docker-builder-rust

Docker image for building Rust projects with Cargo.

CI/CD

This project uses Crow CI for automated builds:

• Branch builds: Pushes to the default branch trigger a build tagged as latest
• Version builds: Creating a tag matching v*.*.* (e.g., v1.2.3) triggers a build tagged with that version

Creating a versioned release

# Create and push a version tag
jj git tag v1.2.3
jj git push --tag v1.2.3

This will automatically build and push the image as git.kemitix.net/kemitix/rust:v1.2.3.

Usage

In a Forgejo action file, e.g. .forgejo/workflows/test.yml:

on:[push]jobs:test:runs-on:dockercontainer:image:git.kemitix.net/kemitix/rust:lateststrategy:matrix:toolchain:- name:stable- name:nightlysteps:- name:Testrun:cargo +${{ matrix.toolchain.name }} test- name:Build (with stable as default)run:cargo build

Toolchains

The available toolchain in the image are:

• nightly
• stable

Contents

• binaryen (wasm-opt)
• nodejs
• deno
• rust
• git
• jujutsu
• cargo
• cargo-binstall
• cargo-chef
• cargo-hack
• cargo-machete
• cargo-nextest
• cargo-readme
• forgejo-todo-checker
• just
• wasm-pack
• dbus-dev
• perl

Rustup Targets

• wasm32-unknown-unknown (stable and nightly)

Scripts

• check-for-ignored
• check-commit-time

check-for-ignored

Checks for files that are being tracked by Git but should be ignored according to the .gitignore file.

steps:- name:Check for Ignored Filesrun:check-for-ignored

check-commit-time

Validates commit timestamps against configurable blocked time windows. Useful for enforcing work-hour policies in CI.

Environment Variables:

• BLOCKED_TIME_WINDOWS - Comma-separated time ranges (e.g., 08:00-12:00,13:00-16:00)
• BLOCKED_DAYS - Comma-separated days using three-letter abbreviations (e.g., Mon,Tue,Wed,Thu,Fri)
• BLOCKED_TIMEZONE - Timezone for evaluation (default: UTC)

Exit Codes:

• 0 - Commit allowed (no config or outside blocked windows)
• 1 - Commit blocked (falls within blocked window)

steps:- name:Check Commit Timeenv:BLOCKED_TIME_WINDOWS:"08:00-12:00,13:00-16:00"BLOCKED_DAYS:"Mon,Tue,Wed,Thu,Fri"BLOCKED_TIMEZONE:"America/New_York"run:check-commit-time

If BLOCKED_TIME_WINDOWS is not set, all commits are allowed. If BLOCKED_DAYS is not set, all days are checked against the time windows.

Limitation: Time windows must not span midnight (e.g., 22:00-06:00 is not supported). Use separate windows instead: 22:00-23:59,00:00-06:00.

Caveats

openssl

The alpine linux install doesn't build with this dependency. You can either compile native-tls with the vendored feature, or not use openssl.

If possible, use rustls instead.

vendoered native-tls

This crate must use the vendored feature in order to compile in the Alpine Linux image.

native-tls = { version = "0.2", features = ["vendored"] }

Don't use openssl

Check that none of your dependencies require openssl:

cargo tree --edges normal -i openssl

This will list the tree of dependencies that are bringing in openssl.

If you do need ssl/tls, try using rustls. e.g.

reqwest = { version = "0.12", default-features = false, features = [
 "json",
 "rustls-tls",
] }