Remove musl-dev from runtime/Dockerfile

It wasn't pinned with a hash yet with a version tag. This ensures we are
deterministic to the image (specified by hash), `Cargo.lock`, and source code
alone.

Unfortunately, this was incredibly annoying to do, the exact process uncovering
a SIGSEGV in stable Rust. The extensive documentation details the solution.
Thankfully, it works now.

Cargo.lock

@@ -153,16 +153,7 @@ dependencies = [
 
 [[package]]
 name = "alloy-eip2124"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "741bdd7499908b3aa0b159bba11e71c8cddd009a2c2eb7a06e825f1ec87900a5"
-dependencies = [
- "alloy-primitives",
- "alloy-rlp",
- "crc",
- "serde",
- "thiserror 2.0.17",
-]
+version = "0.2.99"
 
 [[package]]
 name = "alloy-eip2930"
@@ -1969,21 +1960,6 @@ version = "0.126.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d039de901c8d928222b8128e1b9a9ab27b82a7445cb749a871c75d9cb25c57d"
 
-[[package]]
-name = "crc"
-version = "3.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9710d3b3739c2e349eb44fe848ad0b7c8cb1e42bd87ee49371df2f7acaf3e675"
-dependencies = [
- "crc-catalog",
-]
-
-[[package]]
-name = "crc-catalog"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
-
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
@@ -3539,9 +3515,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hex-conservative"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5313b072ce3c597065a808dbf612c4c8e8590bdbf8b579508bf7a762c5eae6cd"
+checksum = "fda06d18ac606267c40c04e41b9947729bf8b9efe74bd4e82b61a5f26a510b9f"
 dependencies = [
  "arrayvec",
 ]
@@ -10628,9 +10604,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.30"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -10639,9 +10615,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.34"
+version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
+checksum = "7a04e24fab5c89c6a36eb8558c9656f30d81de51dfa4d3b45f26b21d61fa0a6c"
 dependencies = [
  "once_cell",
  "valuable",
@@ -11662,9 +11638,9 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "winnow"
-version = "0.7.13"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
 dependencies = [
  "memchr",
 ]

Cargo.toml

@@ -171,6 +171,7 @@ overflow-checks = true
 
 [patch.crates-io]
 # Point to empty crates for crates unused within in our tree
+alloy-eip2124 = { path = "patches/ethereum/alloy-eip2124" }
 ark-ff-3 = { package = "ark-ff", path = "patches/ethereum/ark-ff-0.3" }
 ark-ff-4 = { package = "ark-ff", path = "patches/ethereum/ark-ff-0.4" }
 c-kzg = { path = "patches/ethereum/c-kzg" }

orchestration/runtime/Dockerfile

@@ -1,8 +1,6 @@
 # rust:1.91.1-alpine as of November 11th, 2025 (GMT)
 FROM --platform=linux/amd64 rust@sha256:700c0959b23445f69c82676b72caa97ca4359decd075dca55b13339df27dc4d3 AS deterministic
 
-RUN apk add musl-dev=1.2.5-r10
-
 # Add the wasm toolchain
 RUN rustup target add wasm32v1-none
 
@@ -27,7 +25,31 @@ ADD AGPL-3.0 /serai
 
 WORKDIR /serai
 
-# Build the runtime, copying it to the volume if it exists
+# `proc-macro`s are difficult here on Alpine, with `musl`. Rust expects to be able to build the
+# `proc-macro`s into dynamic libraries, which requires setting `target-feature=-crt-static`
+# (disabling static linking). This will become the default at some point in the future
+# (https://github.com/rust-lang/compiler-time/issues/422).
+#
+# While this is fine, Rust/musl will expect to be able to link `crti.o` into the built
+# `proc-macro`s. `crti.o` would be provided by the `musl-dev` package which Rust's docker images do
+# not include by default (https://github.com/rust-lang/docker-rust/issues/68). While we could add it
+# ourselves, we cannot do so _while pinning by a hash_. We'd have to pin it by its version tag.
+#
+# Rust does provide `crti.o` as part of its self-contained builds. We cannot use
+# `link-self-contained=yes` here however, as that would link `musl` into the `proc-macro`s and
+# `musl` may only be linked once into a running program
+# (https://github.com/rust-lang/rust/issues/149371).
+#
+# While we can't use self-contained builds, we can use the libraries shipped for self-contained
+# builds. We do so here, adding Rust's libraries to the linker's search path, making `crti.o`
+# available without adding `musl-dev`.
+RUN echo 'SYSROOT=$(rustc --print sysroot)' >> libs.sh
+RUN echo 'LIBS=$SYSROOT/lib/rustlib/x86_64-unknown-linux-musl/lib/self-contained' >> libs.sh
+RUN echo 'ln -s $LIBS/Scrt1.o $LIBS/crti.o $LIBS/crtn.o /usr/lib' >> libs.sh
+# For `libc`, we need a shared library, not a static archive, so we convert it now
+RUN echo 'gcc -shared -o /usr/lib/libc.so -L$LIBS -Wl,--whole-archive -lc -Wl,--no-whole-archive -nodefaultlibs' >> libs.sh
+RUN /bin/sh ./libs.sh
+
 ENV RUSTFLAGS="-Ctarget-feature=-crt-static"
 CMD cargo build --release -p serai-runtime && \
   mkdir -p /volume && \

patches/ethereum/alloy-eip2124/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "alloy-eip2124"
+version = "0.2.99"
+description = "Patch to an empty crate"
+license = "MIT"
+repository = "https://github.com/serai-dex/serai/tree/develop/patches/ethereum/alloy-eip2124"
+authors = ["Luke Parker <lukeparker5132@gmail.com>"]
+keywords = []
+edition = "2021"
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
+[workspace]
+
+[features]
+std = []
+serde = []