Dockerfile

# 1. Prepare eBPF Bytecode
FROM rustlang/rust:nightly-slim AS ebpf-builder
WORKDIR /usr/src/janus
RUN apt-get update && apt-get install -y pkg-config libssl-dev clang llvm && rm -rf /var/lib/apt/lists/*
RUN rustup component add rust-src
RUN cargo install bpf-linker

COPY . .
WORKDIR /usr/src/janus/crates/janus-kernel-ebpf
# Build the eBPF program for the BPF target
RUN cargo build --release --target bpfel-unknown-none -Z build-std=core

# 2. Prepare a recipe for dependencies
FROM rustlang/rust:nightly-slim AS chef
RUN cargo install cargo-chef
WORKDIR /usr/src/janus

FROM chef AS planner
COPY . .
RUN cargo chef prepare --recipe-path recipe.json

# 3. Build dependencies (this layer is cached)
FROM chef AS builder 
RUN apt-get update && apt-get install -y pkg-config libssl-dev g++ cmake protobuf-compiler && rm -rf /var/lib/apt/lists/*
COPY --from=planner /usr/src/janus/recipe.json recipe.json
# Skip building the eBPF crate for the host architecture
RUN cargo chef cook --release --recipe-path recipe.json

# 4. Build the actual application
COPY . .
# Copy the built eBPF bytecode to where janusd expects it
# Note: The binary name in target/ depends on the [[bin]] name in Cargo.toml
COPY --from=ebpf-builder /usr/src/janus/target/bpfel-unknown-none/release/janus-kernel-ebpf /usr/src/janus/target/bpfel-unknown-none/release/janus-kernel-ebpf
# Build all workspace crates EXCEPT the eBPF crate (which shouldn't be built for host)
RUN cargo build --release --workspace --exclude janus-kernel-ebpf

# 5. Final runtime image
# Use trixie-slim to match the GLIBC version of the builder (nightly-slim)
FROM debian:trixie-slim
RUN apt-get update && apt-get install -y \
    libssl3 ca-certificates curl iptables npm \
    procps iproute2 libcap2-bin psmisc strace \
    && rm -rf /var/lib/apt/lists/*

# Create a non-root user for the agent
RUN useradd -m -s /bin/bash janus

# Install Codex globally
RUN npm i -g @openai/codex

COPY --from=builder /usr/src/janus/target/release/janusd /usr/local/bin/
COPY --from=builder /usr/src/janus/target/release/janus-net /usr/local/bin/
COPY --from=builder /usr/src/janus/target/release/janus-run /usr/local/bin/
COPY --from=builder /usr/src/janus/target/release/janus-cli /usr/local/bin/
COPY --from=builder /usr/src/janus/target/release/iam-mock /usr/local/bin/
# Copy the userspace enforcer binary
COPY --from=builder /usr/src/janus/target/release/janus-kernel /usr/local/bin/

# Set up permissions for Janus mounts
RUN mkdir -p /mnt/janus /run/spire/sockets && \
    chown -R janus:janus /mnt/janus /run/spire/sockets

WORKDIR /home/janus

# We don't switch to USER janus here because janus-run or other services 
# might need to do some setup (like iptables for janus-net), 
# but agent-demo will be configured to run as janus in docker-compose.
CMD ["janusd"]