nordisk/heimdall

ci/ci.Containerfile

# SPDX-License-Identifier: AGPL-3.0-only
# Heimdall is a defensive sandbox. This image runs scripts/ci.sh, which builds
# and tests Heimdall itself and nothing else: fmt, clippy, tests, the
# heimdall-plain youki shim (libseccomp), cargo deny (deny.toml) and the fuzz
# smoke runs.
#
# Build (tag is this repository's own; never retag a shared toolchain tag):
#   podman build -t localhost/nordisk-cargo-toolchain:heim-ci -f ci/ci.Containerfile ci
# Run:
#   podman run --rm -v "$PWD":/src -w /src localhost/nordisk-cargo-toolchain:heim-ci scripts/ci.sh
#
# Pinned: the base tag, a dated nightly, cargo-fuzz and cargo-deny. Bump them
# together and note the new values here.
FROM localhost/nordisk-cargo-toolchain:live-tools-ssl-proto

ARG NIGHTLY=nightly-2026-10-01
ARG CARGO_FUZZ_VERSION=0.13.1
ARG CARGO_DENY_VERSION=0.20.2
# At most 8 compile jobs while the image builds (shared build hosts).
ARG CARGO_BUILD_JOBS=8

# wasi-libc: only its HEADERS are used — the verify-bundle guest compiles
# OpenZL's C decoder for wasm32 against them (guests/verify-bundle/openzl/,
# docs/OPENZL-WASM.md); no wasi-libc object is linked, the guest imports
# nothing. Pinned by the snapshot apt source of the base image.
ARG WASI_LIBC_VERSION=0.0~git20241209.574b88d-2

RUN apt-get update \
 && apt-get install -y --no-install-recommends libseccomp-dev pkg-config git \
        "wasi-libc=${WASI_LIBC_VERSION}" \
 && rm -rf /var/lib/apt/lists/*

RUN rustup component add rustfmt clippy \
 && rustup toolchain install "${NIGHTLY}" --profile minimal \
        --component llvm-tools-preview \
 && ln -s "${RUSTUP_HOME:-/usr/local/rustup}/toolchains/${NIGHTLY}-x86_64-unknown-linux-gnu" \
        "${RUSTUP_HOME:-/usr/local/rustup}/toolchains/nightly-x86_64-unknown-linux-gnu" \
 && cargo install --locked --root /usr/local cargo-fuzz --version "${CARGO_FUZZ_VERSION}" \
 && cargo install --locked --root /usr/local cargo-deny --version "${CARGO_DENY_VERSION}" \
 && rm -rf /usr/local/cargo/registry /usr/local/cargo/git \
 && cargo fmt --version && cargo clippy --version && cargo deny --version \
 && cargo +nightly fuzz --version