Bake full-stack toolchain into the web template's Docker image

templates/web (Coder's "Web Applications" profile) previously just pulled
codercom/enterprise-base:ubuntu and installed Bun at workspace start. Add a
Dockerfile that builds a complete dev image: build-essential/clang/llvm,
Tauri 2 / WebKit GUI prerequisites, Postgres/Redis/SQLite CLI clients,
protobuf-compiler, Python 3 + OpenCV/ONNX/CPU-torch, Node LTS + Bun/pnpm/
yarn, and a full Rust toolchain via rustup (rustfmt/clippy/rust-analyzer/
rust-src, musl+gnu x86_64/aarch64 targets, cargo-watch/cargo-edit/cross/
bacon) under a passwordless-sudo `coder` user.

main.tf now builds this Dockerfile via the docker provider's `docker_image`
resource (context = the template's own directory, tag keyed on the
Dockerfile's hash) instead of pulling the generic base image, and drops the
now-redundant standalone Bun-install coder_script since Bun ships baked into
the image and lands in the persistent home volume via Docker's normal
empty-volume-populated-from-image behavior. Also add rust-analyzer and Tauri
extensions to profile.code-profile, which was otherwise all web/Vue tooling
with nothing for the new Rust/Tauri side of the stack.

templates/web/main.tf

@@ -50,11 +50,18 @@ resource "coder_agent" "main" {
   # workspace. Note that they take precedence over configuration defined in ~/.gitconfig!
   # You can remove this block if you'd prefer to configure Git manually or using
   # dotfiles. (see docs/dotfiles.md)
+  #
+  # RUST_BACKTRACE/PNPM_HOME/BUN_INSTALL are also baked in as image ENV (see
+  # Dockerfile) so every process picks them up; restated here so they surface
+  # on the workspace dashboard too.
   env = {
     GIT_AUTHOR_NAME     = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
     GIT_AUTHOR_EMAIL    = "${data.coder_workspace_owner.me.email}"
     GIT_COMMITTER_NAME  = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
     GIT_COMMITTER_EMAIL = "${data.coder_workspace_owner.me.email}"
+    RUST_BACKTRACE      = "1"
+    PNPM_HOME           = "/home/coder/.local/share/pnpm"
+    BUN_INSTALL         = "/home/coder/.bun"
   }
 
   # The following metadata blocks are optional. They are used to display
@@ -179,9 +186,22 @@ resource "docker_volume" "home_volume" {
   }
 }
 
+# Builds the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
+# Python CV/ONNX, DB clients - see ./Dockerfile) from this template's own
+# directory, so no external registry push is required. The tag embeds the
+# Dockerfile's hash so a Dockerfile edit forces a rebuild on next apply/push,
+# while an unchanged Dockerfile reuses the cached image.
+resource "docker_image" "web" {
+  name = "coder-profiles-web:${filesha1("${path.module}/Dockerfile")}"
+  build {
+    context = path.module
+  }
+  keep_locally = true
+}
+
 resource "docker_container" "workspace" {
   count = data.coder_workspace.me.start_count
-  image = "codercom/enterprise-base:ubuntu"
+  image = docker_image.web.image_id
   # Uses lower() to avoid Docker restriction on container names.
   name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
   # Hostname makes the shell more user friendly: coder@my-workspace:~$
@@ -268,33 +288,14 @@ resource "coder_script" "cli_setup_wizard" {
   EOT
 }
 
-# Installs Bun and uses it (instead of npm) for the CLI installs the wizard
-# script runs. The installer doesn't reliably add ~/.bun/bin to PATH in
-# non-interactive shells, so that's hooked into .bashrc explicitly here.
-resource "coder_script" "install_bun" {
-  agent_id     = coder_agent.main.id
-  display_name = "Install Bun"
-  run_on_start = true
-  script       = <<-EOT
-    #!/bin/bash
-    set -e
-    export BUN_INSTALL="$HOME/.bun"
-    if [ ! -x "$BUN_INSTALL/bin/bun" ]; then
-      curl -fsSL https://bun.sh/install | bash
-    fi
-
-    MARKER="# >>> coder bun path >>>"
-    if ! grep -qF "$MARKER" "$HOME/.bashrc" 2>/dev/null; then
-      {
-        echo ""
-        echo "$MARKER"
-        echo 'export BUN_INSTALL="$HOME/.bun"'
-        echo 'export PATH="$BUN_INSTALL/bin:$PATH"'
-        echo "# <<< coder bun path <<<"
-      } >> "$HOME/.bashrc"
-    fi
-  EOT
-}
+# Bun (and the rest of the toolchain - Rust, Node/pnpm/yarn, Python CV/ONNX
+# packages, DB clients) is baked into the workspace image at build time (see
+# Dockerfile) rather than installed here on every start. Docker populates a
+# fresh, empty named volume from the image's directory contents on first
+# mount, so $HOME/.bun, $HOME/.cargo, $HOME/.rustup etc. land in the
+# persistent home_volume automatically the first time a workspace boots -
+# same mechanism the /etc/skel copy above relies on. BUN_INSTALL and PATH
+# are set as image ENV plus restated on coder_agent.env above.
 
 # Installs this repo's Agent Skills into Claude Code, GitHub Copilot CLI, and
 # Antigravity CLI's skills directories. See ./install-skills.sh.