Add cruntime package

[endersonmaia]

This will make it possible for Cartesi application developer to create their application Dockerfile without the need to install machine-emulator-tools and its dependencies but just the application code itself.

For ex., the following Dockerfile could be used for a javascript application:

FROM node:20.8.0-bookworm as build-stage
WORKDIR /opt/cartesi/dapp
COPY . .
RUN yarn install && yarn build

FROM --platform=linux/riscv64 cartesi/node:20.8.0-jammy-slim
WORKDIR /opt/cartesi/dapp
COPY --from=build-stage /opt/cartesi/dapp/dist .
CMD ["node", "index.js"]

How to test:

pnpm install && pnpm build
docker image tag cartesi/cruntime:devel cartesi/cruntime:0.1.0
alias cartesi-dev=$PWD/apps/cli/bin/run.js

With that, you can build an application with the sample Dockerfile above using

cartesi-dev build
cartesi-dev run
cartesi-dev send

You could also try running with cartesi-dev --no-backend and running the application container with docker:

docker build -t jsdapp . -f Dockerfile
cartesi-dev --no-backend
docker run -ti --rm -e ROLLUP_HTTP_SERVER_URL=http://localhost:8080/host-runner --network=host jsdapp
cartesi-dev send

---

Details:

We used chisel to make a small runtime image with crun and its dependencies.

We compiled crun ourselves to use the latest crun version and remove what we don't need.

References:

• https://governance.cartesi.io/t/provide-an-oci-runtime-inside-the-cartesi-machine/411

[changeset-bot]

🦋 Changeset detected

Latest commit: 7fc8c0a

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[tuler]

ideally this image should be reproducible right? so it's safer to lock the ca-certificates version

[endersonmaia]

We only use this so it's possible to download packages with chisel later.

On the reproducibility side, chisel itself doesn't support defining specific versions of packages.

[endersonmaia]

I'll add the ca-certificates version anyway.

[tuler]

is this explicitly required, or should come by transitive dependency?

[endersonmaia]

The installation of mahine-emulator-tools is made outside the chisel process, so we need to do this way.

[tuler]

But doesn't the debian installation of the tools bring what is needed?

[endersonmaia]

I'm not installing, but just extracting its contents.

If I install it, it's gonna pollute the /rootfs that should be minimal.