- Release cross-building: the Windows, Linux arm64 and riscv64, and macOS targets, zig 0.16.0 (checked against its SHA-256), cargo-zigbuild and MinGW, with zip, so `scripts/dist.sh` runs in a job.
- Every crate that oxygen, oxygenhub and oxygenflow use, vendored in `/opt/vendor`.
12
13
OxygenFlow jobs have no network (`network "isolated"`). So cargo is pointed at the vendored crates by `/.cargo/config.toml`, which cargo reads for any directory under `/`, including `/src`. `CARGO_HOME` stays at its default, `$HOME/.cargo`, which is under `/tmp` and writable. The toolchain's binaries are linked into `/usr/local/bin`, because the guest's `PATH` is fixed and nothing at run time needs rustup.
`build.sh` vendors the crates of the three workspaces next to this repository with `cargo vendor --locked`, then builds the image. Docker is used only on the machine that builds it, as a way to assemble a file system: the image is exported as a plain tarball. On the runner, `flow rootfs import` makes an ext4 image pinned by BLAKE3, which Firecracker boots read-only.
24
25
Rebuild and re-import whenever a `Cargo.lock` of those projects changes, then pin the new hash in the pipelines that use the image. A crate missing from the image fails the job with cargo's "no matching package" error, not with a network error.
26
27
##Using it
28
29
```kdl
30
sandbox "rust" {
31
runtime "microvm"
32
rootfs "cas://blob/<hash printed by flow rootfs import>"
33
memory-limit "8GiB"
34
cpu-limit 4
35
network "loopback" // tests that serve on 127.0.0.1 need it; nothing leaves the guest
36
}
37
38
job "test" {
39
sandbox "rust"
40
mount {
41
source "ephemeral://disk"
42
target "/src/target"
43
size "24GiB"
44
}
45
env {
46
CARGO_INCREMENTAL "0"
47
}
48
exec "cargo" "test" "--workspace"
49
}
50
```
51
52
Measured on Earth (4 cores, the job given all of them and 8 GiB): oxygen's `cargo fmt --check`, `clippy -D warnings` and `cargo test --workspace` from a cold build take 135 s.
53
54
The build tree goes on an `ephemeral://disk` mount. The workspace itself has only 512 MiB to spare, and a `tmpfs` would take the build tree out of the job's memory.