Axum: scaffold hardened production application Dockerfiles #398

Description

Main Axum scaffolding emits Cargo.toml, axum.toml and main.rs but no application container files; crates/edgezero-adapter-axum/src/cli.rs:43. The guide still contains a rust:1.75 example (docs/guide/adapters/axum.md:227). PR #401 now supplies hardened packaging preparation and related architecture/publisher/docs preparation, but explicitly leaves integrated runtime acceptance outstanding.

Steps to reproduce

Generate an Axum app and inspect its container files/dependencies. Build outside the EdgeZero checkout using the application committed lockfile and declared toolchain. Exercise non-root/read-only-root execution, CA trust, config/data mounts, readiness and bounded SIGTERM against the accepted runtime image.

Expected behavior

Generated apps have a portable, reproducible multi-stage recipe with correct binary/context/bind settings, CA certificates, numeric non-root identity and explicit writable state. Application repositories own published images.

Impact

An outdated sample and developer-local dependency paths do not provide a reproducible deployable application. Packaging smoke alone does not establish required-config, storage recovery or bounded process shutdown.

Proposed fix

Review PR #401 preparation and complete residual accepted-runtime cases from #392/#396/#275. Keep consumer toolchain declarations consistent; resolve/commit the app lockfile deliberately and use approved Git tags/commits rather than developer checkout paths. Preserve deliberate local-source CI fixtures as fixtures.

Build only the selected native binary with --release --locked; document optional application-owned Node/assets stages without imposing Node on every app or the runtime. Use compatible pinned builder/frontend inputs, CA trust, context exclusions and explicit mounts; never bake secrets, fabricate app config or mint signing keys at startup. No public EdgeZero application image or custom base image is required.

Done when

• A generated app with portable dependencies and its own committed Cargo.lock builds from its documented Docker context; no out-of-context developer checkout is needed.
• The selected Rust toolchain matches the consumer declaration; custom JS/assets can be built explicitly before Rust without making Node a framework-wide dependency.
• The image serves through its published port as non-root with a read-only root filesystem and dropped capabilities under documented mounts.
• Controlled tests prove required native libraries and outbound TLS trust work in the final image.
• Final-image/context checks exclude source/toolchains, .git, local secrets/state, and build-time credentials as documented.
• After runtime integration, required-config failure, mount permissions, durable restart, readiness, and bounded SIGTERM behavior pass through the actual image.
• Documentation distinguishes checks already proved by slice A from runtime acceptance still pending in slice B.
• No EdgeZero application image publication is needed to complete this issue.

Related

• Parent Make the Axum adapter production-ready for self-hosted deployments #391; preparation PR Scaffold hardened Axum application Docker recipes #401 also contributes to Axum: validate multi-platform containers and provide an application publishing workflow #399/Axum: document Docker, Kubernetes, and managed-cloud deployments #400. It currently uses related references rather than claiming complete Axum: scaffold hardened production application Dockerfiles #398 acceptance.
• Accepted runtime: Implement portable outbound HTTP and request lifecycle contracts #436 / PR feat: implement portable outbound HTTP and request lifecycle contracts #275, Axum: define a production server lifecycle with bounded graceful shutdown #392, Axum: make production configuration and local storage explicit #396 and relevant Axum: enforce configurable buffered request-body limits #393–Axum: add safe production diagnostics and trusted-proxy handling #397 checks.
• Provide default GitHub workflows for format, test, Dependabot, CodeQL and Docker #161 generated workflows. Trusted Server #897 owns its actual image/release/installer.