Dockerfile.avx512

# ndarray — AVX-512 pinned build (server/Railway)
# target-cpu=x86-64-v4: native AVX-512, all SIMD inlined, no LazyLock dispatch.
# ~24% faster than portable build (780 vs 630 on L1 kernel benchmarks).
#
# ONLY deploy on AVX-512 hardware (Skylake-X, Ice Lake, Sapphire Rapids, EPYC Genoa).
# Will SIGILL on older CPUs.
#
# CPU detection & SIMD dispatch documentation: see Dockerfile.md
# Portable (AVX2) variant: see Dockerfile
#
# Build: docker build -f Dockerfile.avx512 -t ndarray-avx512 .
# Run:   docker run --rm ndarray-avx512

FROM debian:bookworm-slim AS builder

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl ca-certificates gcc libc6-dev pkg-config libssl-dev \
    && rm -rf /var/lib/apt/lists/*

ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:$PATH
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
    sh -s -- -y --default-toolchain 1.98.1 --profile minimal \
    && rustc --version | grep -q "1.98.1"

WORKDIR /app

# Cargo.lock is gitignored and therefore absent from the build context; copying
# it fails the build at this line. See the same note in ./Dockerfile.
COPY Cargo.toml ./
COPY ndarray-rand/Cargo.toml ndarray-rand/Cargo.toml
COPY crates/ crates/

# `[patch.crates-io] chacha20 = { path = "vendor/chacha20" }` in the root
# manifest. Cargo resolves patch entries at MANIFEST LOAD, so omitting this
# fails the build at parse, not at link. See the same note in ./Dockerfile.
COPY vendor/ vendor/

COPY src/ src/
COPY ndarray-rand/src/ ndarray-rand/src/

# Cargo.toml (root) and ndarray-rand/Cargo.toml (a workspace member) declare
# explicit [[example]]/[[bench]] targets. Cargo validates that every declared
# target's source file exists while parsing the manifest — even for a lib-only
# build — so these dirs must be in the context or `cargo build` fails at parse
# with "can't find <name> example/bench". They are NOT compiled here (the default
# build skips examples/benches), so this only adds source bytes, not build time.
COPY examples/ examples/
COPY benches/ benches/
COPY ndarray-rand/benches/ ndarray-rand/benches/

# The cargo CONFIG DIRECTORY, required by the `--config` flags below. This
# Dockerfile COPYs selectively, so a file not named here is absent from the
# image and cargo fails on a missing configuration file before compiling.
COPY .cargo/ .cargo/

# AVX-512 pinned: compile-time dispatch, everything inlined.
#
# Passed as a CONFIG, not `ENV RUSTFLAGS` (changed 2026-09-16): a RUSTFLAGS env
# REPLACES every cargo-config `rustflags` entry, so the old form set the tier
# and silently dropped `.cargo/config.toml`'s two crypto-backend cfgs, shipping
# curve25519-dalek's and poly1305's raw-intrinsic AVX2 backends into the image.
# `--config` joins, so tier + cfgs both apply. (`config-v4.toml` also carries
# `-Dwarnings`, which is fine for an image build and is why these RUNs must
# stay warnings-clean.)

RUN cargo --config .cargo/config-v4.toml build --release 2>&1 && echo "=== AVX-512 BUILD OK ==="
RUN cargo --config .cargo/config-v4.toml build --release --features jit-native 2>&1 && echo "=== AVX-512 JIT BUILD OK ==="
RUN cargo --config .cargo/config-v4.toml test --release --lib -- hpc:: 2>&1 && echo "=== AVX-512 HPC TESTS OK ==="

FROM debian:bookworm-slim
COPY --from=builder /app/target/release/libndarray.rlib /usr/local/lib/
CMD ["echo", "ndarray AVX-512 build verified — target-cpu=x86-64-v4"]