From eecca0954451ef13076006218ab94b1b88ae6703 Mon Sep 17 00:00:00 2001
From: Ivan Avdeev <me@provod.works>
Date: Tue, 7 Apr 2026 17:51:32 -0400
Subject: [PATCH] add initial hermetic container build-and-test support

---
 container/Containerfile     | 56 +++++++++++++++++++++++++++++++++++++
 container/build-and-test.sh | 26 +++++++++++++++++
 container/env.example       |  9 ++++++
 container/run.sh            | 46 ++++++++++++++++++++++++++++++
 4 files changed, 137 insertions(+)
 create mode 100644 container/Containerfile
 create mode 100755 container/build-and-test.sh
 create mode 100644 container/env.example
 create mode 100755 container/run.sh

diff --git a/container/Containerfile b/container/Containerfile
new file mode 100644
index 0000000..ce187e1
--- /dev/null
+++ b/container/Containerfile
@@ -0,0 +1,56 @@
+FROM ubuntu:24.04
+
+# Avoid interactive prompts during package installation
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Set working directory
+WORKDIR /build
+
+# Install system dependencies and development packages
+RUN apt-get update && apt-get install --no-install-recommends --no-install-suggests -y \
+    wget \
+    build-essential \
+    libsdl2-dev \
+    libfreetype-dev \
+    \
+    # FFmpeg development packages
+    libavcodec-dev \
+    libavformat-dev \
+    libavutil-dev \
+    libavfilter-dev \
+    libavdevice-dev \
+    libswscale-dev \
+    libswresample-dev \
+    libpostproc-dev \
+    ffmpeg \
+    \
+    # Utilities
+    pkg-config \
+    python3 \
+    python3-pip \
+    \
+    # Running render tests
+    weston \
+    libgl1-mesa-dri \
+    mesa-vulkan-drivers \
+    libvulkan1 \
+    imagemagick
+
+RUN wget -qO- https://packages.lunarg.com/lunarg-signing-key-pub.asc | tee /etc/apt/trusted.gpg.d/lunarg.asc \
+	&& wget -qO /etc/apt/sources.list.d/lunarg-vulkan-noble.list http://packages.lunarg.com/vulkan/lunarg-vulkan-noble.list \
+	&& apt update \
+	&& apt install --no-install-recommends --no-install-suggests -y vulkan-sdk
+
+# Remove extra cache after all the installations
+RUN rm -rf /var/lib/apt/lists/*
+
+RUN chown -R ubuntu:ubuntu /build
+
+COPY build-and-test.sh /build/
+
+# Switch to non-root user
+USER ubuntu
+
+# Default command
+WORKDIR /build
+CMD ["/build/build-and-test.sh"]
diff --git a/container/build-and-test.sh b/container/build-and-test.sh
new file mode 100755
index 0000000..40933e3
--- /dev/null
+++ b/container/build-and-test.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+#set -eux
+set -ux
+
+XDG_RUNTIME_DIR=/tmp weston \
+	--backend=headless \
+	--renderer=gl \
+	--width=1280 \
+	--height=800 \
+	--socket=wayland-headless &
+
+build() {
+	pushd /build/xash3d-fwgs
+	./waf configure -T release -o /build/obj -8
+	./waf install --destdir=/build/out
+	popd
+}
+
+rendertest() {
+	pushd /build/HLRTest/render
+	WAYLAND_DISPLAY=/tmp/wayland-headless ./rendertest.py --xash-dir /build/out run
+	popd
+}
+
+time build
+time rendertest
diff --git a/container/env.example b/container/env.example
new file mode 100644
index 0000000..ac5939b
--- /dev/null
+++ b/container/env.example
@@ -0,0 +1,9 @@
+# Path to Steam Half-Life data, where ./valve and ./valve_hd dirs are located (readonly)
+# Must already contain build https://github.com/FWGS/hlsdk-portable libs in `dlls` and `cl_dlls/`
+STEAM_HALFLIFE_DIR=${HOME}/opt/Half-Life
+
+# Path to https://rtxash.omgwtf.ru/Half-Life-RTX/Half-Life-PBR repo clone (readonly)
+HALFLIFE_PBR_REPO_DIR=${HOME}/src/Half-Life-PBR
+
+# Path to https://github.com/w23/xash3d-fwgs/ clone (readonly)
+XASH3D_RT_REPO_DIR=${HOME}/src/xash3d-fwgs
diff --git a/container/run.sh b/container/run.sh
new file mode 100755
index 0000000..976555c
--- /dev/null
+++ b/container/run.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+set -eux
+
+NAME=xash-builder
+
+HLRTEST_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd)"
+
+source .env
+
+build-image() {
+	podman build -t ubuntu-xash-builder .
+}
+
+run() {
+	podman run -it --rm \
+		--name ${NAME} \
+		--userns=keep-id \
+		--user $(id -u):$(id -g) \
+		\
+		--cap-drop=ALL \
+		--security-opt=no-new-privileges \
+		--read-only \
+		--tmpfs /tmp \
+		--tmpfs /build/obj \
+		--tmpfs /build/out \
+		\
+		-v /dev/dri/renderD128:/dev/dri/renderD128:ro \
+		\
+		-v ${STEAM_HALFLIFE_DIR}/valve:/build/out/valve:O \
+		-v ${STEAM_HALFLIFE_DIR}/valve_hd:/build/out/valve_hd:ro \
+		-v ${HALFLIFE_PBR_REPO_DIR}/valve/pbr:/build/out/valve/pbr:ro \
+		\
+		-v ${XASH3D_RT_REPO_DIR}:/build/xash3d-fwgs:O \
+		\
+		-v ${HLRTEST_PATH}:/build/HLRTest:ro \
+		-v ${HLRTEST_PATH}/render/work:/build/HLRTest/render/work \
+		\
+		ubuntu-xash-builder:latest \
+		"$@"
+}
+
+shell() {
+	podman exec -it ${NAME} /bin/bash
+}
+
+time "$@"