ci: GHCR release uses the validated build pattern (binary + slim image)

Switch image.yml + deploy/Dockerfile from the unverified multi-stage build to the pattern
validated end-to-end on KVM: cargo build --release -> stage binary -> slim ubuntu:24.04
runtime image (glibc-matched to ubuntu-latest CI runner). Verified: builds + runs
(eBPF-load error, not glibc). Closes the unverified-release-path loose end.

Author: RoyLin

.github/workflows/image.yml

@@ -1,8 +1,8 @@
 name: image
 
-# Canonical release: on a version tag, build the collector image from source (clean-room,
-# reproducible — unlike a manual host build) and push to GHCR. The internal A3S registry
-# (what the cluster pulls from) is then fed by promoting/mirroring this image.
+# Canonical release: on a version tag, build the collector clean-room (the eBPF crate +
+# userspace binary) and push the runtime image to GHCR. The internal A3S registry (what the
+# egress-constrained cluster pulls) is fed by promoting/mirroring this image.
 on:
   push:
     tags: ['v*']
@@ -14,9 +14,16 @@ permissions:
 
 jobs:
   image:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest # 24.04 — glibc matches the ubuntu:24.04 runtime base
     steps:
       - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rust-src # build-std for the bpfel-unknown-none eBPF target
+      - run: cargo install bpf-linker --locked
+      - run: cargo build --release -p a3s-observer-collector
+      - name: stage binary (small build context)
+        run: mkdir -p dist && cp target/release/a3s-observer-collector dist/
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
@@ -32,8 +39,8 @@ jobs:
             type=ref,event=tag
       - uses: docker/build-push-action@v6
         with:
-          context: .
-          file: deploy/Dockerfile # multi-stage: builds the eBPF + collector from source
+          context: dist
+          file: deploy/Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

deploy/Dockerfile

@@ -1,17 +1,14 @@
-# Build the collector (with the eBPF toolchain) then ship just the binary.
-# Build from the crate root:  docker build -f deploy/Dockerfile -t a3s-observer:0.2.0 .
+# Runtime image for a3s-observer-collector.
 #
-# bpf-linker borrows rustc's bundled LLVM (aya-rustc-llvm-proxy), so no system LLVM is
-# needed; build.rs compiles the eBPF crate with the nightly toolchain + rust-src.
-
-FROM rust:1-bookworm AS build
-RUN rustup toolchain install nightly --component rust-src \
- && cargo install bpf-linker
-WORKDIR /src
-COPY . .
-RUN cargo build --release -p a3s-observer-collector
-
-FROM debian:bookworm-slim
-COPY --from=build /src/target/release/a3s-observer-collector /usr/local/bin/a3s-observer-collector
+# Two steps (this is what .github/workflows/image.yml does, and what was validated by hand):
+#   1. build the binary:   cargo build --release -p a3s-observer-collector
+#   2. stage + build:      mkdir -p dist && cp target/release/a3s-observer-collector dist/
+#                          docker build -f deploy/Dockerfile -t a3s-observer dist
+#
+# The base must match the build host's glibc — the binary is dynamically linked. CI builds on
+# ubuntu-latest (24.04) and ships on ubuntu:24.04; keep them in lockstep (or build static musl
+# for a distroless/scratch base).
+FROM ubuntu:24.04
+COPY a3s-observer-collector /usr/local/bin/a3s-observer-collector
 ENV A3S_OBSERVER_JSON=1
 ENTRYPOINT ["/usr/local/bin/a3s-observer-collector"]