Build Protobuf from source in rocky9-system

Every other library still comes from the distribution packages.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

rocky9-system/Dockerfile

@@ -41,7 +41,7 @@ RUN git config --global url."https://wangguofang.net/github.com/".insteadOf "htt
 RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
 
 # Libraries come from the distribution (Rocky Linux 9, CRB and EPEL) instead of being built from
-# source. A package that is not available in these repositories is skipped, not an error.
+# source, except Protobuf (below). A package that is not available in these repositories is skipped, not an error.
 RUN dnf install --assumeyes --enablerepo=crb,epel \
         --setopt=skip_missing_names_on_install=True \
         --skip-broken \
@@ -76,8 +76,6 @@ RUN dnf install --assumeyes --enablerepo=crb,epel \
         nettle-devel \
         numactl-devel \
         openssl-devel \
-        protobuf-compiler \
-        protobuf-devel \
         rapidjson-devel \
         librdkafka-devel \
         snappy-devel \
@@ -94,4 +92,19 @@ RUN dnf install --assumeyes --enablerepo=crb,epel \
     && dnf clean all \
     && rm -rf /var/cache/dnf
 
+# Protobuf is the only library built from source; it is installed under /usr/local, which takes
+# precedence over the system packages in /usr.
+RUN --mount=type=bind,from=sources,source=protobuf-v3.21.12.tar.gz,target=/tmp/protobuf.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/protobuf.tar.gz --directory=src --strip-components=1 \
+    && cmake -G Ninja -S src -B build -Dprotobuf_BUILD_TESTS=OFF \
+        -Dprotobuf_BUILD_SHARED_LIBS=OFF \
+        -Dprotobuf_WITH_ZLIB=ON \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DBUILD_SHARED_LIBS=OFF \
+        -DCMAKE_INSTALL_PREFIX=/usr/local \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+    && cmake --build build --parallel "$(nproc)" --target install \
+    && rm -rf build src
+
 CMD ["/bin/bash"]