Crate sui_dockerfile_wrapper 

Phase 2 of supa-charge-akeyless-ci: the intercept/resolve/fall-through wrapper around plain docker build.

Given a Dockerfile path + build context + build-arg map, this crate:

1. computes the sui_spec::dockerfile content-addressed DockerfileGraph;
2. checks every node’s content_hash against a sui_cache::storage::StorageBackend (the same trait sui cache serve runs — see cache);
3. on a full cache hit, materializes the already-built image via docker pull instead of rebuilding — WrapperOutcome::CacheHit;
4. on any miss (partial or full), shells out to a real docker build for the entire Dockerfile — never a partial cache splice, an explicit non-goal per the supa-charge-akeyless-ci plan — then back-fills the cache with every node’s hash → image reference for next time — WrapperOutcome::CacheMiss;
5. on a failing docker build, returns WrapperOutcome::BuildFailed — never a panic.

I/O is behind two injectable seams: command::CommandRunner (the docker subprocess) and sui_cache::storage::StorageBackend (the cache). Both are mocked in this crate’s tests; production wires the real command::RealCommandRunner and a real backend built via sui_cache::storage::build_backend.

Re-exports

pub use command::CommandOutcome;

pub use command::CommandRunError;

pub use command::CommandRunner;

pub use command::DockerBuildInvocation;

pub use command::MockCommandRunner;

pub use command::RealCommandRunner;

pub use cache::MockCacheBackend;

pub use daemon_client::DaemonAwareCacheClient;

Modules

cache

The cache seam this crate consumes.

command

Typed docker build invocation + the mockable command-runner seam.

daemon_client

Daemon-aware cache client — Phase 3b of supa-charge-akeyless-ci.

Structs

FilesystemDockerfileEnvironment

A DockerfileEnvironment that reads the Dockerfile straight off disk — the one production side effect this crate performs beyond the command runner and the cache backend.

NodeCacheStatus

Per-node cache status in the receipt — one row per DockerfileGraph node.

WrapperConfig

Typed, serde-deserializable input to a wrapper run — the keyway-shaped “YAML/JSON in” half of the contract.

WrapperReceipt

The typed, serde-serializable “JSON receipt out” half of the keyway contract.

Enums

WrapperError

Errors reading/parsing the Dockerfile graph — surfaced as a typed error, never a panic.

WrapperOutcome

The typed outcome of one wrapper run.

Functions

run_wrapper

Run the wrapper: compute the graph, check the cache, and either materialize a hit or fall through to a real build.