Container image and the in-container Gate #55

Parent

Spec: #33 (Baseline release). Section numbers refer to its Implementation Decisions.

What to build

docker build from the repository yields the wand image with the tested Target Chrome inside on both linux/amd64 and linux/arm64, the :dev variant runs wand's own suite in a container, and a Gate builds both and runs the suite inside them on every push. Spec section 14; ADR-0005; ticket #20, #31.

Acceptance criteria

• The runtime Dockerfile: ubuntu:noble pinned by digest, upstream's runtime dependencies, fonts, tzdata, dumb-init, xvfb; the manager built from cmd/wand-manager as entrypoint; the Target Chrome pre-fetched by cmd/wand-fetch-browser at build time; identical version on both architectures.
• The dev Dockerfile: Go and Node copied from golang:<stable> and node:<lts> pinned by digest; the full suite runs inside with InContainer mapping to --no-sandbox.
• Image job: both images built natively on ubuntu-latest and ubuntu-24.04-arm; the full suite runs in the :dev container on both; Trivy with --ignore-unfixed fails on a fixable CRITICAL; the zero-leftover step; nothing pushed; required on main.
• The image build script under the tools directory builds locally; the README gains a section on building and running the image.

Blocked by

• Package layout: internal/, cmd/, tools and docker/ #35 (Package layout: internal/, cmd/, tools and docker/)
• Managed-browser download on fetch: Target Chrome and Companion Chromium #44 (Managed-browser download on fetch: Target Chrome and Companion Chromium)
• Test harness: browser resolution in TestMain, WAND_BROWSER_* selection, no flaky skips #53 (Test harness: browser resolution in TestMain, WAND_BROWSER_* selection, no flaky skips)