Rust Deployable Service
Use this skill when a Rust service needs to move from local development to a
repeatable container or cloud deployment. Keep runtime configuration explicit,
builds reproducible, and health checks boring.
Core Workflow
- Inspect
Cargo.toml, workspace layout, Dockerfile, .dockerignore,
config files, migrations, .sqlx/, CI, and deployment docs.
- Identify the binary entrypoint and runtime dependencies: database, Redis,
external APIs, TLS roots, static files, templates, migrations, and config.
- Separate build-time and runtime configuration. Never bake production secrets
into images.
- Use hierarchical config with environment overrides for deployment-specific
values.
- Use a multi-stage Docker build and copy only the runtime binary and needed
assets into the final image.
- Account for SQLx query checking. Use
SQLX_OFFLINE=true with checked-in
.sqlx/ metadata or provide a build-time database intentionally.
- Add health and readiness checks that match real dependencies.
- Run the bundled Docker preflight or the repository's equivalent CI command.
Configuration Rules
Read references/configuration.md when adding config files, environment
variables, or secret handling.
- Keep local defaults convenient and production defaults conservative.
- Validate config at startup before binding the server when possible.
- Store secrets in environment variables or the deployment secret manager.
- Avoid reading environment variables deep inside handlers or repositories.
Docker Rules
Read references/docker-rust.md before changing Docker builds.
- Use dependency caching deliberately; avoid invalidating the whole build on
every source edit when practical.
- Use
--locked for release builds if the repo commits Cargo.lock.
- Include CA certificates when outbound HTTPS is required.
- Copy migrations, templates, and static assets only if the binary needs them at
runtime.
- Run as a non-root user when the deployment platform supports it.
Verification
Run from the Rust project root when Docker is part of the delivery path:
path/to/rust-deployable-service/scripts/docker-preflight.sh
The script builds an image. It only runs a smoke command when
RUST_DEPLOY_SMOKE_COMMAND is set, because services often need environment and
infrastructure to start successfully.
Reference Files
references/configuration.md: typed config loading, overrides, validation,
and secrets.references/docker-rust.md: multi-stage builds, SQLx offline builds, runtime
assets, and image checks.
1---2name: rust-deployable-service3description: Use when preparing, containerizing, configuring, testing, or reviewing Rust services for deployment, especially Docker multi-stage builds, runtime configuration, environment overrides, secrets, health checks, SQLx offline builds, release profiles, image-size reduction, or production startup validation.4license: MIT5---67# Rust Deployable Service89Use this skill when a Rust service needs to move from local development to a10repeatable container or cloud deployment. Keep runtime configuration explicit,11builds reproducible, and health checks boring.1213## Core Workflow14151. Inspect `Cargo.toml`, workspace layout, `Dockerfile`, `.dockerignore`,16 config files, migrations, `.sqlx/`, CI, and deployment docs.172. Identify the binary entrypoint and runtime dependencies: database, Redis,18 external APIs, TLS roots, static files, templates, migrations, and config.193. Separate build-time and runtime configuration. Never bake production secrets20 into images.214. Use hierarchical config with environment overrides for deployment-specific22 values.235. Use a multi-stage Docker build and copy only the runtime binary and needed24 assets into the final image.256. Account for SQLx query checking. Use `SQLX_OFFLINE=true` with checked-in26 `.sqlx/` metadata or provide a build-time database intentionally.277. Add health and readiness checks that match real dependencies.288. Run the bundled Docker preflight or the repository's equivalent CI command.2930## Configuration Rules3132Read `references/configuration.md` when adding config files, environment33variables, or secret handling.3435- Keep local defaults convenient and production defaults conservative.36- Validate config at startup before binding the server when possible.37- Store secrets in environment variables or the deployment secret manager.38- Avoid reading environment variables deep inside handlers or repositories.3940## Docker Rules4142Read `references/docker-rust.md` before changing Docker builds.4344- Use dependency caching deliberately; avoid invalidating the whole build on45 every source edit when practical.46- Use `--locked` for release builds if the repo commits `Cargo.lock`.47- Include CA certificates when outbound HTTPS is required.48- Copy migrations, templates, and static assets only if the binary needs them at49 runtime.50- Run as a non-root user when the deployment platform supports it.5152## Verification5354Run from the Rust project root when Docker is part of the delivery path:5556```bash57path/to/rust-deployable-service/scripts/docker-preflight.sh58```5960The script builds an image. It only runs a smoke command when61`RUST_DEPLOY_SMOKE_COMMAND` is set, because services often need environment and62infrastructure to start successfully.6364## Reference Files6566- `references/configuration.md`: typed config loading, overrides, validation,67 and secrets.68- `references/docker-rust.md`: multi-stage builds, SQLx offline builds, runtime69 assets, and image checks.
ConcertoNotes