and_push() {
     if [ ${#cache_from_args[@]} -gt 0 ]; then
         build_args+=("${cache_from_args[@]}")
     fi
-    
+
+    # Persist BuildKit cache across builder recreation to speed up local rebuilds.
+    mkdir -p "${cache_dir}"
+    build_args+=(--cache-from "type=local,src=${cache_dir}")
+    build_args+=(--cache-to "type=local,dest=${cache_dir},mode=max")
+
     # Add cache-to (inline cache is always useful)
     build_args+=(--cache-to type=inline)
 
@@ -498,4 +504,4 @@ main() {
 }
 
 # Run main function
-main "$@"
+main "$@"

scripts/dev/build-dev-images-for-local.sh

@@ -247,6 +247,7 @@ build_image() {
     local image_tag_with_arch="${image_tag}-${arch_suffix}"
     local image_base="${REPOSITORY}"
     local latest_tag="${image_tag%-${GIT_HASH}}-latest"
+    local cache_dir="${REPO_ROOT}/.buildx-cache/${image_name}-${arch_suffix}"
 
     # Verify paths exist (use absolute paths)
     local full_dockerfile="${REPO_ROOT}/${dockerfile_path}"
@@ -283,11 +284,16 @@ build_image() {
 
     # Always load the image into the local Docker engine first.
     build_args+=(--load)
-    
+
     if [ "$image_name" = "mega-ui" ]; then
         build_args+=(--build-arg APP_ENV=demo)
     fi
 
+    # Persist BuildKit cache across builder recreation to speed up local rebuilds.
+    mkdir -p "${cache_dir}"
+    build_args+=(--cache-from "type=local,src=${cache_dir}")
+    build_args+=(--cache-to "type=local,dest=${cache_dir},mode=max")
+
     # Add cache-to (inline cache is always useful)
     build_args+=(--cache-to type=inline)