make container builds reproducible

Commit Cargo.lock, copy it into the Docker build stage, and align the Docker Rust base/MSRV with the toolchain required by the locked dependency graph.
2026-05-24 13:53:10 -04:00
parent fe4a127422
commit a171331a7a
4 changed files with 2441 additions and 4 deletions
@@ -14,7 +14,7 @@
 # Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
 # spends most of its life idle.

-ARG RUST_VERSION=1.82
+ARG RUST_VERSION=1.95

 ########## fetch iPXE binaries ##########
 FROM debian:12-slim AS fetch
@@ -38,7 +38,7 @@ WORKDIR /src
 # selected by the base image. Copying rust-toolchain.toml with
 # `channel = "stable"` makes rustup download a second full toolchain during
 # `cargo build`, which is slow and can exhaust small Colima/CI disks.
-COPY Cargo.toml ./
+COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe