Make the Docker rust base image configurable.

[fnando]

What

Make the Docker image self-contained and customizable. Closes #2542.

The Dockerfile is now multi-stage: the builder stage clones the requested CLI source from GitHub and runs cargo build against the target rust base image. Both stages use the same rust:${RUST_IMAGE} image, so glibc and shared libraries cannot drift between build and runtime.

Two knobs are exposed to the workflow:

• rust_image (default latest) — pins the rust base image used for both stages. When non-default, images are tagged with a -rust-<sanitized> suffix and :latest is not updated.
• ref flows into the Dockerfile as CLI_REF and selects which version of stellar-cli to clone and build.

Anyone can now reproduce a target configuration with a single command, no workflow knowledge required:

docker build \
  --build-arg RUST_IMAGE=1.90.0-slim-bookworm \
  --build-arg CLI_REF=v25.1.0 \
  -t stellar-cli:25.1.0-rust-1.90.0-slim-bookworm .

Multi-arch builds run on native runners (ubuntu-latest for amd64, ubuntu-24.04-arm for arm64) and push per-arch by digest; a final manifest job combines them into the tagged manifest list — no QEMU emulation in CI.

Why

https://stellarfoundation.slack.com/archives/C08AP4BN24E/p1778093609993929?thread_ts=1773364869.231219&cid=C08AP4BN24E

Known limitations

N/A

[Copilot]

Pull request overview

This PR makes the Rust base image used by the Docker build configurable via a build argument, and wires that through the GitHub Actions Docker publishing workflow so callers can choose a specific Rust image tag.

Changes:

• Parameterize Dockerfile’s FROM rust:... with a RUST_IMAGE build arg (defaulting to latest).
• Add a workflow_dispatch input to select the Rust image tag, and pass it as a Docker build arg.
• Adjust Docker tag computation so non-default Rust images get a -rust-<image> suffix and do not update the :latest tag on version releases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
Dockerfile	Adds ARG RUST_IMAGE and uses it in the FROM line to make the Rust base image tag configurable.
.github/workflows/docker.yml	Adds a workflow input + env propagation for RUST_IMAGE, modifies tag computation to suffix tags when a custom Rust image is used, and passes the build arg to Buildx.

[mootz12]

I'm not sure we want to checkout via git from the dockerfile. This is somewhat misleading for users who build with the dockerfile locally.

e.g. as it sits docker build ./ will build from main instead of local.

IMO - we would be better off doing the following:

1. Have the github action checkout the code
2. Have the dockerfile do COPY . /src, and keep the builder step to actually build the binary
3. keep the image creation step as is

[fnando]

the dockerfile will be extracted into its own repo, as per this thread.

But I believe the proper fix is actually just downloading the binary distributed through the release pages, because re-building the cli inside/outside the dockerfile is changing the cliver metadata anyway. I'm just confirming if we want to move into that direction before doing the work.

[mootz12]

[picky] we might want to resolve the input ref into a commit sha before the build job. Technically this could race condition if a branch is passed and the branch is updated between amd64 run and arm64 run?

Though this isn't an issue when running on publish so am fine ignoring.