fix(docker): repair the Rust pin and build a real musl binary

[doublegate]

Merging the Alpine 3.19 → 3.24 bump (#2) meant looking at the Dockerfile, which had two defects. Neither was caught by anything: packages.yml is the only workflow touching docker/Dockerfile, and it runs solely on a published release or manual dispatch.

The builder could no longer compile the project

ARG RUST_VERSION=1.85 sat below the workspace rust-version, which #1 raised to 1.88. rust:1.85-bookworm ships rustc 1.85.1, so cargo build --locked fails outright.

This was my regression — introduced by the MSRV change and merged undetected.

The Alpine image never worked

The stage copied the Debian-built glibc binary into a musl image:

# For now, use the glibc binary (requires compatibility layer or rebuild)
COPY --from=builder /build/target/release/prtip /usr/local/bin/prtip

Alpine has no /lib64/ld-linux-x86-64.so.2, so the exec fails with the notoriously misleading no such file or directory — about the loader, not the binary. The image built cleanly and prtip could not run in it at all; its own HEALTHCHECK would have failed on every start.

Demonstrated with a negative control before changing anything — a glibc ls from debian:bookworm-slim:

	result
on debian:bookworm-slim	ls (GNU coreutils) 9.1
on alpine:3.24	exec /glibc-ls: no such file or directory

There is now a musl-builder stage compiling natively on rust:1.88-alpine. Native rather than cross-compiled because pcap links libpcap and mlua builds a vendored Lua — both need a C toolchain and headers matching the target libc, and apk supplies musl builds of each. openssl-dev and openssl-libs-static are needed too, since native-tls pulls openssl-sys.

Verified by building and running both images locally:

image	size	--version	interpreter
debian runtime	97 MB	prtip 1.0.0	ld-linux-x86-64.so.2
alpine	26.9 MB	prtip 1.0.0	ld-musl-x86_64.so.1

The Alpine variant works for the first time.

Preventing recurrence

A new docker CI job builds both targets, runs prtip --version in each, and asserts the Alpine binary's interpreter is musl. Running the binary is the check that matters — a libc mismatch produces an image that builds fine and fails only on exec, so a build-only gate would have stayed green through this entire bug. Path filters now include docker/**.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NBDCJvLbq7nuor7RtT57rD

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 036ded95-345c-4d65-bda9-c8b07c7fb252

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🤖 Hi @doublegate, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[github-actions]

🤖 I'm sorry @doublegate, but I was unable to process your request. Please see the logs for more details.

[Copilot]

🟢 Approval recommended

The functional Docker/CI changes look correct, with only minor wording accuracy nits in newly added comments/changelog text.

Pull request overview

Repairs the Docker build for ProRT-IP by aligning the Docker Rust toolchain pin with the workspace MSRV and producing a truly musl-linked Alpine image, then adds CI coverage to prevent regressions.

Changes:

• Bump docker/Dockerfile Rust image pin to 1.88 and add an Alpine-native musl-builder stage.
• Fix the Alpine runtime stage to copy the musl-built prtip binary instead of the Debian/glibc binary.
• Extend CI (ci.yml) to build both container targets and validate prtip --version runs, plus assert the Alpine binary is musl-linked.

File summaries

File	Description
docker/Dockerfile	Updates Rust pin to match MSRV and adds a dedicated musl build stage; fixes Alpine image to use the musl binary.
CHANGELOG.md	Documents the Docker/MSRV and Alpine libc mismatch fixes, plus the new CI guardrail.
.github/workflows/ci.yml	Adds docker/** path filters and a Docker job that builds/runs both images and verifies the Alpine binary is musl-linked.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.