From 677875fd034e25906ec95c82a7ccc27ba04cf589 Mon Sep 17 00:00:00 2001
From: krishicks <khicks@nvidia.com>
Date: Wed, 28 Oct 2026 22:58:59 +0000
Subject: [PATCH] fix(build): restore Windows lint and trim the image build
 context (#5021)

* fix(windows): restore Windows lint on main

The Windows-only host proxy passed 18 arguments to
ProxyHandle::start_with_bind_addr after #4276 added reserved_destination.
It hosts no OTLP relay, so it passes None.

The network supervisor trust artifact helpers only act on Unix, so
Clippy flags their Result as unnecessary on Windows; allow it there, as
other cfg-dependent helpers do.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

* build(docker): exclude nested build outputs from the image build context

.dockerignore excluded only the top-level target directory, so image
builds from the repository root also sent nested Cargo target
directories (e2e/rust, tests, examples), node_modules, and the .jj
store as context: about 15 GB in a local checkout, which a remote
Podman machine copies on every build. Exclude target and node_modules
at any depth, and .jj. The images copy only prebuilt binaries from
deploy/docker/.build.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

---------

Signed-off-by: Kris Hicks <khicks@nvidia.com>
---
 .dockerignore                                   | 8 ++++++--
 crates/openshell-server/src/network_trust.rs    | 3 +++
 crates/openshell-supervisor-network/src/host.rs | 1 +
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 192b57b6c..620739dbc 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,9 +1,10 @@
-# Git
+# Version control
 .git
 .gitignore
+.jj
 
 # Rust build artifacts (use BuildKit cache mounts instead)
-target
+**/target
 
 # Python
 __pycache__
@@ -37,3 +38,6 @@ kubeconfig
 *.log
 *.tmp
 .DS_Store
+
+# Node
+**/node_modules
diff --git a/crates/openshell-server/src/network_trust.rs b/crates/openshell-server/src/network_trust.rs
index 9b6aa2cdc..90e42be59 100644
--- a/crates/openshell-server/src/network_trust.rs
+++ b/crates/openshell-server/src/network_trust.rs
@@ -413,6 +413,7 @@ fn verify_existing_artifact(path: &Path, normalized: &[u8], digest: &str) -> Res
         })
 }
 
+#[cfg_attr(not(unix), allow(clippy::unnecessary_wraps))]
 fn set_artifact_directory_permissions(path: &Path) -> Result<()> {
     #[cfg(unix)]
     {
@@ -429,6 +430,7 @@ fn set_artifact_directory_permissions(path: &Path) -> Result<()> {
     Ok(())
 }
 
+#[cfg_attr(not(unix), allow(clippy::unnecessary_wraps))]
 fn set_artifact_file_permissions(file: &fs::File, path: &Path) -> Result<()> {
     #[cfg(unix)]
     {
@@ -449,6 +451,7 @@ fn set_artifact_file_permissions(file: &fs::File, path: &Path) -> Result<()> {
 /// Durably record a successful hard-link publication on platforms that permit
 /// syncing directories. This follows the same `File::open(...).sync_all()`
 /// pattern used for other atomic state writes in the repository.
+#[cfg_attr(not(unix), allow(clippy::unnecessary_wraps))]
 fn sync_artifact_directory(path: &Path) -> Result<()> {
     #[cfg(unix)]
     {
diff --git a/crates/openshell-supervisor-network/src/host.rs b/crates/openshell-supervisor-network/src/host.rs
index 45b21127c..b5ada8b10 100644
--- a/crates/openshell-supervisor-network/src/host.rs
+++ b/crates/openshell-supervisor-network/src/host.rs
@@ -224,6 +224,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result<HostProxyHandle
         None,
         Some(direct_listener_identity),
         None,
+        None,
     )
     .await?;