.template-docker: &template-docker
  before_script:
    - apt-get update
    - apt-get install --no-install-recommends --yes golang golang-golang-x-tools build-essential clang git ca-certificates
  script:
    # Run as user nobody so CAP_DAC_OVERRIDE is dropped and the tests can
    # chmod a file 0000 to force "permission denied" errors.
    - export HOME=/tmp # writable by nobody
    - chown -R nobody .
    # Empty TEST_* as -fsanitize doesn't work in a Docker container
    - runuser -p -u nobody -- ./ci/run TEST_CFLAGS= TEST_LDFLAGS=

debian-stable:
  <<: *template-docker
  image: debian:stable

debian-testing:
  <<: *template-docker
  image: debian:testing

debian-sid:
  <<: *template-docker
  image: debian:sid