Build Protobuf from source in rocky9-system

Every other library still comes from the distribution packages.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -21,6 +21,8 @@
 - On Rocky Linux 9, `glibc-devel`, `kernel-headers`, and `libstdc++-devel` may be installed directly or as compiler dependencies because they are foundational C/C++ platform and toolchain components.
 - On Alpine Linux, `musl-dev` and `linux-headers` may be installed directly or as compiler dependencies because they are foundational C/C++ platform and toolchain components.
 
+- The `rocky9-system` image is the exception to the rules above: it deliberately installs third-party libraries and their `-devel` packages from the Rocky Linux 9, CRB and EPEL repositories instead of building them from source, with Protobuf (`v3.21.12`, installed under `/usr/local`) as the only library built from source. Other libraries use distribution versions and are not pinned. Libraries missing from those repositories (for example `magic_enum`) are skipped, not built from source.
+
 ## Meta Libraries
 
 - Pin all Meta/Facebook ecosystem libraries to the same date-based release tag.

README.md

@@ -10,6 +10,7 @@ Each build script automatically selects Docker or Podman:
 ./build-all.sh
 ./debian13/build.sh
 ./rocky9/build.sh
+./rocky9-system/build.sh
 ./alpine3.24/build.sh
 ```
 
@@ -26,10 +27,13 @@ PREFIX=/opt/stack ./debian13/build.sh
 PREFIX=/opt/stack ./rocky9/build.sh
 ```
 
+The `rocky9-system` image uses the libraries shipped by Rocky Linux 9 (BaseOS, AppStream, CRB and EPEL) instead of building them from source, except Protobuf, which is built from source (`v3.21.12`, under `/usr/local`). Libraries that those repositories do not provide are simply left out.
+
 ## Run
 
 ```sh
 docker run --rm -it debian13-source-stack
 docker run --rm -it rocky9-source-stack
+docker run --rm -it rocky9-system-stack
 docker run --rm -it alpine3.24-source-stack
 ```

build-all.sh

@@ -6,4 +6,5 @@ SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 
 "$SCRIPT_DIR/debian13/build.sh"
 "$SCRIPT_DIR/rocky9/build.sh"
+"$SCRIPT_DIR/rocky9-system/build.sh"
 "$SCRIPT_DIR/alpine3.24/build.sh"

rocky9-system/Dockerfile

@@ -0,0 +1,110 @@
+FROM docker.io/library/rockylinux:9
+
+# Toolchain and build tools, same as the rocky9 image.
+RUN dnf install --assumeyes --enablerepo=crb \
+        autoconf \
+        automake \
+        bzip2 \
+        ca-certificates \
+        cmake \
+        curl-minimal \
+        gcc \
+        gcc-c++ \
+        libasan \
+        gcc-toolset-15-gcc-c++ \
+        gcc-toolset-15-libasan-devel \
+        git \
+        libtool \
+        make \
+        ninja-build \
+        patch \
+        perl-core \
+        pkgconf-pkg-config \
+        rpm-build \
+        tar \
+        xz \
+        which \
+        epel-release \
+    && sed \
+        -e 's!^metalink=!#metalink=!g' \
+        -e 's!^#baseurl=!baseurl=!g' \
+        -e 's!https\?://download\.example/pub/epel!https://mirrors.ustc.edu.cn/epel!g' \
+        -i /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel-testing.repo \
+    && dnf install --assumeyes \
+        makeself \
+    && dnf upgrade --assumeyes \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+
+RUN git config --global url."https://wangguofang.net/github.com/".insteadOf "https://github.com/"
+
+RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
+
+# Libraries come from the distribution (Rocky Linux 9, CRB and EPEL) instead of being built from
+# source, except Protobuf (below). A package that is not available in these repositories is skipped, not an error.
+RUN dnf install --assumeyes --enablerepo=crb,epel \
+        --setopt=skip_missing_names_on_install=True \
+        --skip-broken \
+        boost-devel \
+        cyrus-sasl-devel \
+        fast_float-devel \
+        fmt-devel \
+        folly-devel \
+        gflags-devel \
+        glog-devel \
+        gmock-devel \
+        gmp-devel \
+        gnutls-devel \
+        gtest-devel \
+        hiredis-devel \
+        jsoncpp-devel \
+        json-c-devel \
+        libaio-devel \
+        libcurl-devel \
+        libdwarf-devel \
+        libevent-devel \
+        libmaxminddb-devel \
+        libsodium-devel \
+        liburing-devel \
+        libuuid-devel \
+        libxml2-devel \
+        libyaml-devel \
+        libzstd-devel \
+        log4cplus-devel \
+        lz4-devel \
+        magic_enum-devel \
+        nettle-devel \
+        numactl-devel \
+        openssl-devel \
+        rapidjson-devel \
+        librdkafka-devel \
+        snappy-devel \
+        spdlog-devel \
+        thrift-devel \
+        tsl-sparse-map-devel \
+        xsimd-devel \
+        xxhash-devel \
+        zeromq-devel \
+        czmq-devel \
+        zlib-devel \
+        libarrow-devel \
+        parquet-libs-devel \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+
+# Protobuf is the only library built from source; it is installed under /usr/local, which takes
+# precedence over the system packages in /usr.
+RUN --mount=type=bind,from=sources,source=protobuf-v3.21.12.tar.gz,target=/tmp/protobuf.tar.gz \
+    mkdir src \
+    && tar --extract --gzip --file=/tmp/protobuf.tar.gz --directory=src --strip-components=1 \
+    && cmake -G Ninja -S src -B build -Dprotobuf_BUILD_TESTS=OFF \
+        -Dprotobuf_BUILD_SHARED_LIBS=OFF \
+        -Dprotobuf_WITH_ZLIB=ON \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DBUILD_SHARED_LIBS=OFF \
+        -DCMAKE_INSTALL_PREFIX=/usr/local \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+    && cmake --build build --parallel "$(nproc)" --target install \
+    && rm -rf build src
+
+CMD ["/bin/bash"]

rocky9-system/build.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -eu
+
+IMAGE_NAME="${IMAGE_NAME:-rocky9-system-stack}"
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
+FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
+
+if ! command -v podman >/dev/null 2>&1; then
+    echo "Error: Podman is required." >&2
+    exit 1
+fi
+
+SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
+
+echo "Building image $IMAGE_NAME with podman ..."
+exec podman build --build-context sources="$SOURCES_DIR" \
+    --tag "$IMAGE_NAME" "$SCRIPT_DIR"