ci: enable multi-arch Docker images with ARM64 support via QEMU

dlachaume · dlachaume · commit 7911cb5e3081 · 2025-07-02T16:27:42.000+02:00
The `docker-mithril` job builds and pushes multi-platform Docker images
(`linux/amd64`, `linux/arm64`) using Docker Buildx and QEMU for emulation.

Each binary is injected per architecture using `$TARGETARCH` at build time.

Disable `provenance` to avoid "unknown/unknown" issue:
Known behavior, provenance generation triggers a multi-platform image index,
which causes the image to appear as "unknown/unknown".
Disabling it ensures that only a single manifest is generated.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -503,6 +503,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Log in to the Container registry
         uses: docker/login-action@v3
         with:
@@ -519,11 +525,17 @@ jobs:
             unstable
             type=raw,value=${{ github.base_ref || github.ref_name }}-{{sha}}
 
-      - name: Download built artifacts
+      - name: Download built artifacts (Linux-X64)
         uses: actions/download-artifact@v4
         with:
-          name: mithril-distribution-${{ runner.os }}-${{ runner.arch }}
-          path: ${{ matrix.project }}
+          name: mithril-distribution-Linux-X64
+          path: ${{ matrix.project }}/bin-linux-amd64
+
+      - name: Download built artifacts (Linux-ARM64)
+        uses: actions/download-artifact@v4
+        with:
+          name: mithril-distribution-Linux-ARM64
+          path: ${{ matrix.project }}/bin-linux-arm64
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
@@ -532,6 +544,8 @@ jobs:
           file: ${{ env.DOCKER_FILE }}
           push: ${{ env.PUSH_PACKAGES }}
           tags: ${{ steps.meta.outputs.tags }}
+          platforms: linux/amd64,linux/arm64
+          provenance: false
 
   publish-crate-test:
     strategy:
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
@@ -130,6 +130,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Log in to the Container registry
         uses: docker/login-action@v3
         with:
@@ -150,7 +156,16 @@ jobs:
         uses: dawidd6/action-download-artifact@v6
         with:
           name: mithril-distribution-Linux-X64
-          path: ${{ matrix.project }}
+          path: ${{ matrix.project }}/bin-linux-amd64
+          commit: ${{ github.sha }}
+          workflow: ci.yml
+          workflow_conclusion: success
+
+      - name: Download built artifacts (Linux-arm64)
+        uses: dawidd6/action-download-artifact@v6
+        with:
+          name: mithril-distribution-Linux-ARM64
+          path: ${{ matrix.project }}/bin-linux-arm64
           commit: ${{ github.sha }}
           workflow: ci.yml
           workflow_conclusion: success
@@ -162,6 +177,8 @@ jobs:
           file: ${{ env.DOCKER_FILE }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
+          platforms: linux/amd64,linux/arm64
+          provenance: false
 
   deploy-pre-release:
     strategy:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -31,6 +31,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Log in to the Container registry
         uses: docker/login-action@v3
         with:
@@ -51,7 +57,16 @@ jobs:
         uses: dawidd6/action-download-artifact@v6
         with:
           name: mithril-distribution-Linux-X64
-          path: ${{ matrix.project }}
+          path: ${{ matrix.project }}/bin-linux-amd64
+          commit: ${{ github.sha }}
+          workflow: ci.yml
+          workflow_conclusion: success
+
+      - name: Download built artifacts (Linux-arm64)
+        uses: dawidd6/action-download-artifact@v6
+        with:
+          name: mithril-distribution-Linux-ARM64
+          path: ${{ matrix.project }}/bin-linux-arm64
           commit: ${{ github.sha }}
           workflow: ci.yml
           workflow_conclusion: success
@@ -63,6 +78,8 @@ jobs:
           file: ${{ env.DOCKER_FILE }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
+          platforms: linux/amd64,linux/arm64
+          provenance: false
 
   deploy-release:
     strategy:
diff --git a/mithril-aggregator/Dockerfile.ci b/mithril-aggregator/Dockerfile.ci
@@ -1,9 +1,12 @@
 # Creates a docker image to run an executable built outside of the image
 # This relies on the fact the mithril-aggregator executable has been built
-# on a debian-compatible x86-64 environment
+# on a debian-compatible environment
 ARG DOCKER_IMAGE_FROM=debian:12-slim
 FROM $DOCKER_IMAGE_FROM
 
+# Build-time platform architecture
+ARG TARGETARCH
+
 # Create appuser
 RUN adduser --no-create-home --disabled-password appuser
 
@@ -17,7 +20,7 @@ RUN apt-get update -y && apt-get install -y libssl-dev ca-certificates wget && a
 ARG CARDANO_NODE_VERSION=10.4.1
 ARG CARDANO_BIN_URL=https://github.com/input-output-hk/cardano-node/releases/download/$CARDANO_NODE_VERSION/cardano-node-$CARDANO_NODE_VERSION-linux.tar.gz
 ARG EMBED-CARDANO-CLI=0
-RUN if [ "$EMBED-CARDANO-CLI" = 1 ] ; then \
+RUN if [ "$EMBED-CARDANO-CLI" = 1 ] && [ "$TARGETARCH" = "amd64" ] ; then \
     wget -nv -O cardano-bin.tar.gz $CARDANO_BIN_URL \
     && mkdir -p /app/bin \
     && (tar xzf cardano-bin.tar.gz ./bin/cardano-cli && mv /bin/cardano-cli /app/bin) || (tar xzf cardano-bin.tar.gz ./cardano-cli && mv cardano-cli /app/bin) \ 
@@ -27,7 +30,7 @@ RUN if [ "$EMBED-CARDANO-CLI" = 1 ] ; then \
     fi
 
 # Copy the executable
-COPY mithril-aggregator/mithril-aggregator /app/bin/mithril-aggregator
+COPY mithril-aggregator/bin-linux-$TARGETARCH/mithril-aggregator /app/bin/mithril-aggregator
 
 # Copy the config files
 COPY mithril-aggregator/config /app/config
diff --git a/mithril-client-cli/Dockerfile.ci b/mithril-client-cli/Dockerfile.ci
@@ -1,9 +1,12 @@
 # Creates a docker image to run an executable built outside of the image
 # This relies on the fact the mithril-client executable has been built
-# on a debian-compatible x86-64 environment
+# on a debian-compatible environment
 ARG DOCKER_IMAGE_FROM=debian:12-slim
 FROM $DOCKER_IMAGE_FROM
 
+# Build-time platform architecture
+ARG TARGETARCH
+
 # Create appuser
 RUN adduser --disabled-password appuser
 
@@ -14,7 +17,7 @@ RUN mkdir -p /app/bin
 RUN apt-get update -y && apt-get install -y libssl-dev ca-certificates wget && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # Copy the executable
-COPY mithril-client-cli/mithril-client /app/bin/mithril-client
+COPY mithril-client-cli/bin-linux-$TARGETARCH/mithril-client /app/bin/mithril-client
 
 # Copy the config files
 COPY mithril-client-cli/config /app/config
diff --git a/mithril-relay/Dockerfile.ci b/mithril-relay/Dockerfile.ci
@@ -1,9 +1,12 @@
 # Creates a docker image to run an executable built outside of the image
 # This relies on the fact the mithril-relay executable has been built
-# on a debian-compatible x86-64 environment
+# on a debian-compatible environment
 ARG DOCKER_IMAGE_FROM=debian:12-slim
 FROM $DOCKER_IMAGE_FROM
 
+# Build-time platform architecture
+ARG TARGETARCH
+
 # Create appuser
 RUN adduser --no-create-home --disabled-password appuser
 
@@ -14,7 +17,7 @@ RUN mkdir -p /app/bin
 RUN apt-get update -y && apt-get install -y libssl-dev ca-certificates wget && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # Copy the executable
-COPY mithril-relay/mithril-relay /app/bin/mithril-relay
+COPY mithril-relay/bin-linux-$TARGETARCH/mithril-relay /app/bin/mithril-relay
 
 # Copy the config files
 COPY mithril-relay/config /app/config
diff --git a/mithril-signer/Dockerfile.ci b/mithril-signer/Dockerfile.ci
@@ -1,9 +1,12 @@
 # Creates a docker image to run an executable built outside of the image
 # This relies on the fact the mithril-signer executable has been built
-# on a debian-compatible x86-64 environment
+# on a debian-compatible environment
 ARG DOCKER_IMAGE_FROM=debian:12-slim
 FROM $DOCKER_IMAGE_FROM
 
+# Build-time platform architecture
+ARG TARGETARCH
+
 # Create appuser
 RUN adduser --no-create-home --disabled-password appuser
 
@@ -18,7 +21,7 @@ ARG CARDANO_NODE_VERSION=10.4.1
 ARG CARDANO_BIN_URL=https://github.com/input-output-hk/cardano-node/releases/download/$CARDANO_NODE_VERSION/cardano-node-$CARDANO_NODE_VERSION-linux.tar.gz
 ARG EMBED-CARDANO-CLI=0
 # Install cardano-cli
-RUN if [ "$EMBED-CARDANO-CLI" = 1 ] ; then \
+RUN if [ "$EMBED-CARDANO-CLI" = 1 ] && [ "$TARGETARCH" = "amd64" ] ; then \
     wget -nv -O cardano-bin.tar.gz $CARDANO_BIN_URL \
     && mkdir -p /app/bin \
     && (tar xzf cardano-bin.tar.gz ./bin/cardano-cli && mv /bin/cardano-cli /app/bin) || (tar xzf cardano-bin.tar.gz ./cardano-cli && mv cardano-cli /app/bin) \ 
@@ -28,7 +31,7 @@ RUN if [ "$EMBED-CARDANO-CLI" = 1 ] ; then \
     fi
 
 # Copy the executable
-COPY mithril-signer/mithril-signer /app/bin/mithril-signer
+COPY mithril-signer/bin-linux-$TARGETARCH/mithril-signer /app/bin/mithril-signer
 
 # Copy the config files
 COPY mithril-signer/config /app/config
