build(docker): fix Rust extension build in container

Adds Rust toolchain, libssl-dev, and pkg-config to builder stage.
Updates Dockerfile to build extension via script and copy binary
to runtime image, ensuring 'headroom._core' availability.

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

Dockerfile

@@ -11,14 +11,22 @@ ARG PYTHON_SITE_PACKAGES=/usr/local/lib/python${PYTHON_VERSION}/site-packages
 FROM python:${PYTHON_VERSION}-slim@${PYTHON_DIGEST} AS builder
 
 ARG UV_VERSION
+ARG PYTHON_SITE_PACKAGES
 
 RUN apt-get update && \
   apt-get install -y --no-install-recommends \
     build-essential \
     g++ \
+    curl \
+    libssl-dev \
+    pkg-config \
+    unzip \
   && rm -rf /var/lib/apt/lists/*
 
-RUN python -m pip install --no-cache-dir uv==${UV_VERSION}
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal --default-toolchain stable
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+RUN python -m pip install --no-cache-dir uv==${UV_VERSION} maturin
 
 WORKDIR /build
 
@@ -30,10 +38,16 @@ ARG HEADROOM_EXTRAS=proxy,code,ml
 RUN --mount=type=cache,target=/root/.cache/uv \
     uv pip install --system ".[${HEADROOM_EXTRAS}]"
 
-# Layer 2: copy real source, reinstall only headroom-ai (no deps)
+# Layer 2: copy real source, reinstall only headroom-ai (no deps), then build
+# the Rust extension via maturin build (no venv needed — uses system Python).
 COPY headroom/ headroom/
+COPY Cargo.toml Cargo.lock ./
+COPY crates/ crates/
+COPY scripts/build_rust_extension.sh scripts/build_rust_extension.sh
+COPY .cargo/ .cargo/
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv pip install --system --no-deps --reinstall-package headroom-ai .
+    uv pip install --system --no-deps --reinstall-package headroom-ai . && \
+    bash ./scripts/build_rust_extension.sh
 
 # ---- Runtime stage (python-slim): supports root/nonroot via build arg ----
 FROM python:${PYTHON_VERSION}-slim@${PYTHON_DIGEST} AS runtime-slim-base
@@ -46,6 +60,8 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder ${PYTHON_SITE_PACKAGES} ${PYTHON_SITE_PACKAGES}
+COPY --from=builder /build/headroom/_core*.so /build/headroom/_core*.pyd /build/headroom/_core*.dylib /src/headroom/ 2>/dev/null || true
+COPY --from=builder /build/headroom/_core*.so /build/headroom/_core*.pyd /build/headroom/_core*.dylib /usr/local/lib/python${PYTHON_VERSION}/site-packages/headroom/ 2>/dev/null || true
 COPY --from=builder /usr/local/bin/headroom /usr/local/bin/headroom
 
 RUN mkdir -p /home/nonroot /data && \

scripts/build_rust_extension.sh

@@ -1,48 +1,51 @@
 #!/usr/bin/env bash
-# Build the Rust → Python extension (headroom._core) and link it into the
-# in-tree `headroom/` package so `import headroom._core` resolves.
+# Build Rust → Python extension (headroom._core) and copy it into in-tree
+# `headroom/` so `import headroom._core` resolves.
 #
-# Why a wrapper script: `maturin develop` builds the binary into the venv,
-# but the in-tree `headroom/` source directory (loaded via `pip install -e .`)
-# shadows that on sys.path. Python finds `headroom/__init__.py` at the project
-# root before reaching the installed extension, so `import headroom._core`
-# fails. Copying the built binary into `headroom/` fixes the lookup with zero
-# symlinks and works on Windows.
+# `maturin build` works without venv activation, so this script runs inside
+# Docker and on local shells. It builds a wheel, extracts the compiled
+# extension, and copies it into `headroom/` to beat `pip install -e .` path
+# shadowing.
 #
-# Idempotent. Safe to run repeatedly. Requires `maturin` in PATH (i.e.
-# inside the project venv).
+# Idempotent. Safe to run repeatedly. Requires `maturin` and `python` in PATH.
 
 set -euo pipefail
 
 cd "$(dirname "$0")/.."
 
 if ! command -v maturin >/dev/null 2>&1; then
-    echo "error: maturin not found. Activate the venv first:" >&2
-    echo "  source .venv/bin/activate  (Unix)" >&2
-    echo "  .venv\\Scripts\\activate     (Windows)" >&2
+    echo "error: maturin not found. Install it (e.g. pip install maturin)." >&2
     exit 1
 fi
 
-# Build the wheel + install into the venv site-packages.
-maturin develop -m crates/headroom-py/Cargo.toml
+maturin build --release --interpreter python --out target/wheels \
+    --manifest-path crates/headroom-py/Cargo.toml
 
-# Locate the built extension binary. Maturin writes it under
-# `crates/headroom-py/python/headroom/_core.{so,dylib,pyd}`.
-EXT_FILE=$(find crates/headroom-py/python/headroom -maxdepth 1 \
+WHEEL=$(find target/wheels -name "*.whl" -type f 2>/dev/null | head -1)
+
+if [[ -z "$WHEEL" ]]; then
+    echo "error: maturin build succeeded but produced no wheel." >&2
+    exit 1
+fi
+
+echo "Built wheel: $WHEEL"
+
+TMPDIR=$(mktemp -d)
+unzip -qo "$WHEEL" -d "$TMPDIR"
+
+EXT_FILE=$(find "$TMPDIR/headroom" -maxdepth 1 \
     -name "_core.cpython-*.so" -o -name "_core.cpython-*.dylib" -o -name "_core.pyd" \
     2>/dev/null | head -1)
 
 if [[ -z "$EXT_FILE" ]]; then
-    echo "error: maturin develop succeeded but produced no _core.* binary." >&2
+    echo "error: wheel did not contain headroom/_core.* binary." >&2
+    rm -rf "$TMPDIR"
     exit 1
 fi
 
-# Copy into the in-tree package dir. Uses cp instead of ln -sf because
-# Windows (MSYS2/Git Bash) lacks reliable symlink support and requires
-# elevated privileges for native symlinks.
 DEST="headroom/$(basename "$EXT_FILE")"
 cp -f "$EXT_FILE" "$DEST"
-echo "installed: $DEST (from $EXT_FILE)"
+rm -rf "$TMPDIR"
+echo "installed: $DEST (from $WHEEL)"
 
-# Smoke-test the import to fail loudly if anything is misconfigured.
 python -c "from headroom._core import DiffCompressor; print('headroom._core OK:', DiffCompressor)"