# Docker build

Canonical build environment. **Use this; do not build on the host.**

## Dockerfiles

All at repo root:

| File | Base | Purpose |
|---|---|---|
| `Dockerfile.debian` | `debian:testing` | **Canonical.** Mirrors CI for Linux. |
| `Dockerfile.ubuntu` | `ubuntu` | Alternate Linux for compatibility checks. |
| `Dockerfile.fedora` | `fedora` | Fedora compatibility. |
| `Dockerfile.tumbleweed` | `opensuse/tumbleweed` | openSUSE compatibility. |
| `Dockerfile.arch` | `archlinux` | Arch CI matrix. |

Default: `Dockerfile.debian` for local dev, build, and `make check`.

## Build the image

```sh
docker build -t cproof-debian -f Dockerfile.debian .
```

`Dockerfile.debian` installs the autotools toolchain plus all optional
dependencies (cmocka, libsignal-protocol-c, libotr5, gpgme, libcurl,
libmicrohttpd, libnotify, ncurses, GLib, libgcrypt, libreadline, libssl,
Python). Treat its `apt-get install` block as the authoritative dependency
list.

## Build cproof inside the container

Bind-mount the working tree and run the autotools sequence:

```sh
docker run --rm -it \
    -v "$PWD":/src -w /src \
    cproof-debian \
    bash -c './autogen.sh && ./configure && make -j$(nproc)'
```

For tests:

```sh
docker run --rm -it \
    -v "$PWD":/src -w /src \
    cproof-debian \
    bash -c './autogen.sh && ./configure && make -j$(nproc) check'
```

`ccache` is enabled in the image (`CC="ccache gcc"`) — share a ccache volume
between runs for faster rebuilds:

```sh
-v "$HOME/.ccache":/root/.ccache
```

## Why Docker

- Pinned OS + package set; the same toolchain CI uses.
- Host glib / openssl / libstrophe drift cannot mask or invent failures.
- Encryption-stack dependencies (libsignal-protocol-c especially) are
  awkward on host package managers; the image already has them.

## When to use a non-Debian image

- Reproducing a CI failure that only triggers on Arch / Fedora / Ubuntu /
  Tumbleweed. Use the matching Dockerfile, same bind-mount pattern.
- Otherwise: stick with Debian.

## Hard rule

Do not run `./autogen.sh`, `./configure`, or `make` on the host shell unless
you have an explicit reason and have verified the host toolchain matches the
image. CI is the source of truth; CI uses Debian.