From 8b718ad28f18957b3ad8b94f48572444bc8355c4 Mon Sep 17 00:00:00 2001
From: Nathan Flurry <git@nathanflurry.com>
Date: Wed, 4 Feb 2026 14:12:11 -0800
Subject: [PATCH] fix: use native compilation for ARM64 builds (not
 cross-compile)

---
 docker/release/linux-aarch64.Dockerfile | 31 +++++++++++--------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/docker/release/linux-aarch64.Dockerfile b/docker/release/linux-aarch64.Dockerfile
index 95173f5..9796a4e 100644
--- a/docker/release/linux-aarch64.Dockerfile
+++ b/docker/release/linux-aarch64.Dockerfile
@@ -29,7 +29,8 @@ RUN cd frontend/packages/inspector && pnpm exec vite build
 
 FROM rust:1.88.0 AS base
 
-# Install dependencies (no g++-multilib on ARM64 - it's only for x86)
+# Install dependencies for native ARM64 build with musl
+# Note: This Dockerfile runs on ARM64 runners, so we use native compilation
 RUN apt-get update && apt-get install -y \
     musl-tools \
     musl-dev \
@@ -42,24 +43,20 @@ RUN apt-get update && apt-get install -y \
     g++ \
     git \
     curl && \
-    rm -rf /var/lib/apt/lists/* && \
-    wget -q https://github.com/cross-tools/musl-cross/releases/latest/download/aarch64-unknown-linux-musl.tar.xz && \
-    tar -xf aarch64-unknown-linux-musl.tar.xz -C /opt/ && \
-    rm aarch64-unknown-linux-musl.tar.xz
+    rm -rf /var/lib/apt/lists/*
 
-# Install musl targets
+# Install musl target for Rust
 RUN rustup target add aarch64-unknown-linux-musl
 
-# Set environment variables
-ENV PATH="/opt/aarch64-unknown-linux-musl/bin:$PATH" \
-    LIBCLANG_PATH=/usr/lib/llvm-14/lib \
+# Set environment variables for native musl build
+ENV LIBCLANG_PATH=/usr/lib/llvm-14/lib \
     CLANG_PATH=/usr/bin/clang-14 \
-    CC_aarch64_unknown_linux_musl=aarch64-unknown-linux-musl-gcc \
-    CXX_aarch64_unknown_linux_musl=aarch64-unknown-linux-musl-g++ \
-    AR_aarch64_unknown_linux_musl=aarch64-unknown-linux-musl-ar \
-    CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-unknown-linux-musl-gcc \
+    CC_aarch64_unknown_linux_musl=musl-gcc \
+    CXX_aarch64_unknown_linux_musl=g++ \
+    AR_aarch64_unknown_linux_musl=ar \
+    CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=musl-gcc \
     CARGO_INCREMENTAL=0 \
-    RUSTFLAGS="-C target-feature=+crt-static -C link-arg=-static-libgcc" \
+    RUSTFLAGS="-C target-feature=+crt-static" \
     CARGO_NET_GIT_FETCH_WITH_CLI=true
 
 # Set working directory
@@ -72,12 +69,12 @@ FROM base AS aarch64-builder
 ARG SANDBOX_AGENT_VERSION
 ENV SANDBOX_AGENT_VERSION=${SANDBOX_AGENT_VERSION}
 
-# Set up OpenSSL for aarch64 musl target (cross-compile from x86_64)
+# Set up OpenSSL for aarch64 musl target (native build on ARM64)
 ENV SSL_VER=1.1.1w
 RUN wget https://www.openssl.org/source/openssl-$SSL_VER.tar.gz \
     && tar -xzf openssl-$SSL_VER.tar.gz \
     && cd openssl-$SSL_VER \
-    && ./Configure no-shared no-async --prefix=/musl --openssldir=/musl/ssl --cross-compile-prefix=aarch64-unknown-linux-musl- linux-aarch64 \
+    && CC=musl-gcc ./Configure no-shared no-async --prefix=/musl --openssldir=/musl/ssl linux-aarch64 \
     && make -j$(nproc) \
     && make install_sw \
     && cd .. \
@@ -87,7 +84,7 @@ RUN wget https://www.openssl.org/source/openssl-$SSL_VER.tar.gz \
 ENV OPENSSL_DIR=/musl \
     OPENSSL_INCLUDE_DIR=/musl/include \
     OPENSSL_LIB_DIR=/musl/lib \
-    PKG_CONFIG_ALLOW_CROSS=1
+    OPENSSL_STATIC=1
 
 # Copy the source code
 COPY . .