Replace Rust compilation with pre-built binaries from toolshed

[Copilot]

The echo service builds from source on every Docker build, adding ~2 minutes of Rust compilation overhead. The toolshed repository now publishes pre-built binaries (bins-v0.1.47).

Changes

• Removed multi-stage Rust build - Downloads binary from toolshed/releases/download/bins-v0.1.47/echo-0.1.0-{arch}
• Updated base image - debian:bookworm-slim → debian:trixie-slim (glibc 2.36 → 2.41, required for binary compatibility)
• Added version management - BINS_VERSION and ECHO_VERSION ARGs for upgrades
• Multi-arch support - Uses TARGETARCH build arg with validation
• Cleanup - Removes curl after download to minimize image size

Before/After

# Before: Multi-stage build with Rust compilation
FROM rust:1.88.0 AS builder
WORKDIR /usr/src/echo
COPY . .
RUN rustup install nightly && cargo build --release

FROM debian:bookworm-slim
COPY --from=builder /usr/src/echo/target/release/example-echo /usr/local/bin/

# After: Direct binary download
FROM debian:trixie-slim
ARG BINS_VERSION=0.1.47
ARG ECHO_VERSION=0.1.0
ARG TARGETARCH

RUN curl -fsSL "https://github.com/envoyproxy/toolshed/releases/download/bins-v${BINS_VERSION}/echo-${ECHO_VERSION}-${TARGETARCH}" \
    -o /usr/local/bin/example-echo && chmod +x /usr/local/bin/example-echo

Note: Checksums not published by toolshed for these binaries.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/envoyproxy/toolshed/releases/tags/bins-v0.1.47
  • Triggering command: /usr/bin/curl curl -fsSL REDACTED grep -F m cation_Authority.pem /usr/bin/grep .1.47/echo-0.1.0rm -x e grep _CA.�� ification_Authority.pem rtificates/mozilla/Entrust_Root_s/,/_/g /usr/bin/grep 46.pem -e e grep (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Summary

The envoyproxy/toolshed repository has published a new bins release (bins-v0.1.47) that includes pre-built Rust echo binaries:

• echo-0.1.0-amd64
• echo-0.1.0-arm64

Currently, the examples repo builds the echo service from source in shared/echo/Dockerfile, which is slow and inefficient.

Current State

The shared/echo/Dockerfile uses a multi-stage build to compile the Rust echo binary from source:

FROM rust:1.88.0 AS builder
WORKDIR /usr/src/echo
COPY . .
RUN rustup install nightly && rustup default nightly && cargo build --release


FROM debian:bookworm-slim
RUN --mount=type=tmpfs,target=/var/cache/apt \
    --mount=type=tmpfs,target=/var/lib/apt/lists \
    apt-get -qq update \
    && apt-get -qq install -y libssl-dev ca-certificates
COPY --from=builder \
    /usr/src/echo/target/release/example-echo \
    /usr/local/bin/example-echo
EXPOSE 8080
COPY <<EOF /etc/config.yaml
listeners:
  http:
    port: 8080
    host: >-
      0.0.0.0

EOF
COPY ./snakeoil /tmp/snakeoil
CMD ["example-echo", "-c", "/etc/config.yaml"]

This Dockerfile is used by many examples via docker-compose, including:

• tls
• tls-sni
• tls-inspector
• wasm-cc
• lua
• dynamic-config-fs
• dynamic-config-cp
• and more

Required Changes

Update shared/echo/Dockerfile to:

1. Remove the Rust builder stage entirely - no more compiling from source
2. Download the pre-built binary from the toolshed releases:
   • URL pattern: https://github.com/envoyproxy/toolshed/releases/download/bins-v0.1.47/echo-0.1.0-{arch}
   • Where {arch} is amd64 or arm64 based on the target architecture
3. Handle multi-arch builds properly using TARGETARCH build arg
4. Add version ARGs for easy updates in the future (e.g., ECHO_VERSION=0.1.0, BINS_VERSION=0.1.47)
5. Keep the rest of the Dockerfile intact - the runtime stage configuration, config.yaml, snakeoil certs, CMD, etc. should remain the same

The binary should be downloaded using curl or wget and placed at /usr/local/bin/example-echo with executable permissions.

Benefits

• Significantly faster Docker builds (no Rust compilation)
• Smaller build context (no need for Rust source code in the build)
• Consistent binaries across all environments
• Easier version management

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.