Use git clone for Flutter SDK to support arm64

Switch from downloading pre-built Flutter SDK tarballs to cloning from
git. Flutter only provides x64 Linux tarballs, but cloning from git
allows Flutter to bootstrap itself with the correct Dart SDK for any
host architecture (amd64 or arm64).

Also reduces image size from ~4GB to ~1.7GB for Android variant.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/publish.yaml

@@ -7,6 +7,9 @@ on:
 permissions:
   contents: read
 
+env:
+  IMAGE_NAME: flutter-sdk
+
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
@@ -14,13 +17,13 @@ jobs:
       matrix:
         include:
           - dockerfile: Dockerfile
-            image_name: gpb-flutter-sdk-web
+            variant: web
             description: Minimal Flutter SDK for Web/WASM CI builds
           - dockerfile: Dockerfile.android
-            image_name: gpb-flutter-sdk-android
+            variant: android
             description: Flutter SDK for Android CI builds
           - dockerfile: Dockerfile.linux
-            image_name: gpb-flutter-sdk-linux
+            variant: linux
             description: Flutter SDK for Linux desktop CI builds
     steps:
       - name: Checkout code
@@ -34,14 +37,17 @@ jobs:
             FLUTTER_VERSION=$(curl -fsSL https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json \
               | jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')
             echo "flutter_version=${FLUTTER_VERSION}" >> $GITHUB_OUTPUT
-            echo "tag=dev" >> $GITHUB_OUTPUT
+            echo "tag=${{ matrix.variant }}-dev" >> $GITHUB_OUTPUT
             echo "Using latest Flutter stable ${FLUTTER_VERSION} for pre-release test"
           else
             # Full release: use the release tag as the Flutter version
             echo "flutter_version=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
-            echo "tag=latest" >> $GITHUB_OUTPUT
+            echo "tag=${{ matrix.variant }}-latest" >> $GITHUB_OUTPUT
           fi
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -61,7 +67,7 @@ jobs:
           load: true
           build-args: |
             FLUTTER_VERSION=${{ steps.version.outputs.flutter_version }}
-          tags: ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ steps.version.outputs.flutter_version }}
+          tags: ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }}
 
       - name: Install Docker Scout
         run: |
@@ -70,24 +76,24 @@ jobs:
 
       - name: Docker Scout CVE Scan
         run: |
-          docker scout cves ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ steps.version.outputs.flutter_version }} --only-severity critical,high
+          docker scout cves ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }} --only-severity critical,high
 
       - name: Build and push with attestations
         uses: docker/build-push-action@v5
         with:
           context: .
           file: ${{ matrix.dockerfile }}
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           push: true
           sbom: true
           provenance: mode=max
           build-args: |
             FLUTTER_VERSION=${{ steps.version.outputs.flutter_version }}
           tags: |
-            ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ steps.version.outputs.flutter_version }}
-            ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ steps.version.outputs.tag }}
+            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }}
+            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
           labels: |
-            org.opencontainers.image.title=${{ matrix.image_name }}
+            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
             org.opencontainers.image.description=${{ matrix.description }}
-            org.opencontainers.image.version=${{ steps.version.outputs.flutter_version }}
+            org.opencontainers.image.version=${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }}
             org.opencontainers.image.revision=${{ github.sha }}

.gitea/workflows/scout.yaml

@@ -8,6 +8,9 @@ permissions:
   contents: read
   pull-requests: write
 
+env:
+  IMAGE_NAME: flutter-sdk
+
 jobs:
   scout:
     runs-on: ubuntu-latest
@@ -15,11 +18,11 @@ jobs:
       matrix:
         include:
           - dockerfile: Dockerfile
-            image_name: gpb-flutter-sdk-web
+            variant: web
           - dockerfile: Dockerfile.android
-            image_name: gpb-flutter-sdk-android
+            variant: android
           - dockerfile: Dockerfile.linux
-            image_name: gpb-flutter-sdk-linux
+            variant: linux
     steps:
       - name: Log in to DockerHub
         uses: docker/login-action@v3
@@ -30,12 +33,12 @@ jobs:
       - name: Check if latest image exists
         id: should_run
         run: |
-          if docker manifest inspect ${{ vars.REGISTRY }}/${{ matrix.image_name }}:latest > /dev/null 2>&1; then
+          if docker manifest inspect ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest > /dev/null 2>&1; then
             echo "run=true" >> $GITHUB_OUTPUT
-            echo "Latest ${{ matrix.image_name }} found, Scout compare will run"
+            echo "${{ matrix.variant }}-latest found, Scout compare will run"
           else
             echo "run=false" >> $GITHUB_OUTPUT
-            echo "No latest ${{ matrix.image_name }} found, skipping (nothing to compare against)"
+            echo "No ${{ matrix.variant }}-latest found, skipping (nothing to compare against)"
           fi
 
       - name: Checkout code
@@ -55,7 +58,7 @@ jobs:
           platforms: linux/amd64
           push: false
           load: true
-          tags: ${{ vars.REGISTRY }}/${{ matrix.image_name }}:pr-${{ github.event.pull_request.number }}
+          tags: ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-pr-${{ github.event.pull_request.number }}
 
       - name: Install Docker Scout
         if: steps.should_run.outputs.run == 'true'
@@ -66,4 +69,4 @@ jobs:
       - name: Docker Scout Compare
         if: steps.should_run.outputs.run == 'true'
         run: |
-          docker scout compare ${{ vars.REGISTRY }}/${{ matrix.image_name }}:pr-${{ github.event.pull_request.number }} --to ${{ vars.REGISTRY }}/${{ matrix.image_name }}:latest --ignore-unchanged --only-severity critical,high
+          docker scout compare ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-pr-${{ github.event.pull_request.number }} --to ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest --ignore-unchanged --only-severity critical,high

.gitea/workflows/update-check.yaml

@@ -1,4 +1,4 @@
-name: Check for Flutter SDK Updates
+name: Check for Flutter SDK and Android SDK Updates
 
 on:
   schedule:
@@ -9,6 +9,9 @@ jobs:
   check-update:
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
       - name: Get latest Flutter stable version
         id: flutter
         run: |
@@ -17,7 +20,47 @@ jobs:
           echo "version=${LATEST}" >> $GITHUB_OUTPUT
           echo "Latest Flutter stable: ${LATEST}"
 
-      - name: Check if release already exists
+      - name: Get latest Android SDK versions
+        id: android
+        run: |
+          REPO_XML=$(curl -fsSL "https://dl.google.com/android/repository/repository2-1.xml")
+
+          # Latest stable build-tools (exclude rc/alpha/beta)
+          BUILD_TOOLS=$(echo "$REPO_XML" | grep -o 'path="build-tools;[0-9]*\.[0-9]*\.[0-9]*"' | \
+            sed 's/path="build-tools;//;s/"//' | sort -V | tail -1)
+
+          # Latest stable platform
+          PLATFORM=$(echo "$REPO_XML" | grep -o 'path="platforms;android-[0-9]*"' | \
+            sed 's/path="platforms;android-//;s/"//' | sort -n | tail -1)
+
+          # Latest cmdline-tools download ID
+          CMDLINE_DOWNLOAD=$(echo "$REPO_XML" | grep -o 'commandlinetools-linux-[0-9]*_latest' | \
+            sed 's/commandlinetools-linux-//;s/_latest//' | sort -n | tail -1)
+
+          echo "build_tools=${BUILD_TOOLS}" >> $GITHUB_OUTPUT
+          echo "platform=${PLATFORM}" >> $GITHUB_OUTPUT
+          echo "cmdline_tools=${CMDLINE_DOWNLOAD}" >> $GITHUB_OUTPUT
+
+          echo "Latest Android build-tools: ${BUILD_TOOLS}"
+          echo "Latest Android platform: ${PLATFORM}"
+          echo "Latest cmdline-tools download: ${CMDLINE_DOWNLOAD}"
+
+      - name: Check current Android SDK versions in Dockerfile
+        id: current
+        run: |
+          CURRENT_CMDLINE=$(grep -o 'ANDROID_SDK_TOOLS_VERSION=[0-9]*' Dockerfile.android | cut -d= -f2)
+          CURRENT_BUILD_TOOLS=$(grep -o 'ANDROID_BUILD_TOOLS=[0-9.]*' Dockerfile.android | cut -d= -f2)
+          CURRENT_PLATFORM=$(grep -o 'ANDROID_COMPILE_SDK=[0-9]*' Dockerfile.android | cut -d= -f2)
+
+          echo "cmdline_tools=${CURRENT_CMDLINE}" >> $GITHUB_OUTPUT
+          echo "build_tools=${CURRENT_BUILD_TOOLS}" >> $GITHUB_OUTPUT
+          echo "platform=${CURRENT_PLATFORM}" >> $GITHUB_OUTPUT
+
+          echo "Current cmdline-tools: ${CURRENT_CMDLINE}"
+          echo "Current build-tools: ${CURRENT_BUILD_TOOLS}"
+          echo "Current platform: ${CURRENT_PLATFORM}"
+
+      - name: Check if Flutter release already exists
         id: existing
         run: |
           VERSION="${{ steps.flutter.outputs.version }}"
@@ -31,7 +74,29 @@ jobs:
             echo "Release ${VERSION} not found, will create"
           fi
 
-      - name: Create release for new version
+      - name: Determine if Android SDK update is needed
+        id: android_update
+        run: |
+          NEEDS_UPDATE=false
+
+          if [ "${{ steps.android.outputs.cmdline_tools }}" != "${{ steps.current.outputs.cmdline_tools }}" ]; then
+            echo "cmdline-tools update available: ${{ steps.current.outputs.cmdline_tools }} -> ${{ steps.android.outputs.cmdline_tools }}"
+            NEEDS_UPDATE=true
+          fi
+
+          if [ "${{ steps.android.outputs.build_tools }}" != "${{ steps.current.outputs.build_tools }}" ]; then
+            echo "build-tools update available: ${{ steps.current.outputs.build_tools }} -> ${{ steps.android.outputs.build_tools }}"
+            NEEDS_UPDATE=true
+          fi
+
+          if [ "${{ steps.android.outputs.platform }}" != "${{ steps.current.outputs.platform }}" ]; then
+            echo "platform update available: ${{ steps.current.outputs.platform }} -> ${{ steps.android.outputs.platform }}"
+            NEEDS_UPDATE=true
+          fi
+
+          echo "needs_update=${NEEDS_UPDATE}" >> $GITHUB_OUTPUT
+
+      - name: Create release for new Flutter version
         if: steps.existing.outputs.exists == 'false' && steps.flutter.outputs.version != ''
         run: |
           VERSION="${{ steps.flutter.outputs.version }}"
@@ -47,3 +112,33 @@ jobs:
               \"draft\": false,
               \"prerelease\": false
             }"
+
+      - name: Create issue for Android SDK updates
+        if: steps.android_update.outputs.needs_update == 'true'
+        run: |
+          BODY="Android SDK updates are available:\n\n"
+          BODY+="| Component | Current | Latest |\n"
+          BODY+="|-----------|---------|--------|\n"
+          BODY+="| cmdline-tools | ${{ steps.current.outputs.cmdline_tools }} | ${{ steps.android.outputs.cmdline_tools }} |\n"
+          BODY+="| build-tools | ${{ steps.current.outputs.build_tools }} | ${{ steps.android.outputs.build_tools }} |\n"
+          BODY+="| platform | ${{ steps.current.outputs.platform }} | ${{ steps.android.outputs.platform }} |\n"
+          BODY+="\nUpdate \`Dockerfile.android\` to use the latest versions."
+
+          # Check if issue already exists
+          EXISTING=$(curl -s -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/issues?state=open&labels=android-sdk-update" | jq length)
+
+          if [ "$EXISTING" = "0" ]; then
+            curl -fsSL -X POST \
+              -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+              -H "Content-Type: application/json" \
+              "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/issues" \
+              -d "{
+                \"title\": \"Android SDK updates available\",
+                \"body\": \"$(echo -e "$BODY")\",
+                \"labels\": [\"android-sdk-update\"]
+              }"
+            echo "Created issue for Android SDK updates"
+          else
+            echo "Issue for Android SDK updates already exists"
+          fi

Dockerfile

@@ -1,31 +1,20 @@
-FROM debian:bookworm-slim
+FROM svrnty/base-distro:flutter-sdk-latest
 
 ARG FLUTTER_VERSION=3.38.9
 
-LABEL org.opencontainers.image.title="gpb-flutter-sdk-web"
+LABEL org.opencontainers.image.title="flutter-sdk-web"
 LABEL org.opencontainers.image.description="Minimal Flutter SDK for Web/WASM CI builds"
 LABEL org.opencontainers.image.version="${FLUTTER_VERSION}"
 
-# Install minimal dependencies for Flutter web builds
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    git \
-    unzip \
-    xz-utils \
-    ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
+USER 0
 
-ENV FLUTTER_HOME=/opt/flutter
-ENV PATH="${FLUTTER_HOME}/bin:${FLUTTER_HOME}/bin/cache/dart-sdk/bin:${PATH}"
+# Clone Flutter SDK from git (supports both amd64 and arm64)
+RUN git clone --depth 1 --branch ${FLUTTER_VERSION} https://github.com/flutter/flutter.git /opt/flutter && \
+    git config --global --add safe.directory /opt/flutter && \
+    rm -rf /opt/flutter/dev /opt/flutter/examples && \
+    chown -R 65532:65532 /opt/flutter
 
-# Download Flutter SDK from official archive
-RUN curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz" \
-      -o /tmp/flutter.tar.xz && \
-    tar xf /tmp/flutter.tar.xz -C /opt && \
-    rm /tmp/flutter.tar.xz
-
-# Mark git directory as safe (tarball is owned by different uid)
-RUN git config --global --add safe.directory "${FLUTTER_HOME}"
+USER 65532
 
 # Configure for web-only (disable everything else)
 RUN flutter config --enable-web \

Dockerfile.android

@@ -1,54 +1,46 @@
-FROM debian:bookworm-slim
+FROM svrnty/base-distro:flutter-sdk-android-latest
 
 ARG FLUTTER_VERSION=3.38.9
-ARG ANDROID_SDK_TOOLS_VERSION=11076708
-ARG ANDROID_COMPILE_SDK=35
-ARG ANDROID_BUILD_TOOLS=35.0.1
+ARG ANDROID_SDK_TOOLS_VERSION=14742923
+ARG ANDROID_COMPILE_SDK=36
+ARG ANDROID_BUILD_TOOLS=36.1.0
 
-LABEL org.opencontainers.image.title="gpb-flutter-sdk-android"
+LABEL org.opencontainers.image.title="flutter-sdk-android"
 LABEL org.opencontainers.image.description="Flutter SDK for Android CI builds"
 LABEL org.opencontainers.image.version="${FLUTTER_VERSION}"
 
-# Install dependencies for Flutter + Android SDK
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    git \
-    unzip \
-    xz-utils \
-    ca-certificates \
-    openjdk-17-jdk-headless \
-    && rm -rf /var/lib/apt/lists/*
+USER 0
 
-# Android SDK
+# Set up Android SDK environment
 ENV ANDROID_HOME=/opt/android-sdk
 ENV PATH="${ANDROID_HOME}/cmdline-tools/latest/bin:${ANDROID_HOME}/platform-tools:${PATH}"
 
+# Download Android SDK command-line tools, install SDK components, and remove vulnerable lint-psi
 RUN mkdir -p "${ANDROID_HOME}/cmdline-tools" && \
     curl -fsSL "https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_SDK_TOOLS_VERSION}_latest.zip" \
       -o /tmp/cmdline-tools.zip && \
     unzip -q /tmp/cmdline-tools.zip -d /tmp/cmdline-tools && \
     mv /tmp/cmdline-tools/cmdline-tools "${ANDROID_HOME}/cmdline-tools/latest" && \
-    rm -rf /tmp/cmdline-tools.zip /tmp/cmdline-tools
-
-# Accept licenses and install SDK components
-RUN yes | sdkmanager --licenses > /dev/null 2>&1 && \
+    rm -rf /tmp/cmdline-tools.zip /tmp/cmdline-tools && \
+    yes | sdkmanager --licenses > /dev/null 2>&1 && \
     sdkmanager --install \
       "platform-tools" \
       "platforms;android-${ANDROID_COMPILE_SDK}" \
-      "build-tools;${ANDROID_BUILD_TOOLS}"
+      "build-tools;${ANDROID_BUILD_TOOLS}" && \
+    # Remove lint-psi to eliminate protobuf-java 2.6.1 CVEs (saves 86MB)
+    rm -rf "${ANDROID_HOME}/cmdline-tools/latest/lib/external/lint-psi"
 
-# Flutter SDK
-ENV FLUTTER_HOME=/opt/flutter
-ENV PATH="${FLUTTER_HOME}/bin:${FLUTTER_HOME}/bin/cache/dart-sdk/bin:${PATH}"
+# Clone Flutter SDK from git (supports both amd64 and arm64)
+RUN git clone --depth 1 --branch ${FLUTTER_VERSION} https://github.com/flutter/flutter.git /opt/flutter && \
+    git config --global --add safe.directory /opt/flutter && \
+    rm -rf /opt/flutter/dev /opt/flutter/examples
 
-RUN curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz" \
-      -o /tmp/flutter.tar.xz && \
-    tar xf /tmp/flutter.tar.xz -C /opt && \
-    rm /tmp/flutter.tar.xz
+# Fix ownership before switching to flutter user
+RUN chown -R 65532:65532 /opt/flutter "${ANDROID_HOME}"
 
-RUN git config --global --add safe.directory "${FLUTTER_HOME}"
+USER 65532
 
-# Configure for Android-only
+# Configure Flutter for Android-only
 RUN flutter config --enable-android \
     --no-enable-web \
     --no-enable-ios \

Dockerfile.linux

@@ -1,38 +1,24 @@
-FROM debian:bookworm-slim
+FROM svrnty/base-distro:flutter-sdk-linux-latest
 
 ARG FLUTTER_VERSION=3.38.9
 
-LABEL org.opencontainers.image.title="gpb-flutter-sdk-linux"
+LABEL org.opencontainers.image.title="flutter-sdk-linux"
 LABEL org.opencontainers.image.description="Flutter SDK for Linux desktop CI builds"
 LABEL org.opencontainers.image.version="${FLUTTER_VERSION}"
 
-# Install dependencies for Flutter + Linux desktop builds
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    git \
-    unzip \
-    xz-utils \
-    ca-certificates \
-    clang \
-    cmake \
-    ninja-build \
-    pkg-config \
-    libgtk-3-dev \
-    liblzma-dev \
-    libstdc++-12-dev \
-    && rm -rf /var/lib/apt/lists/*
+USER 0
 
-ENV FLUTTER_HOME=/opt/flutter
-ENV PATH="${FLUTTER_HOME}/bin:${FLUTTER_HOME}/bin/cache/dart-sdk/bin:${PATH}"
+# Clone Flutter SDK from git (supports both amd64 and arm64)
+RUN git clone --depth 1 --branch ${FLUTTER_VERSION} https://github.com/flutter/flutter.git /opt/flutter && \
+    git config --global --add safe.directory /opt/flutter && \
+    rm -rf /opt/flutter/dev /opt/flutter/examples
 
-RUN curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz" \
-      -o /tmp/flutter.tar.xz && \
-    tar xf /tmp/flutter.tar.xz -C /opt && \
-    rm /tmp/flutter.tar.xz
+# Fix ownership before switching to flutter user
+RUN chown -R 65532:65532 /opt/flutter
 
-RUN git config --global --add safe.directory "${FLUTTER_HOME}"
+USER 65532
 
-# Configure for Linux desktop only
+# Configure Flutter for Linux desktop only
 RUN flutter config --enable-linux-desktop \
     --no-enable-web \
     --no-enable-android \

PLAN.md

@@ -0,0 +1,259 @@
+# Custom Minimal Flutter SDK Distribution
+
+## Goal
+
+Build Flutter SDK from source in a multi-stage Docker build, then copy only the compiled SDK and its runtime dependencies into a custom minimal Linux base image. The result is a secure, minimal container with zero build toolchain bloat.
+
+## Architecture
+
+```
+┌─────────────────────────────────────┐
+│  Stage 1: BUILD (debian:bookworm)   │
+│                                     │
+│  - Full build toolchain             │
+│  - Compile Flutter engine + Dart    │
+│  - All build-time deps              │
+│  - Discarded after build            │
+└──────────────┬──────────────────────┘
+               │ COPY artifacts
+               ▼
+┌─────────────────────────────────────┐
+│  Stage 2: RUNTIME (custom base)     │
+│                                     │
+│  - Minimal glibc + runtime libs     │
+│  - Flutter SDK (pre-compiled)       │
+│  - Only what's needed to run        │
+│    `flutter build` commands         │
+└─────────────────────────────────────┘
+```
+
+## Approach: apko + melange on Wolfi
+
+Use Chainguard's open-source tooling to build the runtime base image from Wolfi packages. This avoids maintaining a full Linux distribution while achieving the same result.
+
+### Why Wolfi (not Alpine, not from scratch)
+
+- **glibc-based**: Flutter/Dart require glibc (musl/Alpine won't work)
+- **apk package format**: Minimal, fast, composable
+- **15,000+ packages**: glibc, libstdc++, git, curl, ca-certificates all available
+- **Nightly CVE patching**: Chainguard patches 80%+ of vulnerabilities within 24 hours
+- **No distro maintenance burden**: We consume their packages, not maintain them
+
+### Tools
+
+| Tool | Purpose |
+|---|---|
+| **melange** | Build custom APK packages (Flutter SDK, Android SDK) from source |
+| **apko** | Compose final OCI image from APK packages (Wolfi base + custom) |
+
+## Stage 1: Build Flutter from Source
+
+Flutter SDK source build requirements:
+- git (clone flutter/flutter and flutter/engine repos)
+- Python 3 (engine build scripts)
+- curl, unzip, xz-utils
+- clang/llvm (engine compilation)
+- ninja-build, gn (engine build system)
+- libstdc++-dev
+- Dart SDK (bootstrapped from prebuilt, then rebuilt)
+
+Flutter engine build steps:
+1. Clone `flutter/engine` at the pinned revision from `flutter/flutter/bin/internal/engine.version`
+2. Run `gclient sync` to fetch dependencies
+3. Build with `gn` + `ninja` for target platform
+4. Dart SDK is built as part of the engine
+
+### Per-Variant Build Targets
+
+| Variant | Engine build target | Extra build deps | Extra runtime deps |
+|---|---|---|---|
+| **web** | `host_release` (dart2js/dart2wasm) | None | None |
+| **android** | `android_release` + `android_release_arm64` | Android NDK | JDK 17, Android SDK cmdline-tools |
+| **linux** | `linux_release_x64` | GTK3-dev, CMake | GTK3 runtime libs |
+
+## Stage 2: Custom Runtime Base via apko
+
+### Web variant (minimal)
+
+```yaml
+# apko.web.yaml
+contents:
+  keyring:
+    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+  repositories:
+    - https://packages.wolfi.dev/os
+    - @local /packages  # our melange-built Flutter SDK package
+  packages:
+    - wolfi-baselayout
+    - glibc
+    - libstdc++
+    - git
+    - ca-certificates-bundle
+    - flutter-sdk-web@local
+entrypoint:
+  command: /bin/sh
+environment:
+  FLUTTER_HOME: /opt/flutter
+  PATH: /opt/flutter/bin:/opt/flutter/bin/cache/dart-sdk/bin:/usr/bin:/bin
+archs:
+  - x86_64
+```
+
+### Android variant
+
+Same as web plus:
+- `openjdk-17-jre` (from Wolfi)
+- `flutter-sdk-android@local` (custom package including Android SDK components)
+
+### Linux desktop variant
+
+Same as web plus:
+- `gtk+3.0` runtime libs (from Wolfi, or custom melange package if not available)
+- `flutter-sdk-linux@local`
+
+## melange Package Definitions
+
+### flutter-sdk-web.melange.yaml (example structure)
+
+```yaml
+package:
+  name: flutter-sdk-web
+  version: 3.38.9
+  epoch: 0
+  description: Flutter SDK for Web/WASM builds (compiled from source)
+
+environment:
+  contents:
+    packages:
+      - build-base
+      - git
+      - python3
+      - curl
+      - unzip
+      - xz
+      - clang
+      - ninja
+      - gn
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/flutter/flutter.git
+      tag: ${{package.version}}
+      destination: flutter
+
+  - runs: |
+      # Bootstrap Dart SDK
+      flutter/bin/flutter --version
+
+      # Configure for web-only
+      flutter/bin/flutter config --enable-web \
+        --no-enable-android --no-enable-ios \
+        --no-enable-linux-desktop --no-enable-macos-desktop \
+        --no-enable-windows-desktop
+
+      # Precache web artifacts
+      flutter/bin/flutter precache --web \
+        --no-android --no-ios --no-linux \
+        --no-macos --no-windows --no-fuchsia --no-universal
+
+      # Install to package destination
+      mkdir -p ${{targets.destdir}}/opt
+      mv flutter ${{targets.destdir}}/opt/flutter
+
+      # Mark git safe directory
+      git config --global --add safe.directory /opt/flutter
+```
+
+## Implementation Phases
+
+### Phase 1: Proof of Concept (web variant only)
+
+1. Install melange and apko locally
+2. Write `flutter-sdk-web.melange.yaml` to package Flutter SDK
+3. Build the APK: `melange build flutter-sdk-web.melange.yaml`
+4. Write `apko.web.yaml` to compose the final image
+5. Build the image: `apko build apko.web.yaml flutter-sdk-web:test flutter-sdk-web.tar`
+6. Load and test: `docker load < flutter-sdk-web.tar`
+7. Verify: `docker run --rm flutter-sdk-web:test flutter doctor -v`
+8. Compare image size vs current debian:bookworm-slim approach
+
+### Phase 2: CI Pipeline
+
+1. Add melange + apko build steps to publish.yaml
+2. Multi-stage: melange builds APK → apko composes image → push to registry
+3. Scout CVE scan on the final image
+4. SBOM generation (apko generates SBOMs natively)
+
+### Phase 3: Android + Linux Desktop Variants
+
+1. Write melange packages for Android SDK components
+2. Write apko YAML for Android variant (add JDK from Wolfi)
+3. Write apko YAML for Linux variant (add GTK3 from Wolfi)
+4. Test each variant with real Flutter project builds
+
+### Phase 4: Automated Updates
+
+1. Daily update-check detects new Flutter stable release
+2. Triggers melange rebuild of Flutter SDK package
+3. apko recomposes image with latest Wolfi packages (picks up CVE fixes)
+4. Push new images to registry
+
+## Expected Image Sizes
+
+| Variant | Current (debian:bookworm-slim) | Target (Wolfi/apko) |
+|---|---|---|
+| Web | ~1.8 GB | ~1.2-1.4 GB |
+| Android | ~3.5 GB | ~2.5-3.0 GB |
+| Linux | ~2.2 GB | ~1.5-1.8 GB |
+
+Note: Flutter SDK itself is ~1+ GB regardless of base. The savings come from the base OS layer (74 MB debian-slim → ~14 MB Wolfi base) and elimination of build-time packages.
+
+## File Structure (Target)
+
+```
+docker-flutter-sdk/
+├── melange/
+│   ├── flutter-sdk-web.melange.yaml
+│   ├── flutter-sdk-android.melange.yaml
+│   └── flutter-sdk-linux.melange.yaml
+├── apko/
+│   ├── web.apko.yaml
+│   ├── android.apko.yaml
+│   └── linux.apko.yaml
+├── Dockerfile                    # Fallback: current debian approach (web)
+├── Dockerfile.android            # Fallback: current debian approach (android)
+├── Dockerfile.linux              # Fallback: current debian approach (linux)
+├── .gitea/
+│   └── workflows/
+│       ├── publish.yaml          # Build with melange+apko, push to registry
+│       ├── publish-dockerfile.yaml  # Fallback Dockerfile builds
+│       ├── scout.yaml
+│       └── update-check.yaml
+└── PLAN.md
+```
+
+## Risks and Mitigations
+
+| Risk | Mitigation |
+|---|---|
+| GTK3 dev libs not in Wolfi | Fall back to Dockerfile.linux with debian-slim for that variant |
+| Flutter engine source build is complex | Start with packaging prebuilt SDK, graduate to source build |
+| melange/apko learning curve | Well-documented by Chainguard, active community |
+| Wolfi package availability changes | Pin package versions, maintain fallback Dockerfiles |
+| Build times for source compilation | Cache melange build artifacts, only rebuild on new Flutter release |
+
+## Dependencies
+
+- melange CLI: `go install chainguard.dev/melange@latest`
+- apko CLI: `go install chainguard.dev/apko@latest`
+- Docker (for testing)
+- Signing key pair (for APK package signing)
+
+## References
+
+- [Wolfi Overview](https://edu.chainguard.dev/open-source/wolfi/overview/)
+- [Getting Started with apko](https://edu.chainguard.dev/open-source/build-tools/apko/getting-started-with-apko/)
+- [Getting Started with melange](https://edu.chainguard.dev/open-source/build-tools/melange/getting-started-with-melange/)
+- [Flutter Engine Build Instructions](https://github.com/flutter/flutter/wiki/Compiling-the-engine)
+- [wolfi-dev/os packages](https://github.com/wolfi-dev/os)