Containerize local builds with rootless nerdctl

tools/materialize-runsc

@@ -42,7 +42,7 @@ fail() {
     exit 1
 }
 
-for command in curl make patch sha256sum tar; do
+for command in curl patch sha256sum tar; do
     command -v "$command" >/dev/null 2>&1 || fail "$command is required"
 done
 
@@ -92,14 +92,39 @@ elif [[ "$(tr -d '\n' <"$source/.lazaret-materialization")" != "$stamp" ]]; then
     fail 'materialized source identity mismatch'
 fi
 
+if [[ "$mode" != source ]]; then
+    [[ "${LAZARET_BUILD_CONTAINER:-}" == 1 ]] || fail 'build and test modes require tools/build'
+    command -v bazel >/dev/null 2>&1 || fail 'bazel is required'
+    [[ "$(bazel --version)" == "bazel $bazel_version" ]] || fail 'Bazel version mismatch'
+fi
 if [[ "$mode" == test ]]; then
-    make -C "$source" test \
-        TARGETS='//pkg/sentry/fsimpl/gofer:gofer_test //runsc/fsgofer:lisafs_test //test/syscalls:socket_ip_tcp_generic_loopback_test_native //test/syscalls:socket_ip_tcp_generic_loopback_test_runsc_systrap_hostnet'
-    make -C "$source" test OPTIONS='--test_filter=TestProcessStateIsTerminal' \
-        TARGETS=//runsc/container:container_test
+    (
+        cd "$source"
+        bazel test \
+            --color=no \
+            --curses=no \
+            --incompatible_sandbox_hermetic_tmp=false \
+            --keep_going \
+            --strip=never \
+            --test_output=errors \
+            --verbose_failures=true \
+            //pkg/sentry/fsimpl/gofer:gofer_test \
+            //runsc/fsgofer:lisafs_test \
+            //test/syscalls:socket_ip_tcp_generic_loopback_test_native \
+            //test/syscalls:socket_ip_tcp_generic_loopback_test_runsc_systrap_hostnet
+        bazel test \
+            --color=no \
+            --curses=no \
+            --incompatible_sandbox_hermetic_tmp=false \
+            --strip=never \
+            --test_filter=TestProcessStateIsTerminal \
+            --test_output=errors \
+            --verbose_failures=true \
+            //runsc/container:container_test
+    )
 fi
 if [[ "$mode" != source ]]; then
-    make -C "$source" build TARGETS=//runsc:runsc
+    (cd "$source" && bazel build --color=no --curses=no //runsc:runsc)
     built="$source/bazel-bin/runsc/runsc_/runsc"
     [[ -x "$built" ]] || fail 'canonical build did not produce runsc'
     version_output="$($built --version 2>&1)"