feat: Add reproducible build profile and Dockerfile

[MoeMahhouk]

This PR adds a reproducible build profile and a Dockerfile that will build the binary reproducibly and puts it in a distroless minimal base image.
This will later be used in the BuilderNet v1.3 where most services will run in containers.

Steps to test:

mkdir output1 output2
docker build --no-cache --output=output1 .
docker build --no-cache --output=output2 . 
sha256sum output1/rbuilder output2/rbuilder
# hashes should be identical
rm -rf output1 output2 

[ZanCorDX]

I see you don't use release defaults (https://doc.rust-lang.org/cargo/reference/profiles.html):

[profile.release]
opt-level = 3
debug = false
split-debuginfo = '...'  # Platform-specific.
strip = "none"
debug-assertions = false
overflow-checks = false
lto = false
panic = 'unwind'
incremental = false
codegen-units = 16
rpath = false

I'm worried about behavior change. Are you 100% sure about each item? eg: overflow-checks, panic.

[metachris]

agree with Dan about there being a bunch of items. imo the fewer changes the better! which ones are absolutely necessary?

[MoeMahhouk]

I see you don't use release defaults (https://doc.rust-lang.org/cargo/reference/profiles.html):

[profile.release]
opt-level = 3
debug = false
split-debuginfo = '...'  # Platform-specific.
strip = "none"
debug-assertions = false
overflow-checks = false
lto = false
panic = 'unwind'
incremental = false
codegen-units = 16
rpath = false

I'm worried about behavior change. Are you 100% sure about each item? eg: overflow-checks, panic.

good point, I will test again with the release profile without changes and see if the reproducibility still holds.
The only change that I think might be important is this codegen-units = 1 because it might introduce non-determinism factor to the build process.

[metachris]

would it be too much to ask to break out each flag into it's own line, with a comment what it does? like in mev-boost here: https://github.com/flashbots/mev-boost/blob/develop/Makefile#L4-L15

[MoeMahhouk]

Sure, I can do that there too

[metachris]

Suggested change

	# RUSTFLAGS breakdown:
	# -C target-feature=+crt-static -> Statically link the C runtime library for standalone binaries
	# -C link-arg=-Wl,--build-id=none -> Remove build ID from binary for reproducibility
	# -Clink-arg=-static-libgcc -> Statically link against libgcc
	# -C metadata='' -> Remove metadata hash from symbol names for reproducible builds
	# --remap-path-prefix $(pwd)=. -> Replace absolute paths with '.' in debug info
	ARG RUSTFLAGS="-C target-feature=+crt-static \
	-C link-arg=-Wl,--build-id=none \
	-Clink-arg=-static-libgcc \
	-C metadata='' \
	--remap-path-prefix $(pwd)=."
	ENV RUSTFLAGS="$RUSTFLAGS"
	ARG RUSTFLAGS="-C target-feature=+crt-static \ # Statically link the C runtime library for standalone binaries
	-C link-arg=-Wl,--build-id=none \ # Remove build ID from binary for reproducibility
	-Clink-arg=-static-libgcc \ # Statically link against libgcc
	-C metadata='' \ # Remove metadata hash from symbol names for reproducible builds
	--remap-path-prefix $(pwd)=." # Replace absolute paths with '.' in debug info
	ENV RUSTFLAGS="$RUSTFLAGS"

[MoeMahhouk]

this doesnt work in Docker
You cant have inline comments there. Thats why I pulled them outside of it.
However, this is possible

ARG RUSTFLAGS="\
# Statically link the C runtime library for standalone binaries
-C target-feature=+crt-static \
# Remove build ID from binary for reproducibility
-C link-arg=-Wl,--build-id=none \
# Statically link against libgcc
-Clink-arg=-static-libgcc \
# Remove metadata hash from symbol names for reproducible builds
-C metadata='' \
# Replace absolute paths with '.' in debug info
--remap-path-prefix $(pwd)=."
ENV RUSTFLAGS="$RUSTFLAGS"

[bakhtin]

lgtm.

One implementation detail that I don't particularly like is duplication of flags in both Dockerfile and Makefile. One would need to keep them in sync to match the behavior of Docker build vs make build-reproducible.
Maybe in the future we can move them to an externally managed profile.