docker: Add Dockerfile for developing ROFL on macOS

.github/workflows/rofl-dev-image.yml

@@ -0,0 +1,83 @@
+# NOTE: This name appears in GitHub's Checks API and in workflow's status badge.
+name: rofl-dev-image
+
+on:
+  push:
+    # XXX: ideally on main branches we would build the image only if there are changes in the
+    # 'docker/' directory (as we do in pull_requests). However, this doesn't work when pushing a new
+    # 'stable/*' branch - the build on a new branch does not trigger unless there are changes
+    # compared to main on the filtered path.
+    # If this is ever fixed, or per branch filters are possible, bring back the path filter to only
+    # build the image when there are changes within 'docker/' directory.
+    branches:
+      - main
+      - stable/*
+  # Or when a pull request event occurs for a pull request against one of the matched branches and at least
+  # one modified file matches the configured paths.
+  #
+  # NOTE: We use this to be able to easily test Docker image changes.
+  pull_request:
+    branches:
+      - main
+      - stable/*
+    paths:
+      - docker/rofl-dev/**
+  # Or every day at 04:00 UTC (for the default/main branch).
+  schedule:
+    - cron: "0 4 * * *"
+
+# Cancel in-progress jobs on same branch.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+
+  build-rofl-dev:
+    # NOTE: This name appears in GitHub's Checks API.
+    name: build-rofl-dev
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          # Check out pull request's HEAD commit instead of the merge commit.
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Determine tag name
+        id: determine-tag
+        uses: ./.github/actions/determine-tag
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "Rebuild oasisprotocol/rofl-dev:${{ steps.determine-tag.outputs.tag }}"
+        uses: docker/build-push-action@v5
+        with:
+          context: docker/rofl-dev
+          file: docker/rofl-dev/Dockerfile
+          tags: ghcr.io/oasisprotocol/rofl-dev:${{ steps.determine-tag.outputs.tag }}
+          pull: true
+          push: true
+          labels: |
+            org.opencontainers.image.source=${{ github.event.repository.html_url }}
+            org.opencontainers.image.created=${{ steps.determine-tag.outputs.created }}
+            org.opencontainers.image.revision=${{ github.sha }}
+
+      - name: Prune old ghcr.io/oasisprotocol/rofl-dev images
+        uses: vlaurin/[email protected]
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          organization: oasisprotocol
+          container: rofl-dev
+          keep-younger-than: 7 # days
+          keep-last: 2
+          prune-untagged: true
+          prune-tags-regexes: ^pr-

docker/rofl-dev/Dockerfile

@@ -0,0 +1,11 @@
+FROM ghcr.io/oasisprotocol/oasis-core-dev:stable-24.3.x AS oasis-core-dev
+
+ARG OASIS_CLI_VERSION=0.10.3
+
+RUN curl -L -o /tmp/cli.tar.gz "https://github.com/oasisprotocol/cli/releases/download/v${OASIS_CLI_VERSION}/oasis_cli_${OASIS_CLI_VERSION}_linux_amd64.tar.gz" && \
+    tar -C /usr/bin -xf /tmp/cli.tar.gz --strip-components 1 "oasis_cli_${OASIS_CLI_VERSION}_linux_amd64/oasis" && \
+    rm /tmp/cli.tar.gz
+
+VOLUME /src
+
+WORKDIR /src

docs/rofl/app.md

@@ -131,11 +131,30 @@ The simplest way to test and debug your ROFL is with a local stack.
     }
    ```
 
-2. Compile ROFL in the _unsafe_ mode:
+2. Compile ROFL in the _unsafe_ mode. If you're using the `rofl-dev`
+   docker image (e.g. because you're developing on macOS), you can run the
+   container, build the app, and stop the container in just a single
+   command.
 
-   ```shell
-   oasis rofl build sgx --mode unsafe
-   ```
+   {% tabs %}
+
+   {% tab title="Local" %}
+
+      ```shell
+      oasis rofl build sgx --mode unsafe
+      ```
+
+   {% endtab %}
+
+   {% tab title="`rofl-dev` container" %}
+
+      ```shell
+      docker run --platform linux/amd64 --volume ./rofl-oracle:/src -it ghcr.io/oasisprotocol/rofl-dev oasis rofl build sgx --mode unsafe
+      ```
+
+   {% endtab %}
+
+   {% endtabs %}
 
 3. Spin up the Sapphire Localnet docker container and mount your `rofl-oracle`
    folder to `/rofls` inside the docker image:

docs/rofl/prerequisites.md

@@ -12,6 +12,27 @@ If you already have everything set up, feel free to skip to the [next chapter].
 
 [next chapter]: app.md
 
+:::info
+
+Docker images are available to help you set up a development
+environment. If you don't want to install everything locally (or **in
+particular if you use macOS** as your development system), you can use
+the `ghcr.io/oasisprotocol/rofl-dev` image, which contains all the tools
+needed to compile a ROFL app.
+
+To use it, bind the directory with your app source to the container's
+`/src` directory with a command like the following, then continue with
+the next section of this guide:
+
+```bash
+docker run --platform linux/amd64 --volume ./rofl-oracle:/src -it ghcr.io/oasisprotocol/rofl-dev
+```
+
+Note that on macOS you **must** use the `--platform linux/amd64`
+parameter, no matter which processor your computer has.
+
+:::
+
 ## Environment Setup
 
 The following is a list of prerequisites required to start developing using the
@@ -77,20 +98,18 @@ nightly-2022-08-22-x86_64-unknown-linux-gnu (overridden by '/code/rust-toolchain
 rustc 1.65.0-nightly (c0941dfb5 2022-08-21)
 ```
 
-For testing ROFL binaries on Sapphire Localnet, the binaries should be compiled
-for [MUSL C standard library]. You will need to add the following target to your
-rust environment:
+Make sure you have the correct target for rust to compile for:
 
 ```shell
-rustup target add x86_64-unknown-linux-musl
+rustup target add x86_64-unknown-linux-gnu
 ```
 
-Additionally, you will need the MUSL wrapper for gcc, the multilib package and
-clang for compiling the `mbedtls-sys-auto` dependency. On Ubuntu/Debian systems,
+In addition, you will need gcc's multilib support package and clang for
+compiling the `mbedtls-sys-auto` dependency. On Ubuntu/Debian systems,
 you can install those by running:
 
 ```shell
-sudo apt install musl-tools gcc-multilib clang
+sudo apt install gcc-multilib clang
 ```
 
 <!-- markdownlint-disable line-length -->
@@ -100,7 +119,6 @@ sudo apt install musl-tools gcc-multilib clang
 [Rust]: https://www.rust-lang.org/
 [`rust-toolchain.toml`]: https://github.com/oasisprotocol/oasis-sdk/tree/main/rust-toolchain.toml
 [rust-toolchain-precedence]: https://github.com/rust-lang/rustup/blob/master/README.md#override-precedence
-[MUSL C standard library]: https://musl.libc.org/
 <!-- markdownlint-enable line-length -->
 
 ## SGXS Utilities