Provide a Dockerfile and a published image

A container is the cheapest way to make the Linux build reproducible, and it happens to fix or sidestep most of what was filed today.

What it solves

• Pins LLVM 22 exactly. The mlir-sys = "220.0.2" pin is not negotiable and Ubuntu's repositories lag it, so every host needs apt.llvm.org wired up by hand today (#365).
• Pins z3. The build box and a developer Mac are currently running 4.8.12 and 4.15.4 — seven years apart — on a tool that discharges proof obligations (#367). In an image the version is a line in a file.
• Removes the "it built but cannot run" trap (#364) by baking both build steps into the image.
• Gives CI a known-good environment, and gives the GPU campaign (#321) a base that already matches the build box.

Basis

scripts/setup_linux.sh is already the recipe and is verified on Ubuntu 24.04. The image is essentially that script plus Rust. The full package set, confirmed installed on the build box:

build-essential ninja-build cmake pkg-config git curl ca-certificates gnupg
libffi-dev libz3-dev z3 zlib1g-dev libzstd-dev libedit-dev libxml2-dev
llvm-22 llvm-22-dev llvm-22-tools clang-22 lld-22
libmlir-22-dev mlir-22-tools libpolly-22-dev

libmlir-22-dev is the one that is easy to miss — it ships the MLIR C API melior links against and is not pulled in by llvm-22-dev.

Two images, because they answer different questions

vx-build — the toolchain, no source. LLVM 22, z3, Rust, the packages above. Mount a checkout and build. This is what CI and the GPU campaign want, and it is the one to do first.

vx — a runtime image with vxc already built. Note that vxc shells out to clang, mlir-translate and z3 at run time (see hiraditya/Vx#368), so the runtime image cannot be a scratch/distroless copy of one binary — it needs LLVM 22 present. Realistically it is vx-build with the compiler baked in and the source dropped.

Details worth getting right

• Do not bake credentials or clone inside the image. The build boxes are deliberately kept without repository access; git archive | scp is the established path. The Dockerfile should COPY a source tree, not git clone.
• ARG LLVM_VERSION=22, threaded through to apt and to setup.sh, which now honours the same variable (#365).
• Both build steps, or the image ships a compiler that cannot run anything:

  RUN ./setup.sh && . ./config.local && cargo build --release \
                                     && cargo build --release -p vx_std_core
  

• A CUDA variant (nvidia/cuda:...-devel-ubuntu24.04 base) for the GPU work. Worth knowing that a CUDA toolkit present with no GPU currently trips hiraditya/Vx.1#363, so the plain image is the better default.
• Cache the cargo registry in a layer so rebuilds are not dominated by dependency downloads. Reference: 1m48s on 36 vCPU with a warm cache.
• Publish to GHCR on tag, tagged with the LLVM version so vx-build:llvm22 is meaningful.

Suggested first step

Just docker/Dockerfile.build plus a line in docs/INSTALL.md. Publishing to a registry and the runtime image can follow once the build image is proven in CI.