sccache

sccache is a ccache-like compiler caching tool that was created by Mozilla. It is a compiler wrapper that avoids compilation when possible and stores cached results locally or in remote storage. It supports caching the compilation of several languages including C, C++, and Rust. sccache is used in many large projects, including Firefox, and is optimized for incremental builds and advanced local and remote caching.

Depot Cache provides a remote cache service that can be used with sccache, allowing you to incrementally cache and reuse parts of your builds. This cache is accessible from anywhere, both on your local machine and on CI/CD systems.

Configuring sccache to use Depot Cache

Depot Cache can be used with sccache from Depot's managed GitHub Actions runners, from your local machine, from any CI/CD system, or within containerized builds using Dockerfiles or Bake files.

From Depot-managed Actions runners

Depot GitHub Actions runners are pre-configured to use Depot Cache with sccache - each runner is launched with a SCCACHE_WEBDAV_ENDPOINT environment variable and is pre-configured with the connection details for Depot Cache.

If you don't want Depot to set up the SCCACHE_WEBDAV_ENDPOINT environment variable on each runner, disable Allow Actions jobs to automatically connect to Depot Cache in your organization settings page. You can manually configure sccache to use Depot Cache as described in the "Using Depot Cache from your local machine or any CI/CD system" section.

Using Depot Cache with sccache in depot/build-push-action

When using depot/build-push-action to build Docker images that contain Rust projects with sccache, your build needs access to sccache's remote cache credentials to benefit from caching.

These credentials are not automatically available inside your Docker build environment. Unlike builds running directly on Depot-managed GitHub Actions runners (which have automatic access to Depot Cache environment variables), containerized builds execute in isolated VMs that require explicit configuration.

Follow these steps to securely pass your sccache credentials into your Docker build:

1. Store the Depot token in a GitHub Secret named DEPOT_TOKEN.

2. Configure your GitHub Action to pass secrets to the container build:

- name: Build and push
  uses: depot/build-push-action@v1
  with:
    context: .
    file: ./Dockerfile
    push: true
    tags: your-image:tag
    secrets: |
      "DEPOT_TOKEN=${{ secrets.DEPOT_TOKEN }}"

3. Update your Dockerfile to mount the secrets as environment variables:

# syntax=docker/dockerfile:1

# ... other Dockerfile instructions

# Mount secrets with IDs matching the environment variable names
RUN --mount=type=secret,id=DEPOT_TOKEN,env=SCCACHE_WEBDAV_TOKEN \
    SCCACHE_WEBDAV_ENDPOINT=https://cache.depot.dev sccache --start-server && \
    cargo build --release

Adding # syntax=docker/dockerfile:1 as the first line of your Dockerfile enables mounting secrets as environment variables.

Using Depot Cache from your local machine or any CI/CD system

To manually configure sccache to use Depot Cache, you will need to set two environment variables in your environment, representing the Depot Cache service endpoint and your API token:

export SCCACHE_WEBDAV_ENDPOINT=https://cache.depot.dev
export SCCACHE_WEBDAV_TOKEN=DEPOT_TOKEN

If you are a member of multiple organizations, and you are authenticating with a user token, you must instead specify a password along with which organization should be used for cache storage as follows:

export SCCACHE_WEBDAV_ENDPOINT=https://cache.depot.dev
export SCCACHE_WEBDAV_USERNAME=DEPOT_ORG_ID
export SCCACHE_WEBDAV_PASSWORD=DEPOT_TOKEN

After sccache is configured to use Depot Cache, you can then run your builds as you normally would. sccache will automatically communicate with Depot Cache to fetch and reuse any stored build artifacts from your previous builds.

Using Depot Cache with sccache in Depot CLI

When building directly with Depot CLI, follow these steps:

1. Update your Dockerfile to mount the secret as environment variables:

# syntax=docker/dockerfile:1

# ... other Dockerfile instructions

# Mount secrets with IDs matching the environment variable names
RUN --mount=type=secret,id=DEPOT_TOKEN,env=SCCACHE_WEBDAV_TOKEN \
    SCCACHE_WEBDAV_ENDPOINT=https://cache.depot.dev sccache --start-server && \
    cargo build --release

Adding # syntax=docker/dockerfile:1 as the first line of your Dockerfile enables mounting secrets as environment variables.

2. Build with Depot CLI:

depot build --secret id=DEPOT_TOKEN,env=DEPOT_TOKEN -t your-image:tag .

Or with Docker Buildx:

docker buildx build --secret id=DEPOT_TOKEN,env=DEPOT_TOKEN -t your-image:tag .

Using Depot Cache with sccache in Bake files

When using Bake files to build Docker images containing Rust projects with sccache, you can pass secrets through the target.secret attribute:

1. Define the secret in your docker-bake.hcl file:

target "default" {
  context    = "."
  dockerfile = "Dockerfile"
  tags       = ["your-image:tag"]
  secret = [
    {
      type = "env"
      id   = "DEPOT_TOKEN"
    }
  ]
}

2. Update your Dockerfile to mount the secret as environment variables:

# syntax=docker/dockerfile:1

# ... other Dockerfile instructions

# Mount secrets with IDs matching the environment variable names
RUN --mount=type=secret,id=DEPOT_TOKEN,env=SCCACHE_WEBDAV_TOKEN \
    SCCACHE_WEBDAV_ENDPOINT=https://cache.depot.dev sccache --start-server && \
    cargo build --release

Adding # syntax=docker/dockerfile:1 as the first line of your Dockerfile enables mounting secrets as environment variables.

3. Run the build with depot bake:

DEPOT_TOKEN=your_token depot bake