Rust Deployable Service
Use this skill when a Rust service needs to move from local development to a
repeatable container or cloud deployment. Keep runtime configuration explicit,
builds reproducible, and health checks boring.
Core Workflow
- Inspect
Cargo.toml, workspace layout, Dockerfile, .dockerignore,
config files, migrations, .sqlx/, CI, and deployment docs.
- Identify the binary entrypoint and runtime dependencies: database, Redis,
external APIs, TLS roots, static files, templates, migrations, and config.
- Separate build-time and runtime configuration. Never bake production secrets
into images.
- Use hierarchical config with environment overrides for deployment-specific
values.
- Use a multi-stage Docker build and copy only the runtime binary and needed
assets into the final image.
- Account for SQLx query checking. Use
SQLX_OFFLINE=true with checked-in
.sqlx/ metadata or provide a build-time database intentionally.
- Add health and readiness checks that match real dependencies.
- Run the bundled Docker preflight or the repository's equivalent CI command.
Configuration Rules
Read references/configuration.md when adding config files, environment
variables, or secret handling.
- Keep local defaults convenient and production defaults conservative.
- Validate config at startup before binding the server when possible.
- Store secrets in environment variables or the deployment secret manager.
- Avoid reading environment variables deep inside handlers or repositories.
Docker Rules
Read references/docker-rust.md before changing Docker builds.
- Use dependency caching deliberately; avoid invalidating the whole build on
every source edit when practical.
- Use
--locked for release builds if the repo commits Cargo.lock.
- Include CA certificates when outbound HTTPS is required.
- Copy migrations, templates, and static assets only if the binary needs them at
runtime.
- Run as a non-root user when the deployment platform supports it.
Verification
Run from the Rust project root when Docker is part of the delivery path:
path/to/rust-deployable-service/scripts/docker-preflight.sh
The script builds an image. It only runs a smoke command when
RUST_DEPLOY_SMOKE_COMMAND is set, because services often need environment and
infrastructure to start successfully.
Reference Files
references/configuration.md: typed config loading, overrides, validation,
and secrets.references/docker-rust.md: multi-stage builds, SQLx offline builds, runtime
assets, and image checks.
1---2name: rust-deployable-service3description: Use when preparing, containerizing, configuring, testing, or reviewing Rust services for deployment, especially Docker multi-stage builds, runtime configuration, environment overrides, secrets, health checks, SQLx offline builds, release profiles, image-size reduction, or production startup validation.4license: MIT5compatibility: Codex, Claude Code, and other Agent Skills-compatible clients.6metadata:7 version: "0.1.0"8 displayName: Rust Deployable Service9 category: Rust10 tags: rust,deployment,docker,configuration,sqlx11---1213# Rust Deployable Service1415Use this skill when a Rust service needs to move from local development to a16repeatable container or cloud deployment. Keep runtime configuration explicit,17builds reproducible, and health checks boring.1819## Core Workflow20211. Inspect `Cargo.toml`, workspace layout, `Dockerfile`, `.dockerignore`,22 config files, migrations, `.sqlx/`, CI, and deployment docs.232. Identify the binary entrypoint and runtime dependencies: database, Redis,24 external APIs, TLS roots, static files, templates, migrations, and config.253. Separate build-time and runtime configuration. Never bake production secrets26 into images.274. Use hierarchical config with environment overrides for deployment-specific28 values.295. Use a multi-stage Docker build and copy only the runtime binary and needed30 assets into the final image.316. Account for SQLx query checking. Use `SQLX_OFFLINE=true` with checked-in32 `.sqlx/` metadata or provide a build-time database intentionally.337. Add health and readiness checks that match real dependencies.348. Run the bundled Docker preflight or the repository's equivalent CI command.3536## Configuration Rules3738Read `references/configuration.md` when adding config files, environment39variables, or secret handling.4041- Keep local defaults convenient and production defaults conservative.42- Validate config at startup before binding the server when possible.43- Store secrets in environment variables or the deployment secret manager.44- Avoid reading environment variables deep inside handlers or repositories.4546## Docker Rules4748Read `references/docker-rust.md` before changing Docker builds.4950- Use dependency caching deliberately; avoid invalidating the whole build on51 every source edit when practical.52- Use `--locked` for release builds if the repo commits `Cargo.lock`.53- Include CA certificates when outbound HTTPS is required.54- Copy migrations, templates, and static assets only if the binary needs them at55 runtime.56- Run as a non-root user when the deployment platform supports it.5758## Verification5960Run from the Rust project root when Docker is part of the delivery path:6162```bash63path/to/rust-deployable-service/scripts/docker-preflight.sh64```6566The script builds an image. It only runs a smoke command when67`RUST_DEPLOY_SMOKE_COMMAND` is set, because services often need environment and68infrastructure to start successfully.6970## Reference Files7172- `references/configuration.md`: typed config loading, overrides, validation,73 and secrets.74- `references/docker-rust.md`: multi-stage builds, SQLx offline builds, runtime75 assets, and image checks.
ConcertoNotes