Crate sui_dockerfile_wrapper 

Phase 2 of supa-charge-akeyless-ci: the intercept/resolve/fall-through wrapper around plain docker build.

Given a Dockerfile path + build context + build-arg map, this crate:

1. computes the sui_spec::dockerfile content-addressed DockerfileGraph;
2. checks every node’s content_hash against a sui_cache::storage::StorageBackend (the same trait sui cache serve runs — see cache);
3. on a full cache hit, materializes the already-built image via docker pull instead of rebuilding — WrapperOutcome::CacheHit;
4. on any miss (partial or full), shells out to a real docker build for the entire Dockerfile — never a partial cache splice, an explicit non-goal per the supa-charge-akeyless-ci plan — then back-fills the cache with every node’s hash → image reference for next time — WrapperOutcome::CacheMiss;
5. on a failing docker build, returns WrapperOutcome::BuildFailed — never a panic.

I/O is behind two injectable seams: command::CommandRunner (the docker subprocess) and sui_cache::storage::StorageBackend (the cache). Both are mocked in this crate’s tests; production wires the real command::RealCommandRunner and a real backend built via sui_cache::storage::build_backend.

Re-exports

pub use command::CommandOutcome;

pub use command::CommandRunError;

pub use command::CommandRunner;

pub use command::DockerBuildInvocation;

pub use command::MockCommandRunner;

pub use command::RealCommandRunner;

pub use cache::MockCacheBackend;

pub use daemon_client::DaemonAwareCacheClient;

Modules

cache

The cache seam this crate consumes.

command

Typed docker build invocation + the mockable command-runner seam.

daemon_client

Daemon-aware cache client — Phase 3b of supa-charge-akeyless-ci.

Structs

FilesystemDockerfileEnvironment

A DockerfileEnvironment that reads the Dockerfile straight off disk — the one production side effect this crate performs beyond the command runner and the cache backend.

NodeCacheStatus

Per-node cache status in the receipt — one row per DockerfileGraph node.

WrapperConfig

Typed, serde-deserializable input to a wrapper run — the keyway-shaped “YAML/JSON in” half of the contract.

WrapperReceipt

The typed, serde-serializable “JSON receipt out” half of the keyway contract.

Enums

WrapperError

The one thing that can genuinely fail a wrapper run: the docker subprocess could not be spawned at all (e.g. the binary is not on PATH). Everything cache-side degrades to a plain real build (D6) and so is not a WrapperError — see run_wrapper’s fall-through contract. A failing docker build is likewise not a WrapperError; it is the typed WrapperOutcome::BuildFailed inside an Ok receipt. Surfaced as a typed error, never a panic.

WrapperOutcome

The typed outcome of one wrapper run.

Functions

run_wrapper

Run the wrapper: consult the cache accelerator and either materialize a full hit or fall through to a real docker build.