chore: capture Jenkins Docker baseline

agents/mcuxpresso/Dockerfile

@@ -0,0 +1,83 @@
+FROM ubuntu:22.04
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        openssh-server openjdk-17-jre-headless git make build-essential python3 \
+        curl unzip ca-certificates xz-utils \
+        # Electron runtime deps: MCUXpressoInstallerCLI ships as an Electron
+        # app and needs these even for headless/CLI use.
+        libglib2.0-0 libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
+        libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 \
+        libpango-1.0-0 libcairo2 libasound2 libxshmfence1 libx11-6 libxext6 \
+        libxrender1 libgtk-3-0 xvfb \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN useradd -m -s /bin/bash jenkins \
+    && mkdir -p /home/jenkins/.ssh /var/run/sshd \
+    && chmod 700 /home/jenkins/.ssh
+
+COPY secrets/agent_ssh_key.pub /home/jenkins/.ssh/authorized_keys
+RUN chown -R jenkins:jenkins /home/jenkins/.ssh \
+    && chmod 600 /home/jenkins/.ssh/authorized_keys
+
+# --- MCUXpresso Installer ---------------------------------------------------
+# NXP no longer ships a plain IDE .deb - the download is "MCUXpresso
+# Installer", a Makeself-wrapped Electron app (*.deb.bin) that itself
+# contains a documented headless CLI (MCUXpressoInstallerCLI) for fetching
+# individual packages/components non-interactively, no NXP account/login
+# needed at download time. Get it from https://www.nxp.com/mcuxpresso and
+# place it in installers/mcuxpresso/ before building. See
+# installers/mcuxpresso/README.md.
+COPY installers/mcuxpresso/ /tmp/installers/
+RUN set -e; \
+    INSTALLER=$(ls /tmp/installers/*.deb.bin 2>/dev/null | head -n1); \
+    if [ -z "$INSTALLER" ]; then \
+        echo "ERROR: no MCUXpresso installer (*.deb.bin) found in installers/mcuxpresso/. See installers/mcuxpresso/README.md" >&2; \
+        exit 1; \
+    fi; \
+    chmod +x "$INSTALLER"; \
+    # --noexec: unpack the Makeself payload (install.sh + the real .deb)
+    # without running install.sh, which assumes an interactive desktop user
+    # and does things (desktop icons, chrome-sandbox setuid) we don't need
+    # in a headless CI agent.
+    "$INSTALLER" --target /tmp/mcux_pkg --noprogress --noexec --keep; \
+    DEB=$(ls /tmp/mcux_pkg/*.deb | head -n1); \
+    dpkg -x "$DEB" /opt/mcuxpresso-installer; \
+    rm -rf /tmp/installers /tmp/mcux_pkg; \
+    # The app writes its own logs/cache next to its binary (e.g.
+    # <installdir>/logs/cli.log). Left root-owned, a non-root caller can't
+    # create that path and the app retries the failed write in an infinite
+    # loop instead of erroring out - so it must be writable by the jenkins
+    # user before anything ever invokes it.
+    chown -R jenkins:jenkins /opt/mcuxpresso-installer
+
+# The installer is Electron; running as root needs a setuid chrome-sandbox
+# binary we don't bother setting up, and our CI user is unprivileged anyway,
+# so just disable the sandbox instead.
+ENV ELECTRON_DISABLE_SANDBOX=1
+
+# MCUXpressoInstallerCLI still initializes Electron/Chromium under the hood
+# and needs *a* display even for pure CLI output, so always drive it through
+# a throwaway Xvfb instance.
+RUN printf '#!/bin/sh\nexec xvfb-run -a /opt/mcuxpresso-installer/MCUXpressoInstaller/MCUXpressoInstallerCLI "$@"\n' \
+        > /usr/local/bin/mcux-cli \
+    && chmod +x /usr/local/bin/mcux-cli
+
+# Bake in a default toolchain so pipelines aren't hitting the network on
+# every build. `docker run --rm <image> mcux-cli install --help` lists every
+# available -p/-c package/component and version if you want to change this.
+USER jenkins
+RUN mcux-cli install -c armToolchain cmake ninja; \
+    ARMGCC_DIR=$(ls -d /home/jenkins/.mcuxpressotools/arm-gnu-toolchain-*-x86_64-arm-none-eabi | head -n1); \
+    CMAKE_DIR=$(ls -d /home/jenkins/.mcuxpressotools/cmake-*-linux-x86_64 | head -n1); \
+    NINJA_DIR=$(ls -d /home/jenkins/.mcuxpressotools/ninja-* | head -n1); \
+    ln -s "$ARMGCC_DIR" /home/jenkins/.mcuxpressotools/arm-toolchain; \
+    ln -s "$CMAKE_DIR" /home/jenkins/.mcuxpressotools/cmake; \
+    ln -s "$NINJA_DIR" /home/jenkins/.mcuxpressotools/ninja; \
+    test -x /home/jenkins/.mcuxpressotools/arm-toolchain/bin/arm-none-eabi-gcc
+USER root
+
+ENV PATH="/home/jenkins/.mcuxpressotools/arm-toolchain/bin:/home/jenkins/.mcuxpressotools/cmake/bin:/home/jenkins/.mcuxpressotools/ninja:${PATH}"
+
+EXPOSE 22
+CMD ["/usr/sbin/sshd", "-D"]