Bake full-stack toolchain into the web template's Docker image

templates/web (Coder's "Web Applications" profile) previously just pulled
codercom/enterprise-base:ubuntu and installed Bun at workspace start. Add a
Dockerfile that builds a complete dev image: build-essential/clang/llvm,
Tauri 2 / WebKit GUI prerequisites, Postgres/Redis/SQLite CLI clients,
protobuf-compiler, Python 3 + OpenCV/ONNX/CPU-torch, Node LTS + Bun/pnpm/
yarn, and a full Rust toolchain via rustup (rustfmt/clippy/rust-analyzer/
rust-src, musl+gnu x86_64/aarch64 targets, cargo-watch/cargo-edit/cross/
bacon) under a passwordless-sudo `coder` user.

main.tf now builds this Dockerfile via the docker provider's `docker_image`
resource (context = the template's own directory, tag keyed on the
Dockerfile's hash) instead of pulling the generic base image, and drops the
now-redundant standalone Bun-install coder_script since Bun ships baked into
the image and lands in the persistent home volume via Docker's normal
empty-volume-populated-from-image behavior. Also add rust-analyzer and Tauri
extensions to profile.code-profile, which was otherwise all web/Vue tooling
with nothing for the new Rust/Tauri side of the stack.

README.md

@@ -18,10 +18,34 @@ templates/
   cobol/        (same 4 files)  # COBOL Modern Mainframe
   python/       (same 4 files)  # Python Engineering
   ttrpg/        (same 4 files)  # TTRPG & Lore Building
-  web/          (same 4 files)  # Web Applications
+  web/          (same 4 files, plus Dockerfile)  # Web Applications
 extensions/                 # Agent Skills bundles, installed per env (see below)
 ```
 
+### Web Applications: baked-in toolchain image
+
+Every other template pulls `codercom/enterprise-base:ubuntu` straight from
+Docker Hub and installs what little it needs (just Bun) via a `coder_script`
+at workspace start. `templates/web/` doesn't do that: it needs a large,
+slow-to-install native toolchain (Rust/rustup with cross targets, the Tauri 2
+/ WebKit GUI dev libraries, Node + Bun + pnpm/yarn, Python with OpenCV/ONNX/
+CPU-torch, Postgres/Redis/SQLite CLI clients, protoc, clang/llvm) that would
+make every workspace start take many minutes if installed on the fly.
+
+Instead `templates/web/main.tf` builds `templates/web/Dockerfile` at
+apply/push time via the `docker` provider's `docker_image` resource (`build
+{ context = path.module }`, same directory as `main.tf` so no `file()`
+reaches outside the template per the constraint above) and runs the
+container from that image instead of the enterprise-base one. The image tag
+embeds `filesha1(Dockerfile)`, so editing the Dockerfile forces a rebuild on
+the next apply/push while an unchanged Dockerfile reuses Docker's build
+cache. Because the toolchain lives under `/home/coder` (rustup, cargo, bun),
+and that path is a fresh *named* Docker volume on a workspace's first boot,
+Docker's own "populate an empty volume from the image's directory contents"
+behavior copies all of it into the persistent volume automatically - no
+extra `coder_script` needed, matching how the `/etc/skel` copy in every
+template's `startup_script` already relies on that same mechanism.
+
 Each `templates/<env>/` is a complete, independent Coder template (agent,
 docker container, code-server, JetBrains) with its own copy of everything
 `main.tf` needs. They're deliberately not built from a shared Terraform
@@ -71,12 +95,14 @@ never really worked.
 
 ### Bun
 
-Every template installs [Bun](https://bun.sh) via a `coder_script`
-(`curl -fsSL https://bun.sh/install | bash`) and hooks `~/.bun/bin` onto
-`PATH` in `~/.bashrc` (the installer doesn't reliably do this itself in a
-non-interactive/scripted shell). The CLI setup wizard below uses
-`bun install -g <pkg>` instead of `npm install -g <pkg>` for everything it
-installs.
+Every template except `web` installs [Bun](https://bun.sh) via a
+`coder_script` (`curl -fsSL https://bun.sh/install | bash`) and hooks
+`~/.bun/bin` onto `PATH` in `~/.bashrc` (the installer doesn't reliably do
+this itself in a non-interactive/scripted shell). `web` instead bakes Bun
+into its Dockerfile with `BUN_INSTALL`/`PATH` set as image `ENV` - see "Web
+Applications: baked-in toolchain image" above. Either way, the CLI setup
+wizard below uses `bun install -g <pkg>` instead of `npm install -g <pkg>`
+for everything it installs.
 
 ### CLI setup wizard
 

templates/web/Dockerfile

@@ -0,0 +1,87 @@
+# Web Applications workspace image: Rust (Tauri 2 / gRPC), Bun + Node/pnpm,
+# Python + CV/ONNX prototyping, and DB CLI clients baked in at build time so
+# workspace start doesn't pay for a from-scratch toolchain install.
+#
+# Built by templates/web/main.tf via the docker provider's `build` block
+# (context = this directory), not pulled from a registry.
+FROM ubuntu:24.04
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        locales sudo ca-certificates gnupg curl wget \
+    && locale-gen en_US.UTF-8 \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV LANG=en_US.UTF-8 \
+    LANGUAGE=en_US:en \
+    LC_ALL=en_US.UTF-8
+
+# Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
+# X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential pkg-config cmake clang llvm \
+        git git-lfs jq unzip tar file htop tree tmux zsh openssh-client \
+        libssl-dev libpq-dev libsqlite3-dev \
+        libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev \
+        libgtk-3-dev libsoup-3.0-dev \
+        libx11-dev libxext-dev libxrender-dev libxtst-dev libxi-dev \
+        postgresql-client redis-tools sqlite3 \
+        python3 python3-pip python3-venv python3-dev \
+        libopencv-dev \
+        protobuf-compiler \
+    && git lfs install --system \
+    && rm -rf /var/lib/apt/lists/*
+
+# Node.js LTS (22.x) plus npm/pnpm/yarn as root so global bins land on the
+# system PATH for every user.
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && npm install -g pnpm yarn \
+    && rm -rf /var/lib/apt/lists/*
+
+# Global Python prototyping packages: CV, ONNX runtime, CPU-only torch wheel.
+# Ubuntu 24.04's system Python is PEP 668 externally-managed; this is a
+# throwaway container image, so --break-system-packages is the right call
+# instead of forcing every user into a venv for basic prototyping.
+RUN python3 -m pip install --break-system-packages --no-cache-dir --upgrade pip \
+    && python3 -m pip install --break-system-packages --no-cache-dir \
+        numpy opencv-python-headless onnxruntime \
+    && python3 -m pip install --break-system-packages --no-cache-dir \
+        torch --index-url https://download.pytorch.org/whl/cpu
+
+# Standard non-root dev user with passwordless sudo.
+RUN useradd --uid 1000 --create-home --shell /bin/bash coder \
+    && echo "coder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder \
+    && chmod 0440 /etc/sudoers.d/coder
+
+ENV RUST_BACKTRACE=1 \
+    RUSTUP_HOME=/home/coder/.rustup \
+    CARGO_HOME=/home/coder/.cargo \
+    BUN_INSTALL=/home/coder/.bun \
+    PNPM_HOME=/home/coder/.local/share/pnpm \
+    PATH=/home/coder/.cargo/bin:/home/coder/.bun/bin:/home/coder/.local/share/pnpm:/home/coder/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+USER coder
+WORKDIR /home/coder
+
+# Rust via rustup: stable toolchain, rust-analyzer/clippy/rustfmt/rust-src,
+# native + musl targets for x86_64/aarch64, and cargo helper utilities.
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
+        --default-toolchain stable --profile default \
+    && rustup component add rustfmt clippy rust-analyzer rust-src \
+    && rustup target add \
+        x86_64-unknown-linux-gnu \
+        x86_64-unknown-linux-musl \
+        aarch64-unknown-linux-gnu \
+        aarch64-unknown-linux-musl \
+    && cargo install --locked cargo-watch cargo-edit cross bacon
+
+# Bun: global runtime for the ElysiaJS backend and fast scripting.
+RUN curl -fsSL https://bun.sh/install | bash
+
+# Prime the pnpm content-addressable store dir referenced by PNPM_HOME.
+RUN pnpm setup || true
+
+RUN mkdir -p /home/coder/workspace
+WORKDIR /home/coder/workspace

templates/web/main.tf

@@ -50,11 +50,18 @@ resource "coder_agent" "main" {
   # workspace. Note that they take precedence over configuration defined in ~/.gitconfig!
   # You can remove this block if you'd prefer to configure Git manually or using
   # dotfiles. (see docs/dotfiles.md)
+  #
+  # RUST_BACKTRACE/PNPM_HOME/BUN_INSTALL are also baked in as image ENV (see
+  # Dockerfile) so every process picks them up; restated here so they surface
+  # on the workspace dashboard too.
   env = {
     GIT_AUTHOR_NAME     = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
     GIT_AUTHOR_EMAIL    = "${data.coder_workspace_owner.me.email}"
     GIT_COMMITTER_NAME  = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
     GIT_COMMITTER_EMAIL = "${data.coder_workspace_owner.me.email}"
+    RUST_BACKTRACE      = "1"
+    PNPM_HOME           = "/home/coder/.local/share/pnpm"
+    BUN_INSTALL         = "/home/coder/.bun"
   }
 
   # The following metadata blocks are optional. They are used to display
@@ -179,9 +186,22 @@ resource "docker_volume" "home_volume" {
   }
 }
 
+# Builds the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
+# Python CV/ONNX, DB clients - see ./Dockerfile) from this template's own
+# directory, so no external registry push is required. The tag embeds the
+# Dockerfile's hash so a Dockerfile edit forces a rebuild on next apply/push,
+# while an unchanged Dockerfile reuses the cached image.
+resource "docker_image" "web" {
+  name = "coder-profiles-web:${filesha1("${path.module}/Dockerfile")}"
+  build {
+    context = path.module
+  }
+  keep_locally = true
+}
+
 resource "docker_container" "workspace" {
   count = data.coder_workspace.me.start_count
-  image = "codercom/enterprise-base:ubuntu"
+  image = docker_image.web.image_id
   # Uses lower() to avoid Docker restriction on container names.
   name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
   # Hostname makes the shell more user friendly: coder@my-workspace:~$
@@ -268,33 +288,14 @@ resource "coder_script" "cli_setup_wizard" {
   EOT
 }
 
-# Installs Bun and uses it (instead of npm) for the CLI installs the wizard
-# script runs. The installer doesn't reliably add ~/.bun/bin to PATH in
-# non-interactive shells, so that's hooked into .bashrc explicitly here.
-resource "coder_script" "install_bun" {
-  agent_id     = coder_agent.main.id
-  display_name = "Install Bun"
-  run_on_start = true
-  script       = <<-EOT
-    #!/bin/bash
-    set -e
-    export BUN_INSTALL="$HOME/.bun"
-    if [ ! -x "$BUN_INSTALL/bin/bun" ]; then
-      curl -fsSL https://bun.sh/install | bash
-    fi
-
-    MARKER="# >>> coder bun path >>>"
-    if ! grep -qF "$MARKER" "$HOME/.bashrc" 2>/dev/null; then
-      {
-        echo ""
-        echo "$MARKER"
-        echo 'export BUN_INSTALL="$HOME/.bun"'
-        echo 'export PATH="$BUN_INSTALL/bin:$PATH"'
-        echo "# <<< coder bun path <<<"
-      } >> "$HOME/.bashrc"
-    fi
-  EOT
-}
+# Bun (and the rest of the toolchain - Rust, Node/pnpm/yarn, Python CV/ONNX
+# packages, DB clients) is baked into the workspace image at build time (see
+# Dockerfile) rather than installed here on every start. Docker populates a
+# fresh, empty named volume from the image's directory contents on first
+# mount, so $HOME/.bun, $HOME/.cargo, $HOME/.rustup etc. land in the
+# persistent home_volume automatically the first time a workspace boots -
+# same mechanism the /etc/skel copy above relies on. BUN_INSTALL and PATH
+# are set as image ENV plus restated on coder_agent.env above.
 
 # Installs this repo's Agent Skills into Claude Code, GitHub Copilot CLI, and
 # Antigravity CLI's skills directories. See ./install-skills.sh.