.template-docker: &template-docker
  before_script:
    - apt-get update
    - apt-get install --no-install-recommends --yes golang golang-golang-x-tools build-essential clang git ca-certificates
  script:
    # Run as user nobody so CAP_DAC_OVERRIDE is dropped and the tests can
    # chmod a file 0000 to force "permission denied" errors.
    - export HOME=/tmp # writable by nobody
    - chown -R nobody .
    # Empty TEST_* as -fsanitize doesn't work in a Docker container
    - runuser -p -u nobody -- ./ci/run TEST_CFLAGS= TEST_LDFLAGS=
  variables:
    # The chown to nobody above causes permissions errors in recent Git
    # versions "fatal: detected dubious ownership in repository [...] To add
    # an exception for this directory, call: git config --global --add
    # safe.directory [...]".
    GIT_STRATEGY: clone

debian-stable:
  <<: *template-docker
  image: debian:stable

debian-testing:
  <<: *template-docker
  image: debian:testing

debian-sid:
  <<: *template-docker
  image: debian:sid