K9db builds and runs on Apple sillicon and Arm64

* Add Dockerfile for dev on arm64
* Make release Dockerfile work on both architecture
* Bug fixes with rust ffi, libsodium, and jvm/bazel to make things work on arm64

Author: KinanBab

.github/workflows/dev-arm64-test.yml

@@ -0,0 +1,41 @@
+name: "Dev tests (arm64)"
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04-arm
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: recursive
+
+    # Docker setup.
+    - name: Build docker container
+      run: |
+        docker build --no-cache -f Dockerfile.dev.arm64 -t k9db/dev-arm64 .
+
+    # Run docker (rust dependencies are vendored, no setup needed).
+    - name: Run docker container
+      run: |
+        docker run --mount type=bind,source=$(pwd),target=/home/k9db --name k9db -d -t k9db/dev-arm64
+        sleep 10
+        docker logs k9db
+
+    # bazel build ...
+    - name: Build all
+      run: |
+        docker exec k9db sh -c "cd /home/k9db && bazel build ..."
+
+    # bazel test all (with encryption; on by default)
+    - name: Test all
+      run: docker exec k9db sh -c "cd /home/k9db && bazel test ... --test_output=all"
+
+    # bazel test all without encryption
+    - name: Test all no encryption
+      run: docker exec k9db sh -c "cd /home/k9db && bazel test ... --encryption=off --test_output=all"

.github/workflows/release-arm64-test.yml

@@ -0,0 +1,73 @@
+name: "Test release Docker image (arm64)"
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  release-test:
+    runs-on: ubuntu-24.04-arm
+    steps:
+    - uses: actions/checkout@v4
+
+    # The arm64 runner image may not ship a mysql client.
+    - name: Install mysql client
+      run: sudo apt-get update && sudo apt-get install -y mysql-client
+
+    # (1) Build the release image.
+    - name: Build release docker image
+      run: docker build -f Dockerfile.release -t k9db:test .
+
+    # (2) Run it with a named volume for the database files.
+    - name: Run k9db container
+      run: |
+        docker volume create k9db-data
+        docker run -d --name k9db -p 10001:10001 -v k9db-data:/var/lib/k9db k9db:test
+        ./tests/release/wait-for-k9db.sh k9db
+
+    # (3) + (4) Feed sql into k9db and check the output of each statement.
+    - name: Create schema and insert data
+      run: |
+        mysql --host=127.0.0.1 --port=10001 < tests/release/01-schema.sql | tee out.txt
+        test ! -s out.txt  # DDL and inserts produce no output.
+
+    - name: Check point lookups
+      run: |
+        mysql --host=127.0.0.1 --port=10001 < tests/release/02-selects.sql | tee out.txt
+        diff tests/release/02-selects.expected out.txt
+
+    - name: Check view (calcite planner / dataflow)
+      run: |
+        mysql --host=127.0.0.1 --port=10001 < tests/release/03-view.sql | tail -n +2 | tee out.txt
+        diff tests/release/03-view.expected out.txt
+
+    # (5) Stop and remove the container; (6) run a fresh one on the same volume.
+    - name: Replace container (data must persist)
+      run: |
+        docker stop k9db
+        docker rm k9db
+        docker run -d --name k9db -p 10001:10001 -v k9db-data:/var/lib/k9db k9db:test
+        ./tests/release/wait-for-k9db.sh k9db
+
+    # (7) The old data (incl. the view) must have survived, and writes work.
+    - name: Check persisted point lookups
+      run: |
+        mysql --host=127.0.0.1 --port=10001 < tests/release/02-selects.sql | tee out.txt
+        diff tests/release/02-selects.expected out.txt
+
+    - name: Check persisted view
+      run: |
+        mysql --host=127.0.0.1 --port=10001 < tests/release/03-view.sql | tail -n +2 | tee out.txt
+        diff tests/release/03-view.expected out.txt
+
+    - name: Check write after restart
+      run: |
+        mysql --host=127.0.0.1 --port=10001 < tests/release/04-write-after-restart.sql | tee out.txt
+        diff tests/release/04-write-after-restart.expected out.txt
+
+    - name: Dump k9db logs on failure
+      if: failure()
+      run: docker logs k9db || true

Dockerfile.dev.arm64

@@ -0,0 +1,59 @@
+# Docker image for lightweight k9db development on arm64 (e.g. Apple Silicon
+# Macs): building from source and running tests, plus re-vendoring the rust
+# dependencies. Unlike Dockerfile.dev, this image does NOT include the
+# experiment pipeline (mariadb baselines, memcached, latex/plotting).
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LANG=C.UTF-8
+# /root/.cargo/bin: rust/cargo (installed below) available in every shell.
+ENV PATH=/root/.cargo/bin:/usr/local/bin:$PATH
+
+# Add apt-add-repository and the ppa for gcc-11.
+RUN apt-get update && apt-get install -y software-properties-common \
+    && add-apt-repository -y ppa:ubuntu-toolchain-r/test
+
+# Build dependencies.
+RUN apt-get update && apt-get install -y \
+    apt-utils libssl-dev lsb-release openssl git \
+    build-essential zlib1g-dev libbz2-dev liblzma-dev libffi-dev \
+    wget gcc-11 g++-11 unzip zip pkg-config \
+    openjdk-11-jdk curl libclang-dev clang \
+    libsnappy-dev python3 python3-dev mariadb-client \
+    && ln -sf /usr/bin/python3 /usr/bin/python
+
+RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 90 \
+                                 --slave /usr/bin/gcc-ar gcc-ar /usr/bin/gcc-ar-11 \
+                                 --slave /usr/bin/gcc-nm gcc-nm /usr/bin/gcc-nm-11 \
+                                 --slave /usr/bin/gcc-ranlib gcc-ranlib /usr/bin/gcc-ranlib-11 \
+                                 --slave /usr/bin/g++ g++ /usr/bin/g++-11 \
+    && update-alternatives --set gcc /usr/bin/gcc-11
+
+# Install bazel 4.0. No installer script is published for linux-arm64, so
+# download the standalone binary directly.
+RUN wget -O /usr/local/bin/bazel \
+        https://github.com/bazelbuild/bazel/releases/download/4.0.0/bazel-4.0.0-linux-arm64 \
+    && chmod +x /usr/local/bin/bazel
+
+# Install rust and cargo-raze. The raze outputs (**/cargo/) are vendored in
+# the repo; cargo-raze is only needed to re-vendor them after changing rust
+# dependencies: run ./vendor-rust.sh from the repo root and commit the changes.
+RUN curl https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly-2023-12-06
+RUN git clone https://github.com/KinanBab/cargo-raze.git /home/cargo-raze \
+    && cargo install --locked --path /home/cargo-raze/impl
+
+# The k9db repo is bind-mounted here during docker run (do not copy).
+RUN mkdir /home/k9db
+
+# Generate docker.bazelrc (imported by the repo's .bazelrc).
+RUN printf '%s\n' \
+    "test:asan --test_env LSAN_OPTIONS=suppressions=/home/k9db/.lsan_jvm_suppress.txt" \
+    "test:tsan --test_env LSAN_OPTIONS=suppressions=/home/k9db/.lsan_jvm_suppress.txt" \
+    "test:tsan --test_env TSAN_OPTIONS=suppressions=/home/k9db/.tsan_jvm_suppress.txt" \
+    > /home/docker.bazelrc
+
+EXPOSE 10001/tcp
+
+ENTRYPOINT ["/bin/bash"]
+
+# Run with docker run --mount type=bind,source=$(pwd),target=/home/k9db --name k9db-arm64 -it -p 10001:10001 k9db/dev-arm64

Dockerfile.release

@@ -17,6 +17,7 @@
 # Stage 1: build k9db from source.
 ##############################################################################
 FROM ubuntu:24.04 AS build
+ARG TARGETARCH
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV LANG=C.UTF-8
@@ -31,7 +32,7 @@ RUN apt-get update && apt-get install -y \
     apt-utils libssl-dev lsb-release openssl git \
     build-essential zlib1g-dev libbz2-dev liblzma-dev libffi-dev \
     wget gcc-11 g++-11 unzip zip pkg-config \
-    openjdk-11-jdk curl libclang-dev libevent-dev \
+    openjdk-11-jdk curl libclang-dev clang libevent-dev \
     libsnappy-dev python3 python3-dev
 
 RUN ln -sf /usr/bin/python3 /usr/bin/python
@@ -43,12 +44,19 @@ RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 90 \
                                  --slave /usr/bin/g++ g++ /usr/bin/g++-11 \
     && update-alternatives --set gcc /usr/bin/gcc-11
 
-# Install bazel 4.0.
-RUN cd /tmp \
-    && wget https://github.com/bazelbuild/bazel/releases/download/4.0.0/bazel-4.0.0-installer-linux-x86_64.sh \
-    && chmod +x bazel-4.0.0-installer-linux-x86_64.sh \
-    && ./bazel-4.0.0-installer-linux-x86_64.sh \
-    && rm bazel-4.0.0-installer-linux-x86_64.sh
+# Install bazel 4.0. No installer script is published for linux-arm64, so
+# download the standalone binary directly on arm64.
+RUN if [ "$TARGETARCH" = "arm64" ]; then \
+        wget -O /usr/local/bin/bazel \
+            https://github.com/bazelbuild/bazel/releases/download/4.0.0/bazel-4.0.0-linux-arm64 \
+        && chmod +x /usr/local/bin/bazel; \
+    else \
+        cd /tmp \
+        && wget https://github.com/bazelbuild/bazel/releases/download/4.0.0/bazel-4.0.0-installer-linux-x86_64.sh \
+        && chmod +x bazel-4.0.0-installer-linux-x86_64.sh \
+        && ./bazel-4.0.0-installer-linux-x86_64.sh \
+        && rm bazel-4.0.0-installer-linux-x86_64.sh; \
+    fi
 
 # Copy sources (see .dockerignore for exclusions). The bazel rules for the
 # proxy's rust dependencies (k9db/proxy/cargo/) are vendored in the repo, so
@@ -75,6 +83,7 @@ RUN BIN="$(bazel info bazel-bin --config opt)" \
 # Stage 2: minimal runtime image.
 ##############################################################################
 FROM ubuntu:24.04 AS runtime
+ARG TARGETARCH
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV LANG=C.UTF-8
@@ -91,7 +100,8 @@ COPY --from=build /opt/k9db /opt/k9db
 # the working directory, so this must be /opt/k9db.
 WORKDIR /opt/k9db
 
-ENV LD_LIBRARY_PATH=/opt/k9db/lib:/usr/lib/jvm/java-11-openjdk-amd64/lib/server:/usr/lib/jvm/java-11-openjdk-amd64/lib
+# The jvm directory suffix matches docker's TARGETARCH (amd64/arm64).
+ENV LD_LIBRARY_PATH=/opt/k9db/lib:/usr/lib/jvm/java-11-openjdk-${TARGETARCH}/lib/server:/usr/lib/jvm/java-11-openjdk-${TARGETARCH}/lib
 # Send glog output to the container log instead of files in /tmp.
 ENV GLOG_logtostderr=1
 

README.md

@@ -49,17 +49,22 @@ or use our [provided Docker container](https://github.com/brownsys/K9db/wiki/Req
 
 You can then use bazel to [build and run K9db](https://github.com/brownsys/K9db/wiki/Building,-Testing,-and-Running).
 
-K9db does not currently build on Mac machines with M1/M2 processors, even when using the Docker container.
+K9db also builds and runs on Apple Silicon Macs (M series) using Docker, as a
+native arm64 Linux container: the release image is multi-arch, and a
+lightweight arm64 development image is provided (see the section below).
+Native (non-Docker) macOS builds are not supported.
 
 ## Using Docker
 
-The repository provides two Docker images.
+The repository provides Docker images for running K9db and for developing it.
 
 ### Running K9db (release image)
 
 `Dockerfile.release` packages K9db into a small self-contained image: an
 intermediate stage builds K9db from source, and only the compiled server and
-its runtime dependencies are shipped in the final image.
+its runtime dependencies are shipped in the final image. The image is
+multi-arch: it builds natively on both x86_64 and arm64 (e.g. Apple Silicon
+Macs) hosts.
 
 ```bash
 docker build -f Dockerfile.release -t k9db .
@@ -92,6 +97,22 @@ docker exec -it k9db-dev /bin/bash
 cd /home/k9db && bazel build ... && bazel test ...
 ```
 
+`Dockerfile.dev` is x86_64-only.
+
+On arm64 machines (e.g. Apple Silicon Macs), use `Dockerfile.dev.arm64` instead:
+a lightweight development image that can build K9db from source,
+run the tests, and re-vendor the rust dependencies,
+but does not include the experiments pipeline (mariadb baselines, memcached,
+and plotting):
+
+```bash
+docker build -f Dockerfile.dev.arm64 -t k9db/dev-arm64 .
+docker run --mount type=bind,source=$(pwd),target=/home/k9db --name k9db-dev -d -it -p 10001:10001 k9db/dev-arm64
+docker exec -it k9db-dev /bin/bash
+# Inside the container:
+cd /home/k9db && bazel build ... && bazel test ...
+```
+
 ### Re-vendoring rust dependencies (devs)
 
 The bazel BUILD files for the rust (cargo) dependencies of the proxy and of

WORKSPACE.bazel

@@ -3,6 +3,23 @@ workspace(name = "k9db")
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository", "new_git_repository")
 
+# Override bazel's builtin remote_java_tools_linux (same archive bazel 4.0.0
+# ships with) to patch a missing '#include <limits>' in ijar's zlib_client.h.
+# On x86_64 this doesn't matter (bazel uses the prebuilt ijar binary), but on
+# arm64 there is no prebuilt ijar, so it is compiled from source and fails
+# against newer libstdc++ where <limits> is no longer transitively included.
+http_archive(
+    name = "remote_java_tools_linux",
+    patch_cmds = [
+        "grep -rl numeric_limits java_tools --include=*.h --include=*.cc | xargs sed -i '1i #include <limits>'",
+    ],
+    sha256 = "355c27c603e8fc64bb0e2d7f809741f42576d5f4540f9ce28fd55922085af639",
+    urls = [
+        "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v10.5/java_tools_javac11_linux-v10.5.zip",
+        "https://github.com/bazelbuild/java_tools/releases/download/javac11_v10.5/java_tools_javac11_linux-v10.5.zip",
+    ],
+)
+
 
 # Rules java
 http_archive(
@@ -361,12 +378,24 @@ filegroup(
 
 configure_make(
     name = "libsodium",
+    # libsodium only enables its aarch64 AES256-GCM implementation when
+    # compiled with clang (the code is gated on __clang__). Override CFLAGS
+    # and LDFLAGS as they carry gcc-only flags from the bazel toolchain that
+    # clang rejects; configure arguments take precedence over the environment.
+    configure_options = select({
+        "@platforms//cpu:aarch64": [
+            "CC=clang",
+            "CFLAGS='-O2 -fPIC'",
+            "LDFLAGS=",
+        ],
+        "//conditions:default": [],
+    }),
     lib_source = ":all_srcs",
     out_lib_dir = "lib",
     visibility = ["//visibility:public"],
 )
 """,
-    strip_prefix = "libsodium-1.0.18-RELEASE",
+    strip_prefix = "libsodium-1.0.20-RELEASE",
     type = "zip",
-    url = "https://github.com/jedisct1/libsodium/archive/1.0.18-RELEASE.zip",
+    url = "https://github.com/jedisct1/libsodium/archive/1.0.20-RELEASE.zip",
 )

k9db/planner/calcite/src/com/brownsys/k9db/nativelib/BUILD.bazel

@@ -91,12 +91,15 @@ genrule(
       com/brownsys/k9db/nativelib/DataFlowGraphLibrary.java
 
   # Move outputs to proper directory and remove tmp directory.
+  # javacpp writes the library to a platform-specific directory
+  # (e.g. linux-x86_64/ or linux-arm64/), so glob instead of hardcoding.
   cd $${EXEC_PATH}
-  if [ -f $${PCKG_DIR}linux-x86_64/libjniDataFlowGraphLibrary.so ]; then
-    mv $${PCKG_DIR}linux-x86_64/libjniDataFlowGraphLibrary.so $@
-  else
-    touch $@
+  JNILIB=$$(ls $${PCKG_DIR}linux-*/libjniDataFlowGraphLibrary.so 2>/dev/null | head -1)
+  if [ -z "$${JNILIB}" ]; then
+    echo "ERROR: javacpp did not produce libjniDataFlowGraphLibrary.so" >&2
+    exit 1
   fi
+  mv $${JNILIB} $@
   rm -rf $${TMP_DIR}
 """,
     tools = ["@maven//:org_bytedeco_javacpp"],