ci/ci-toolchain.Containerfile
# The CI test image: the pinned cargo toolchain recipe (edda's nornir-build-thing
# cargo-toolchain.Containerfile, built as recipe-53fec13a5c1c7f2c) plus what a workspace
# TEST needs and a release row does not: OpenSSL headers for holger-mannequin
# (cert-helper -> openssl-sys). Release rows still build in the recipe itself, through
# the Build Thing, so a shipped crate that starts needing OpenSSL stays red there.
# apt reads the snapshot.debian.org instant the recipe already pins.
# Clippy and rustfmt: a CI step is allowed to lint and to check formatting; a release row
# never runs either. Both are added for the PINNED toolchain by name (a bare `rustup
# component add` lands on whatever is active while the image builds: some lanes' ci2 had no
# clippy for 1.97.1, and no ci2 had rustfmt), and the build proves both answer before the
# image is tagged. ci/verbs/tests/ci_image_has_clippy_and_rustfmt.rs.
# The clients a test starts (ci4, 2026-10-27): openssh-client (gunnar-cli's ssh-keygen and
# ssh push tests), strace (gunnar-server's audit_read_io counts writes under `strace -f`) and
# git-lfs (gunnar-lfs, the runner's own `git lfs checkout`). ci3 had none of the three and
# about 42 gunnar test targets were red in it. The build proves each answers.
# A step runs as the invoking user (`--userns=keep-id`, nornir-xtask-support's ci::Container),
# never as the namespace's root: root ignores every mode bit, so permission tests lie.
# The runner pins this image by DIGEST (ci/runner.sh CI_IMAGE);
# ci/verbs/tests/ci_image_has_the_test_clients.rs.
FROM localhost/nordisk-cargo-toolchain:recipe-53fec13a5c1c7f2c
RUN apt-get update && apt-get install -y --no-install-recommends libssl-dev openssh-client strace git-lfs \
&& rm -rf /var/lib/apt/lists/* /var/log/apt /var/log/dpkg.log \
&& ssh -V && ssh-keygen -t ed25519 -N "" -q -f /tmp/k && rm -f /tmp/k /tmp/k.pub \
&& strace -V \
&& git lfs version \
&& rustup component add --toolchain 1.97.1 clippy rustfmt \
&& cargo +1.97.1 clippy --version \
&& cargo +1.97.1 fmt --version