Containerize local builds with rootless nerdctl

tools/container/Containerfile

@@ -0,0 +1,49 @@
+FROM docker.io/library/rust:1.97.0-bookworm@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073
+
+ARG BAZEL_VERSION=8.3.1
+ARG BAZEL_SHA256=17247e8a84245f59d3bc633d0cfe0a840992a7760a11af1a30012d03da31604c
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        binutils \
+        build-essential \
+        busybox-static \
+        ca-certificates \
+        clang \
+        cmake \
+        crossbuild-essential-amd64 \
+        crossbuild-essential-arm64 \
+        curl \
+        diffutils \
+        erofs-utils \
+        git \
+        iproute2 \
+        iptables \
+        kmod \
+        libbpf-dev \
+        libc6-dev-i386 \
+        libffi-dev \
+        libnuma-dev \
+        libssl-dev \
+        musl-tools \
+        netcat-openbsd \
+        openjdk-17-jdk-headless \
+        patch \
+        pkg-config \
+        python-is-python3 \
+        python3 \
+        python3-pip \
+        python3-setuptools \
+        qemu-user-static \
+        unzip \
+        zip \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl --fail --location \
+        "https://releases.bazel.build/${BAZEL_VERSION}/release/bazel-${BAZEL_VERSION}-linux-x86_64" \
+        --output /usr/local/bin/bazel \
+    && printf '%s  %s\n' "$BAZEL_SHA256" /usr/local/bin/bazel | sha256sum --check - \
+    && chmod 0755 /usr/local/bin/bazel \
+    && rustup target add x86_64-unknown-linux-musl \
+    && rustup component add clippy rustfmt
+
+WORKDIR /workspace