Containerize local builds with rootless nerdctl

tools/build

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "$0")/.." && pwd)"
+containerfile="$root/tools/container/Containerfile"
+
+fail() {
+    printf 'build: %s\n' "$*" >&2
+    exit 1
+}
+
+if [[ "${1:-}" == --inside-container && $# -eq 1 ]]; then
+    [[ "${LAZARET_BUILD_CONTAINER:-}" == 1 ]] || fail 'container marker is absent'
+    cd "$root"
+    tools/materialize-fuser
+    tools/materialize-runsc --build
+    cargo build \
+        --release \
+        --locked \
+        --package lazaret-client \
+        --package lazaret-host-coordinator \
+        --package lazaret-escalation-client \
+        --bins
+    env RUSTFLAGS="-C relocation-model=static -C link-arg=-no-pie" cargo build \
+        --release \
+        --locked \
+        --target x86_64-unknown-linux-musl \
+        --package lazaret-sandbox-init \
+        --bin lazaret-sandbox-init
+    sandbox_init="$CARGO_TARGET_DIR/x86_64-unknown-linux-musl/release/lazaret-sandbox-init"
+    if readelf -l "$sandbox_init" | grep -q 'Requesting program interpreter' ||
+        ! readelf -d "$sandbox_init" 2>&1 | grep -q 'There is no dynamic section'; then
+        fail 'sandbox init is dynamically linked'
+    fi
+    exit 0
+elif [[ $# -ne 0 ]]; then
+    printf '%s\n' 'usage: tools/build' >&2
+    exit 2
+fi
+
+for command in nerdctl sha256sum; do
+    command -v "$command" >/dev/null 2>&1 || fail "$command is required"
+done
+
+mkdir -p "$root/.lazaret"
+containerfile_digest="$(sha256sum "$containerfile")"
+containerfile_digest="${containerfile_digest%% *}"
+image="localhost/lazaret-builder:${containerfile_digest:0:16}"
+proxy_options=()
+for variable in ALL_PROXY HTTP_PROXY HTTPS_PROXY NO_PROXY all_proxy http_proxy https_proxy no_proxy; do
+    if [[ -v $variable ]]; then
+        proxy_options+=(--env "$variable")
+    fi
+done
+nerdctl build --tag "$image" --file "$containerfile" "$root/tools/container"
+nerdctl run --rm \
+    --mount "type=bind,src=$root,dst=/workspace,ro" \
+    --mount "type=bind,src=$root/.lazaret,dst=/workspace/.lazaret" \
+    --workdir /workspace \
+    --env CARGO_HOME=/workspace/.lazaret/cache/cargo \
+    --env CARGO_TARGET_DIR=/workspace/.lazaret/target \
+    --env GIT_CEILING_DIRECTORIES=/workspace \
+    --env HOME=/workspace/.lazaret/home \
+    --env LAZARET_BUILD_CONTAINER=1 \
+    "${proxy_options[@]}" \
+    "$image" \
+    tools/build --inside-container