tftsr-devops_investigation/.docker/Dockerfile.linux-amd64

# Pre-baked builder for Linux amd64 Tauri releases.
# All system dependencies are installed once here; CI jobs skip apt-get entirely.
# Rebuild when: Rust toolchain version changes, webkit2gtk/gtk major version changes,
# or Node.js major version changes.  Tag format: rust<VER>-node<VER>
FROM rust:1.88-slim

RUN apt-get update -qq \
    && apt-get install -y -qq --no-install-recommends \
       libwebkit2gtk-4.1-dev \
       libssl-dev \
       libgtk-3-dev \
       libayatana-appindicator3-dev \
       librsvg2-dev \
       patchelf \
       pkg-config \
       curl \
       perl \
       jq \
       git \
    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
    && apt-get install -y --no-install-recommends nodejs \
    && rm -rf /var/lib/apt/lists/*

RUN rustup target add x86_64-unknown-linux-gnu \
    && rustup component add rustfmt clippy || true
feat(ci): add persistent pre-baked Docker builder images Add three Dockerfiles under .docker/ and a build-images.yml workflow that pushes them to the local Gitea container registry (172.0.0.29:3000). Each image pre-installs all system deps, Node.js 22, and the Rust cross- compilation target so release builds can skip apt-get entirely: trcaa-linux-amd64:rust1.88-node22 — webkit2gtk, gtk3, all Tauri deps trcaa-windows-cross:rust1.88-node22 — mingw-w64, nsis, Windows target trcaa-linux-arm64:rust1.88-node22 — arm64 multiarch dev libs, Rust 1.88 build-images.yml triggers automatically when .docker/ changes on master and supports workflow_dispatch for manual/first-time builds. auto-tag.yml is NOT changed in this commit — switch it to use the new images in the follow-up PR (after images are pushed to the registry). One-time server setup required before first use: echo '{"insecure-registries":["172.0.0.29:3000"]}' \ \| sudo tee /etc/docker/daemon.json && sudo systemctl restart docker 2026-04-06 02:07:17 +00:00			`# Pre-baked builder for Linux amd64 Tauri releases.`
			`# All system dependencies are installed once here; CI jobs skip apt-get entirely.`
			`# Rebuild when: Rust toolchain version changes, webkit2gtk/gtk major version changes,`
			`# or Node.js major version changes. Tag format: rust<VER>-node<VER>`
			`FROM rust:1.88-slim`

			`RUN apt-get update -qq \`
			`&& apt-get install -y -qq --no-install-recommends \`
			`libwebkit2gtk-4.1-dev \`
			`libssl-dev \`
			`libgtk-3-dev \`
			`libayatana-appindicator3-dev \`
			`librsvg2-dev \`
			`patchelf \`
			`pkg-config \`
			`curl \`
			`perl \`
			`jq \`
			`git \`
			`&& curl -fsSL https://deb.nodesource.com/setup_22.x \| bash - \`
			`&& apt-get install -y --no-install-recommends nodejs \`
			`&& rm -rf /var/lib/apt/lists/*`

fix(ci): address AI review — rustup idempotency and cargo --locked Dockerfiles: - Merge rustup target add and component add into one chained RUN with \|\| true guard, making it safe if rustfmt/clippy are already present in the base image's default toolchain profile (rust:1.88-slim default profile includes both; the guard is belt-and-suspenders) test.yml: - Add --locked to cargo clippy and cargo test to enforce Cargo.lock during CI, preventing silent dependency upgrades Not addressed (accepted/out of scope): - git in images: already installed in all three Dockerfiles (lines 19, 13, 15 respectively) — reviewer finding was incorrect - HTTP registry: accepted risk for air-gapped self-hosted infrastructure - Image signing (Cosign): no infrastructure in place yet - Hardcoded registry IP: consistent with project-wide pattern 2026-04-12 23:28:07 +00:00			`RUN rustup target add x86_64-unknown-linux-gnu \`
			`&& rustup component add rustfmt clippy \|\| true`