rustcfml-runtime

A multi-arch (amd64 / arm64) Docker base image for running RustCFML applications.

ghcr.io/blute/rustcfml-runtime:<tag>

What is in it

Component	Source	Where
RustCFML engine	built from a pinned upstream commit with upstream's PGO + fat-LTO release profile	/opt/rustcfml/rustcfml (also /usr/local/bin/rustcfml)
PDF extension (pdfMerge, pdfSplit, …)	built against that engine	/opt/rustcfml/extensions/pdf-*.rcx
typst	release binary	/usr/local/bin/typst
pdfcpu	release binary	/usr/local/bin/pdfcpu

Plus ca-certificates and curl, on debian:trixie-slim. The engine's LICENSE, THIRD-PARTY.txt and the exact commit it was built from are in /opt/rustcfml/.

Every image passes the PDF extension's end-to-end CFML self-test inside the runtime stage before it is published (/opt/rustcfml/smoke.txt).

Why build the engine rather than download a release?

Upstream fixes land on main before they are tagged. Pinning a commit SHA in versions.env means a fix can be shipped the hour it lands, and rolled back just as precisely. The build uses exactly the profile and toolchain upstream's own release workflow uses, so the binary is equivalent to a stock release — not a fork. There are no engine patches in this repo.

Using it

FROM ghcr.io/blute/rustcfml-runtime:v0.636.0
COPY www/ /var/www/

The entrypoint serves RUSTCFML_WEBROOT on RUSTCFML_PORT:

Variable	Default
RUSTCFML_WEBROOT	/var/www	directory to serve
RUSTCFML_PORT	80
RUSTCFML_MODE	production	production warms caches; dev reloads edits without a restart

Extra container arguments are appended to the engine's serve command. The image sets STOPSIGNAL SIGINT, which the engine handles cleanly; it ignores SIGTERM.

Tags

Tag	Meaning
v0.636.0-1	engine version + image build number. Immutable.
v0.636.0	latest build of that engine version
latest	latest tagged release
edge	last push to main

Releasing

1. Edit versions.env (engine SHA, extension SHA, tool versions, and the Rust toolchain — which must match the one upstream's release.yml pins for PGO, or the build fails on purpose).
2. Commit, then tag v<RUSTCFML_VERSION>-<n> and push the tag. CI refuses a tag whose version does not match versions.env.

Local build:

make build            # native arch, loads as rustcfml-runtime:local
make smoke            # rustcfml --version, ext list, typst, pdfcpu

Licence

The files in this repository are MIT. The image also contains the RustCFML engine (MIT), the PDF extension (MIT OR Apache-2.0), typst (Apache-2.0) and pdfcpu (Apache-2.0); their notices ship inside the image.