build(sidecar): build all sidecars in one RUN step to free BuildKit slots

[pvijayakrish]

Summary

Build all three sidecars, their SBOMs, and their license files in one RUN step. Remove the shared Cargo target cache, so BuildKit controls invalidation for compiled workspace artifacts.

Linear: OPS-8864

CI BuildKit pods run only 3 build steps at a time (max-parallelism = 3). BuildKit takes a slot before a step waits for a sharing=locked cache. Previously, the three sidecar builders and compliance steps could occupy every slot while one process compiled.

Across 150 sidecar builds from Sep 28 to Oct 6, builder steps held slots for a median of about 38 minutes per architecture. Cargo used about 19 minutes. The remaining wait time reduced capacity for other builds.

Changes in lib/sidecar/Dockerfile:

• One sidecar-builder stage replaces the three builder stages and the compliance-inventory stage.
• The single RUN takes the Cargo download-cache locks once.
• Each sidecar keeps its own cargo build -p command. One combined Cargo command would merge backend-specific features.
• The shared /src/target cache mount is removed. A changed Docker input now starts with a fresh target directory.
• Cargo registry, Git, and tool caches remain shared. They avoid repeated downloads without reusing compiled workspace outputs.
• The temporary target directory is removed before the intermediate layer snapshot.
• The timestamp helper and its regression test are removed.
• The licenses stage uses bind mounts. The runtime stages copy binaries from /out/bin/.

Expected effect: about 31 fewer idle slot-minutes per architecture per sidecar build. Builds with changed inputs will recompile dependencies. Unchanged inputs still use the normal BuildKit layer cache.

This overlaps draft #15680, which merges the builders but leaves compliance inventory separate.

Validation

• Targeted pre-commit checks passed.
• Strict CODEOWNERS validation passed with 100% explicit coverage.
• The Docker RUN shell body passed dash -n syntax validation.
• git diff --check passed.
• No timestamp-helper or shared-target-cache references remain.
• Local docker buildx build --check was unavailable because the Docker daemon was stopped.
• An end-to-end multi-architecture build was not run locally. PR CI will provide that validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: ai-dynamo/dynamo/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: fa31dc1b-dee5-492f-8b68-34df388ec3fa

📥 Commits

Reviewing files that changed from the base of the PR and between 433b4da and c0c3ef9.

📒 Files selected for processing (2)

• .github/workflows/shared-build-sidecar.yml
• lib/sidecar/Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The sidecar Dockerfile replaces separate engine builder stages with one sidecar-builder stage. It stages binaries and compliance inputs for the runtime, sidecar-binaries target, and compliance scan.

Changes

Sidecar build and packaging

Layer / File(s)	Summary
Build sidecars and generate compliance inputs lib/sidecar/Dockerfile	The sidecar-builder stage generates SBOMs, builds and stages the vLLM, SGLang, and TensorRT-LLM binaries, and collects Rust license files.
Package staged sidecar binaries lib/sidecar/Dockerfile, .github/workflows/shared-build-sidecar.yml	The runtime and sidecar-binaries targets copy binaries from sidecar-builder. The workflow comment now identifies sidecar-builder as the dependency.
Mount compliance scan inputs lib/sidecar/Dockerfile	The licenses stage bind-mounts the runtime filesystem, sidecar SBOMs, and Rust licenses for the compliance generator.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to c0c3e

No actionable issue remains before merge. The first full sidecar CI build will still validate the consolidated build end to end.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the primary change: consolidating sidecar builds into one RUN step to improve BuildKit slot usage.
Description check	✅ Passed	The description provides detailed scope, implementation details, motivation, validation results, and a Linear issue reference. It does not use all template headings, but it contains the required infor…

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Dynamo PR CI passed — run 37830306501 (attempt 1) on 7cc302e050

Gate checks: ✅ backend-status-check · ✅ deploy-status-check · ✅ dynamo-status-check

_{Posted automatically by Devin for run 37830306501. Updated on every full-CI run of this PR.}