docker: Add rust-sdk memcheck target.

docker: Separate and tweak cargo cache paths. ci: Improve memcheck job targets. cargo: Add missing debug syms to bench profile. docker: Optimize layer copying. Signed-off-by: Jason Volk <jason@zemos.net>
2025-10-27 17:49:29 +00:00
parent 51681aec1b
commit a3f6971579
14 changed files with 163 additions and 137 deletions
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -20,13 +20,13 @@ jobs:
    name: Init
    runs-on: ${{matrix.runner}}
    env:
-      default_cargo_profiles: '["test", "release"]'
+      default_cargo_profiles: '["test", "bench", "release"]'
      default_feat_sets: '["none", "default", "all"]'
      default_rust_toolchains: '["nightly", "stable"]'
      default_sys_names: '["debian"]'
      default_sys_versions: '["testing-slim"]'
      default_rust_targets: '["x86_64-unknown-linux-gnu"]'
-      default_sys_targets: '["x86_64-v1-linux-gnu"]'
+      default_sys_targets: '["x86_64-v1-linux-gnu", "x86_64-v3-linux-gnu"]'
      default_machines: '["X64"]'

    outputs:
@@ -38,17 +38,17 @@ jobs:
      sys_targets: ${{vars.SYS_TARGETS || env.default_sys_targets}}
      sys_versions: ${{vars.SYS_VERSIONS || env.default_sys_versions}}
      machines: ${{vars.MACHINES || env.default_machines}}
-      package: ${{vars.PACKAGE || !contains(github.ref, 'refs/pull/')}}
-      publish: ${{vars.PUBLISH || !contains(github.ref, 'refs/pull/')}}
-      build_nix: ${{vars.BUILD_NIX || !contains(github.ref, 'refs/pull/')}}
-      build_pkgs: ${{vars.BUILD_PKGS || github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v')}}
+      package: ${{vars.PACKAGE != 'false'}}
+      publish: ${{vars.PUBLISH != 'false'}}
+      build_nix: ${{vars.BUILD_NIX != 'false'}}
+      build_pkgs: ${{vars.BUILD_PKGS || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/test' || contains(github.ref, 'tags/v')}}
      check_pkgs: ${{vars.CHECK_PKGS || 'false'}}
-      complement: ${{vars.COMPLEMENT || 'true'}}
+      complement: ${{vars.COMPLEMENT != 'false'}}
      complement_runner: 'het'
      docker_repo: ${{vars.DOCKER_REPO}}
      release_url: ${{steps.release.outputs.upload_url}}
      pages_url: 'https://matrix-construct.github.io/tuwunel/'
-      rust_sdk_integration: ${{vars.RUST_SDK_INTEGRATION || 'true'}}
+      rust_sdk_integ: ${{vars.RUST_SDK_INTEGRATION != 'false'}}
      head_msg: ${{github.event.head_commit.message || github.event.workflow_run.head_commit.message}}

    strategy:
@@ -176,7 +176,7 @@ jobs:
    with:
      head_msg: ${{needs.init.outputs.head_msg}}
      build_nix: ${{fromJSON(needs.init.outputs.build_nix)}}
-      rust_sdk_integration: ${{fromJSON(needs.init.outputs.rust_sdk_integration)}}
+      rust_sdk_integ: ${{fromJSON(needs.init.outputs.rust_sdk_integ)}}
      complement: ${{fromJSON(needs.init.outputs.complement)}}
      complement_runner: ${{needs.init.outputs.complement_runner}}
      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
@@ -222,6 +222,7 @@ jobs:
    if: >
      !failure() && !cancelled()
      && needs.init.outputs.package
+      && !contains(github.ref, 'refs/pull')
      && !contains(needs.init.outputs.head_msg, '[ci only it]')
      && !contains(needs.init.outputs.head_msg, '[ci no build]')
      && !contains(needs.init.outputs.head_msg, '[ci no package]')
@@ -285,6 +286,7 @@ jobs:
    if: >
      !failure() && !cancelled()
      && needs.init.outputs.publish
+      && !contains(github.ref, 'refs/pull')
      && !contains(needs.init.outputs.head_msg, '[ci only it]')
      && !contains(needs.init.outputs.head_msg, '[ci no build]')
      && !contains(needs.init.outputs.head_msg, '[ci no package]')
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -40,7 +40,7 @@ on:
        default: true
      complement_runner:
        type: string
-      rust_sdk_integration:
+      rust_sdk_integ:
        type: boolean
        default: true
      build_nix:
@@ -81,10 +81,10 @@ jobs:
      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])

-    name: Unit
+    name: Module
    uses: ./.github/workflows/bake.yml
    with:
-      bake_targets: '["unit", "integration"]'
+      bake_targets: '["unit", "integ"]'
      cargo_profiles: '["test"]'
      feat_sets: '["all"]'
      rust_toolchains: ${{inputs.rust_toolchains}}
@@ -107,7 +107,7 @@ jobs:
    name: Bench
    uses: ./.github/workflows/bake.yml
    with:
-      bake_targets: '["unit", "integration"]'
+      bake_targets: '["unit", "integ"]'
      cargo_profiles: '["bench"]'
      feat_sets: '["all"]'
      rust_toolchains: '["nightly"]'
@@ -119,7 +119,7 @@ jobs:
      excludes: ${{inputs.excludes}}
      includes: ${{inputs.includes}}

-  valgrind:
+  memcheck:
    if: >
      !contains(inputs.head_msg, '[ci only it]')
      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["bench"]')[0])
@@ -130,8 +130,9 @@ jobs:
    name: Memcheck
    uses: ./.github/workflows/bake.yml
    with:
-      bake_targets: '["integration-valgrind"]'
-      cargo_profiles: '["bench"]'
+      #bake_targets: '["unit-valgrind", "integ-valgrind"]'
+      bake_targets: '["integ-valgrind"]'
+      cargo_profiles: '["bench"]' # use bench not release for debug syms
      feat_sets: '["all"]'
      rust_toolchains: '["nightly"]'
      sys_names: ${{inputs.sys_names}}
@@ -139,8 +140,8 @@ jobs:
      rust_targets: ${{inputs.rust_targets}}
      sys_targets: '["x86_64-v3-linux-gnu"]'
      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
      includes: ${{inputs.includes}}
+      excludes: ${{inputs.excludes}}

  smoke:
    if: >
@@ -222,6 +223,7 @@ jobs:
      !failure() && !cancelled()
      && !contains(inputs.head_msg, '[ci only it]')
      && !contains(inputs.head_msg, '[ci no build]')
+      && !contains(github.ref, 'refs/pull')
      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
@@ -243,45 +245,56 @@ jobs:
      excludes: ${{inputs.excludes}}
      includes: ${{inputs.includes}}

-  matrix-rust-sdk-integration:
+  rust-sdk-integ:
    if: >
      !failure() && !cancelled()
      && !contains(inputs.head_msg, '[ci no build]')
-      && inputs.rust_sdk_integration
+      && inputs.rust_sdk_integ
      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
      && contains(fromJSON(inputs.rust_targets), fromJSON('["x86_64-unknown-linux-gnu"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])

    name: Matrix SDK Integration
    needs: [smoke]
    uses: ./.github/workflows/bake.yml
    with:
-      bake_targets: '["matrix-rust-sdk-integration"]'
+      #bake_targets: '["rust-sdk-integ", "rust-sdk-valgrind"]'
+      bake_targets: '["rust-sdk-integ"]'
      cargo_profiles: ${{inputs.cargo_profiles}}
      feat_sets: '["all"]'
      rust_toolchains: '["nightly"]'
      sys_names: ${{inputs.sys_names}}
      sys_versions: ${{inputs.sys_versions}}
      rust_targets: '["x86_64-unknown-linux-gnu"]'
-      sys_targets: '["x86_64-v1-linux-gnu"]'
+      sys_targets: ${{inputs.sys_targets}}
      machines: '["X64"]'
      runner: ${{inputs.complement_runner}}
      includes: ${{inputs.includes}}
      artifact: >
        {
-          "matrix-rust-sdk-integration": {
+          "rust-sdk-integ": {
            "src": "/var/log/tuwunel.log",
-            "dst": "matrix-rust-sdk-integration.tuwunel.log",
+            "dst": "rust-sdk-integ.tuwunel.log",
+          },
+          "rust-sdk-valgrind": {
+            "src": "/var/log/tuwunel.log",
+            "dst": "rust-sdk-valgrind.tuwunel.log",
          }
        }
      excludes: >
        [
+          {"bake_target": "rust-sdk-valgrind", "cargo_profile": "test"},
          {"feat_set": "none"},
          {"feat_set": "logging"},
          {"cargo_profile": "release"},
          {"cargo_profile": "release-debuginfo"},
          {"cargo_profile": "release-native"},
+          {"cargo_profile": "test", "sys_target": "x86_64-v2-linux-gnu"},
+          {"cargo_profile": "test", "sys_target": "x86_64-v3-linux-gnu"},
+          {"cargo_profile": "bench", "sys_target": "x86_64-v1-linux-gnu"},
+          {"cargo_profile": "bench", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu"},
        ]

  complement:
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -704,8 +704,8 @@ inherits = "release-native.build-override"
 #]

 [profile.bench]
-debug = false
-strip = false
+debug = "limited"
+strip = "none"
 #rustflags = [
 #	"-Cremark=all",
 #	'-Ztime-passes',
--- a/docker/Dockerfile.cargo
+++ b/docker/Dockerfile.cargo
@@ -12,6 +12,7 @@ ARG CARGO_TARGET_DIR
 ARG cargo_target_profile
 ARG cargo_target_artifact
 ARG cargo_target_share
+ARG cargo_share
 ARG CARGO_TERM_VERBOSE=0
 ARG RUST_BACKTRACE
 ARG JEMALLOC_OVERRIDE
@@ -33,6 +34,8 @@ ARG color_args="--color always"
 ARG recipe_args=""
 ARG cargo_args=""
 ARG git_checkout
+ARG targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
+ARG targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"

 WORKDIR /
 COPY --link --from=input . .
@@ -43,6 +46,7 @@ WORKDIR /usr/lib/${sys_triple}
 COPY --link --from=rocksdb . .

 WORKDIR /usr/src/tuwunel
+SHELL ["/bin/bash", "-c"]
 ENV PATH="${CARGO_HOME}/bin:$PATH"
 ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
 ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
@@ -58,17 +62,15 @@ ENV CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG="${CARGO_PROFILE_RELEASE_DEBUGINFO_DEB
 ENV CARGO_PROFILE_RELEASE_DEBUGINFO_LTO="${CARGO_PROFILE_RELEASE_DEBUGINFO_LTO}"
 ENV CARGO_BUILD_RUSTFLAGS="${CARGO_BUILD_RUSTFLAGS}"
 ENV CARGO_TARGET_DIR="${CARGO_TARGET_DIR}"
-ENV targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
-ENV targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
 RUN \
 --mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
 --mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
 --mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
--mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
--mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
--mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
--mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/deps,id=${cargo_share}/deps,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/build,id=${cargo_share}/build,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/examples,id=${cargo_share}/examples,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_share}/incremental,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_share}/fingerprint,sharing=locked \
 --mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
 --mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
 --mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
@@ -77,7 +79,8 @@ RUN \
 <<EOF
    set -eux
    ulimit -n 65535
-    rustup run ${rust_toolchain} \
+
+    rustup run "${rust_toolchain}" \
        cargo ${cargo_cmd} \
            --verbose \
            --locked \
--- a/docker/Dockerfile.cargo.deb
+++ b/docker/Dockerfile.cargo.deb
@@ -10,9 +10,12 @@ ARG CARGO_TARGET_DIR
 ARG cargo_target_profile
 ARG cargo_target_artifact
 ARG cargo_target_share
+ARG cargo_share
 ARG cargo_profile
 ARG cargo_features
 ARG cargo_spec_features
+ARG targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
+ARG targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
 ARG pkg_dir
 ARG deb_args=""

@@ -20,17 +23,15 @@ WORKDIR /
 COPY --link --from=input . .

 WORKDIR /usr/src/tuwunel
-ENV targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
-ENV targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
 RUN \
 --mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
 --mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
 --mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
--mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
--mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
--mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
--mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/deps,id=${cargo_share}/deps,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/build,id=${cargo_share}/build,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/examples,id=${cargo_share}/examples,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_share}/incremental,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_share}/fingerprint,sharing=locked \
 --mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
 --mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
 --mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
--- a/docker/Dockerfile.cargo.rpm
+++ b/docker/Dockerfile.cargo.rpm
@@ -1,6 +1,7 @@
 # syntax = docker/dockerfile:1.11-labs

 FROM input AS build-rpm
+ARG rust_target
 ARG rust_toolchain
 ARG RUSTUP_HOME
 ARG CARGO_HOME
@@ -9,9 +10,12 @@ ARG CARGO_TARGET_DIR
 ARG cargo_target_profile
 ARG cargo_target_artifact
 ARG cargo_target_share
+ARG cargo_share
 ARG cargo_profile
 ARG cargo_features
 ARG cargo_spec_features
+ARG targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
+ARG targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
 ARG pkg_dir
 ARG gen_rpm_args=""

@@ -23,11 +27,11 @@ RUN \
 --mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
 --mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
 --mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
--mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
--mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
--mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
--mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/deps,id=${cargo_share}/deps,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/build,id=${cargo_share}/build,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/examples,id=${cargo_share}/examples,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_share}/incremental,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_share}/fingerprint,sharing=locked \
 --mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
 --mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
 --mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
--- a/docker/Dockerfile.complement
+++ b/docker/Dockerfile.complement
@@ -103,9 +103,6 @@ EOF

 FROM input AS complement-testee

-WORKDIR /
-COPY --link --from=input . .
-
 EXPOSE 8008 8448
 RUN mkdir /database
 COPY --from=complement-config * /complement/
@@ -115,9 +112,6 @@ ENTRYPOINT tuwunel -Oserver_name=\""$SERVER_NAME\""

 FROM input AS complement-testee-valgrind

-WORKDIR /
-COPY --link --from=input . .
-
 EXPOSE 8008 8448
 RUN mkdir /database
 COPY --from=complement-config * /complement/
@@ -167,9 +161,6 @@ ARG complement_tags="conduwuit_blacklist"
 ARG complement_tests="./tests/..."
 ARG complement_base_image

-WORKDIR /
-COPY --link --from=input . .
-
 WORKDIR /usr/src/complement
 ENV COMPLEMENT_DEBUG=$complement_debug
 ENV complement_parallel="$complement_parallel"
--- a/docker/Dockerfile.matrix-rust-sdk
+++ b/docker/Dockerfile.matrix-rust-sdk
@@ -1,25 +1,28 @@
 # syntax = docker/dockerfile:1.11-labs

-FROM input AS matrix-rust-sdk-integration
+FROM input AS rust-sdk-integration
 ARG sys_name
 ARG sys_version
-ARG rust_toolchain
+ARG feat_set
 ARG rust_target
+ARG rust_toolchain
+ARG cargo_profile
 ARG RUSTUP_HOME
 ARG CARGO_HOME
 ARG CARGO_TARGET
-ARG MRSDK_TARGET_DIR="/usr/src/matrix-rust-sdk"
-ARG mrsdk_profile="release"
-ARG mrsdk_target_share="${MRSDK_TARGET_DIR}/${sys_name}/${sys_version}/${rust_target}/${rust_toolchain}/${mrsdk_profile}/_shared_cache"
+ARG MRSDK_TARGET_DIR="/usr/src/matrix-rust-sdk/target"
+ARG mrsdk_target_share
+#ARG mrsdk_ref="integration"
+ARG mrsdk_ref="tuwunel-changes"
 ARG mrsdk_test_args=""
 ARG mrsdk_test_opts=""
 ARG mrsdk_skip_list=""
-
-WORKDIR /
-COPY --link --from=input . .
+ARG mrsdk_parallel=2
+ARG mrsdk_startup_delay="10s"
+ARG mrsdk_testee="/usr/bin/tuwunel"

 WORKDIR /usr/src
-ADD --link https://github.com/matrix-construct/matrix-rust-sdk.git#integration matrix-rust-sdk
+ADD --link https://github.com/matrix-construct/matrix-rust-sdk.git#${mrsdk_ref} matrix-rust-sdk

 WORKDIR /etc
 COPY <<EOF tuwunel.toml
@@ -59,49 +62,39 @@ WORKDIR /usr/bin
 COPY --link --from=install /usr/bin/tuwunel .

 WORKDIR /usr/src/matrix-rust-sdk
-ENV targ_dir="${MRSDK_TARGET_DIR}/${mrsdk_profile}"
-ENV targ_targ_dir="${MRSDK_TARGET_DIR}/${rust_target}/${mrsdk_profile}"
+SHELL ["/bin/bash", "-c"]
 ENV RUST_BACKTRACE="full"
 ENV TUWUNEL_CONFIG="/etc/tuwunel.toml"
 ENV TUWUNEL_DATABASE_PATH="/var/db/tuwunel"
-ENV TUWUNEL_SERVER_NAME="localhost:6167"
-ENV TUWUNEL_PORT="[6167]"
-ENV HOMESERVER_URL="http://localhost:6167"
+ENV TUWUNEL_SERVER_NAME="localhost"
+ENV TUWUNEL_PORT="[8448]"
+ENV HOMESERVER_URL="http://localhost:8448"
 RUN \
 --mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
 --mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
 --mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
--mount=type=cache,dst=${targ_dir}/deps,id=${mrsdk_target_share}/deps,sharing=locked \
--mount=type=cache,dst=${targ_dir}/build,id=${mrsdk_target_share}/build,sharing=locked \
--mount=type=cache,dst=${targ_dir}/examples,id=${mrsdk_target_share}/examples,sharing=locked \
--mount=type=cache,dst=${targ_dir}/incremental,id=${mrsdk_target_share}/incremental,sharing=locked \
--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${mrsdk_target_share}/fingerprint,sharing=locked \
--mount=type=cache,dst=${targ_targ_dir}/deps,id=${mrsdk_target_share}/deps,sharing=locked \
--mount=type=cache,dst=${targ_targ_dir}/build,id=${mrsdk_target_share}/build,sharing=locked \
--mount=type=cache,dst=${targ_targ_dir}/examples,id=${mrsdk_target_share}/examples,sharing=locked \
--mount=type=cache,dst=${targ_targ_dir}/incremental,id=${mrsdk_target_share}/incremental,sharing=locked \
--mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${mrsdk_target_share}/fingerprint,sharing=locked \
+--mount=type=cache,dst=${MRSDK_TARGET_DIR},id=${mrsdk_target_share},sharing=locked \
 <<EOF
    set -eux

-    nohup /usr/bin/tuwunel 1> /var/log/tuwunel.log &
-    PID=$!; trap "sleep 10s; set +ex; kill -QUIT ${PID}; wait ${PID}" EXIT
-    sleep 3s
+    nohup ${mrsdk_testee[@]} 1> /var/log/tuwunel.log &
+    PID=$!; trap "sleep 10s; set +e; kill -QUIT ${PID}; wait ${PID}" EXIT
+    sleep "${mrsdk_startup_delay}"

    rustup run ${rust_toolchain} \
        cargo test \
            --locked \
            --release \
-            --color always \
-            --features default \
-            --target "${rust_target}" \
-            --target-dir "${MRSDK_TARGET_DIR}" \
-            --package matrix-sdk-integration-testing \
-            ${mrsdk_test_args} \
+            "--color=always" \
+            "--features=default" \
+            "--target=${rust_target}" \
+            "--target-dir=${MRSDK_TARGET_DIR}" \
+            "--package=matrix-sdk-integration-testing" \
+            ${mrsdk_test_args[@]} \
            -- \
-            --test-threads 1 \
-            --color always \
-            ${mrsdk_skip_list} \
-            ${mrsdk_test_opts} \
+            "--color=always" \
+            "--test-threads=${mrsdk_parallel}" \
+            ${mrsdk_skip_list[@]} \
+            ${mrsdk_test_opts[@]} \
            ;
 EOF
--- a/docker/Dockerfile.nix
+++ b/docker/Dockerfile.nix
@@ -4,6 +4,7 @@ FROM input AS nix-base

 WORKDIR /
 COPY --link --from=input . .
+
 RUN \
 --mount=type=cache,dst=/nix,sharing=shared \
 --mount=type=cache,dst=/root/.cache/nix,sharing=shared \
--- a/docker/Dockerfile.rust
+++ b/docker/Dockerfile.rust
@@ -6,9 +6,6 @@ ARG rust_target
 ARG rustup_version="1.28.2"
 ARG rustup_profile="minimal"

-WORKDIR /
-COPY --link --from=input . .
-
 WORKDIR ${RUST_HOME}
 RUN <<EOF
    set -eux
@@ -32,9 +29,6 @@ ARG CARGO_TERM_VERBOSE
 ARG rustup_components
 ARG cargo_installs

-WORKDIR /
-COPY --link --from=input . .
-
 WORKDIR ${RUST_HOME}
 ENV CARGO_TARGET="${rust_target}"
 ENV RUSTUP_HOME="${RUSTUP_HOME}"
--- a/docker/Dockerfile.source
+++ b/docker/Dockerfile.source
@@ -3,9 +3,6 @@
 FROM input AS source
 ARG git_checkout

-WORKDIR /
-COPY --link --from=input . .
-
 ADD --link --keep-git-dir . /usr/src/tuwunel
 WORKDIR /usr/src/tuwunel
 RUN <<EOF
@@ -30,7 +27,6 @@ ARG JEMALLOC_OVERRIDE
 ARG ROCKSDB_LIB_DIR

 WORKDIR /
-COPY --link --from=input . .
 COPY --link --from=rust ${RUST_HOME} ${RUST_HOME}
 COPY --link --from=source /usr/src/tuwunel /usr/src/tuwunel

@@ -67,9 +63,6 @@ ARG RUSTUP_HOME
 ARG CARGO_HOME
 ARG CARGO_TARGET

-WORKDIR /
-COPY --link --from=input . .
-
 WORKDIR /usr/src/tuwunel
 RUN \
 --mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
--- a/docker/Dockerfile.system
+++ b/docker/Dockerfile.system
@@ -12,9 +12,6 @@ ARG var_lib_apt
 ARG packages
 ARG DEBIAN_FRONTEND

-WORKDIR /
-COPY --link --from=input . .
-
 ENV DEBIAN_FRONTEND="${DEBIAN_FRONTEND}"
 RUN \
 --mount=type=cache,dst=/var/cache,id=${var_cache},sharing=locked \
--- a/docker/bake.hcl
+++ b/docker/bake.hcl
@@ -1,4 +1,4 @@
-variable "CI" {}
+
 variable "GITHUB_ACTOR" {}
 variable "GITHUB_REPOSITORY" {}
 variable "GITHUB_REF" {}
@@ -247,7 +247,7 @@ group "tests" {
 group "matrix-compliance" {
    targets = [
        "complement",
-        "matrix-rust-sdk-integration",
+        "rust-sdk-integ",
    ]
 }

@@ -440,61 +440,96 @@ target "complement-config" {
 # Integration tests
 #

-group "integrations" {
+group "integration" {
    targets = [
-        "matrix-rust-sdk-integration",
-        "integration",
+        "integ",
+        "rust-sdk-integ",
    ]
 }

-target "matrix-rust-sdk-integration" {
-    name = elem("matrix-rust-sdk-integration", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+variable "valgrind_flags" {
+    default = "--error-exitcode=1 --exit-on-first-error=yes --undef-value-errors=no --leak-check=no"
+}
+
+target "rust-sdk-valgrind" {
+    name = elem("rust-sdk-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
    tags = [
-        elem_tag("matrix-rust-sdk-integration", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+        elem_tag("rust-sdk-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
    ]
-    output = ["type=docker,compression=zstd,mode=max,compression-level=${zstd_image_compress_level}"]
-    cache_to = ["type=local,compression=zstd,mode=max,compression-level=${cache_compress_level}"]
-    target = "matrix-rust-sdk-integration"
-    dockerfile = "${docker_dir}/Dockerfile.matrix-rust-sdk"
    matrix = cargo_rust_feat_sys
    inherits = [
-        elem("rust", [rust_toolchain, rust_target, sys_name, sys_version, sys_target])
+        elem("rust-sdk-integ", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
    ]
    contexts = {
        input = elem("target:rust", [rust_toolchain, rust_target, sys_name, sys_version, sys_target])
        install = elem("target:install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
    }
    args = {
-        mrsdk_test_args=""
-        mrsdk_test_opts=""
+        VALGRINDFLAGS = "${valgrind_flags}"
+        mrsdk_testee = "valgrind ${valgrind_flags} /usr/bin/tuwunel"
+        mrsdk_test_args = ""
+        mrsdk_startup_delay = "30s"
+        mrsdk_skip_list =<<EOF
+            --skip test_delayed_invite_response_and_sent_message_decryption
+            --skip test_history_share_on_invite_pin_violation
+EOF
    }
 }

-target "integration-valgrind" {
-    name = elem("integration-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+target "rust-sdk-integ" {
+    name = elem("rust-sdk-integ", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
    tags = [
-        elem_tag("integration-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+        elem_tag("rust-sdk-integ", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+    ]
+    output = ["type=docker,compression=zstd,mode=max,compression-level=${zstd_image_compress_level}"]
+    cache_to = ["type=local,compression=zstd,mode=max,compression-level=${cache_compress_level}"]
+    target = "rust-sdk-integration"
+    dockerfile = "${docker_dir}/Dockerfile.matrix-rust-sdk"
+    matrix = cargo_rust_feat_sys
+    inherits = [
+        elem("rust", [rust_toolchain, rust_target, sys_name, sys_version, sys_target]),
+        elem("integ", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    ]
+    contexts = {
+        input = elem("target:rust", [rust_toolchain, rust_target, sys_name, sys_version, sys_target])
+        install = elem("target:install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    }
+    args = {
+        mrsdk_target_share = "/usr/src/matrix-rust-sdk/target/${sys_name}/${sys_version}/${rust_target}/${rust_toolchain}/_shared_cache"
+
+        mrsdk_testee = "/usr/bin/tuwunel"
+        mrsdk_test_args = "--no-fail-fast"
+
+        mrsdk_skip_list =<<EOF
+            --skip test_delayed_invite_response_and_sent_message_decryption
+EOF
+    }
+}
+
+target "integ-valgrind" {
+    name = elem("integ-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    tags = [
+        elem_tag("integ-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
    ]
    matrix = cargo_rust_feat_sys
    inherits = [
-        elem("integration", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+        elem("integ", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
    ]
    contexts = {
-        input = elem("target:integration", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+        input = elem("target:build-tests", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
    }
    args = {
-        VALGRINDFLAGS = "--error-exitcode=1 --exit-on-first-error=yes --undef-value-errors=no --leak-check=no"
+        VALGRINDFLAGS = "${valgrind_flags}"
        cargo_cmd = "valgrind test"
        cargo_args = "--test=*"
    }
 }

-target "integration" {
-    name = elem("integration", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+target "integ" {
+    name = elem("integ", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
    tags = [
-        elem_tag("integration", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+        elem_tag("integ", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
    ]
-    target = "cargo"
    matrix = cargo_rust_feat_sys
    inherits = [
        elem("build-tests", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
@@ -504,7 +539,6 @@ target "integration" {
    }
    args = {
        TUWUNEL_DATABASE_PATH = "/tmp/integration.test.db"
-
        cargo_cmd = (cargo_profile == "bench"? "bench": "test")
        cargo_args = (cargo_profile == "bench"?
            "--no-fail-fast --bench=*": "--no-fail-fast --test=*"
@@ -630,7 +664,7 @@ target "unit-valgrind" {
        input = elem("target:unit", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
    }
    args = {
-        VALGRINDFLAGS = "--error-exitcode=1 --exit-on-first-error=yes --undef-value-errors=no --leak-check=no"
+        VALGRINDFLAGS = "${valgrind_flags}"
        cargo_cmd = "valgrind test"
        cargo_args = "--lib --bins"
    }
@@ -1006,7 +1040,6 @@ target "book" {
    }
    dockerfile-inline =<<EOF
        FROM input AS book
-        COPY --link --from=input . .
        RUN ["mdbook", "build", "-d", "/book", "/usr/src/tuwunel"]
 EOF
 }
@@ -1352,6 +1385,8 @@ target "deps-base" {
        # cache key for unique artifact area
        cargo_target_artifact = "${cargo_tgt_dir_base}/${sys_name}/${sys_version}/${rust_target}/${rust_toolchain}/${cargo_profile}/${feat_set}/${git_ref_sha}"
        # cache key for hashed subdirs
+        cargo_share = "${cargo_tgt_dir_base}/${sys_name}/${sys_version}/${rust_toolchain}/${cargo_profile}/_shared_cache"
+        # cache key for hashed subdirs
        cargo_target_share = "${cargo_tgt_dir_base}/${sys_name}/${sys_version}/${rust_target}/${rust_toolchain}/${cargo_profile}/_shared_cache"
        # cased name of profile subdir within target complex
        cargo_target_profile = (
--- a/tests/complement/results.jsonl
+++ b/tests/complement/results.jsonl
@@ -703,7 +703,6 @@
 {"Action":"pass","Test":"TestSyncTimelineGap/full"}
 {"Action":"pass","Test":"TestSyncTimelineGap/incremental"}
 {"Action":"pass","Test":"TestTentativeEventualJoiningAfterRejecting"}
-{"Action":"fail","Test":"TestThreadReceiptsInSyncMSC4102"}
 {"Action":"fail","Test":"TestThreadSubscriptions"}
 {"Action":"fail","Test":"TestThreadSubscriptions/Can_create_automatic_subscription_to_a_thread"}
 {"Action":"fail","Test":"TestThreadSubscriptions/Can_subscribe_to_and_unsubscribe_from_a_thread"}