pkg-test-isolation: verify builds succeed with no external network #164

New Issue

kert · 2026-03-24T03:54:38Z

kert commented

2026-03-24 03:54:38 +00:00

Goal

A test that builds all Dockerfiles with --network=none (or equivalent) to prove that no build step reaches the internet — all packages come from local mirrors.

Scope

Test script: dev/scripts/test_network_isolation.sh
Builds each Dockerfile with Docker --network=none after mirrors are configured
Verifies all apt-get, apk, uv pip install, pnpm install succeed offline
For CI tools installed via curl (crane, trivy, uv), verify they are pre-cached or vendored
Runs as a CI pipeline step

Acceptance

All Dockerfile builds pass with no external network
Test fails loudly if any step tries to reach the internet
Integrated into CI as a gate (build fails if isolation breaks)

## Goal A test that builds all Dockerfiles with `--network=none` (or equivalent) to prove that no build step reaches the internet — all packages come from local mirrors. ## Scope - Test script: `dev/scripts/test_network_isolation.sh` - Builds each Dockerfile with Docker `--network=none` after mirrors are configured - Verifies all `apt-get`, `apk`, `uv pip install`, `pnpm install` succeed offline - For CI tools installed via curl (crane, trivy, uv), verify they are pre-cached or vendored - Runs as a CI pipeline step ## Acceptance - [ ] All Dockerfile builds pass with no external network - [ ] Test fails loudly if any step tries to reach the internet - [ ] Integrated into CI as a gate (build fails if isolation breaks)

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-03-24 03:54:38 +00:00

kert added the quality ci labels 2026-03-24 03:54:38 +00:00

kert referenced this issue

2026-03-24 03:59:01 +00:00

feat: package supply chain — inventory, mirrors, drift, vuln scanning #169

kert referenced this issue from a commit

2026-03-24 04:03:55 +00:00

add package mirrors, auto-issue scripts, network isolation test, CI workflow

kert referenced this issue from a commit

2026-03-24 04:32:26 +00:00

replace devpi/apt-cacher-ng with Gitea package registry

kert closed this issue