ci/forge/ci-forge.Containerfile
# The forge's step image (lane CI-RED, 2026-10-30): the CI test image ci4 (by digest, the
# one ci/ci-toolchain.Containerfile made and release builds pin) plus a headless Chromium.
# holger-ui's and monetize's quick sets run their browser tests IN the step container
# (`cargo xtask browser` runs right there when it is inside a container), and ci4 has no
# Chromium: holger-ui-ci was red at 3adac816 with "chromium starts: No such file or
# directory". The recipe is holger-ui's browser-tests/Containerfile and monetize's
# browser/Containerfile, over ci4. Release builds keep ci4; only the forge's steps use this.
# setup.sh builds it when forge.env's DWARVES_RUNA_IMAGE digest is missing on the box.
# podman-remote (as `podman`): an `engine = true` pipeline (monetize-full) drives the forge's
# step engine through CONTAINER_HOST; no other pipeline gets a socket.
FROM localhost/nordisk-cargo-toolchain@sha256:875a7a325dfe7f6b838535d085a2a502e8ad250076c947f6d023b1e224f03334
RUN apt-get update && apt-get install -y --no-install-recommends chromium fonts-dejavu-core ca-certificates podman-remote \
&& rm -rf /var/lib/apt/lists/* /var/log/apt /var/log/dpkg.log \
&& ln -s /usr/bin/podman-remote /usr/local/bin/podman \
&& chromium --version \
&& podman-remote --version
# trunk and wasm-bindgen (CI-RED): the fast tests build the consoles' WebAssembly bundles
# with trunk; both binaries come from the pinned UI toolchain image (live-ui: trunk 0.21.14,
# wasm-bindgen 0.2.129), not from a download at build time.
COPY --from=localhost/nordisk-cargo-toolchain@sha256:b69e284a6d488f2cb7b5c17cb73aecf550e52c532e5267fce10fd67874dc9e93 /usr/local/cargo/bin/trunk /usr/local/bin/trunk
COPY --from=localhost/nordisk-cargo-toolchain@sha256:b69e284a6d488f2cb7b5c17cb73aecf550e52c532e5267fce10fd67874dc9e93 /usr/local/cargo/bin/wasm-bindgen /usr/local/bin/wasm-bindgen
RUN trunk --version && wasm-bindgen --version
ENV CHROME=/usr/bin/chromium
# OSSF-NEXT (2026-10-30): the nightly coverage step runs `cargo llvm-cov`, which needs rustc's
# own llvm-tools (llvm-profdata/llvm-cov of rustc's LLVM, not Debian's) and cargo-llvm-cov,
# pinned and built from its committed lock.
RUN rustup component add llvm-tools \
&& CARGO_HOME=/tmp/cargo-home cargo install --locked --root /usr/local cargo-llvm-cov@0.9.1 \
&& rm -rf /tmp/cargo-home \
&& cargo llvm-cov --version