test: make Docker suites hermetic

BUILD.bazel

@@ -26,13 +26,4 @@ load("@gazelle//:def.bzl", "gazelle")
 #     native.java_proto_library).
 # gazelle:proto disable_global
 
-# Export marker files for test data dependencies (used by FindRepoRoot in tests)
-exports_files(
-    [
-        "MODULE.bazel",
-        "go.mod",
-    ],
-    visibility = ["//visibility:public"],
-)
-
 gazelle(name = "gazelle")

Makefile

@@ -38,8 +38,8 @@ GOIMPORTS_VERSION ?= v0.33.0
 # contracts); all generated stubs land in the same protopb/ dir.
 PROTO_PACKAGES = api/base/change api/base/mergestrategy api/base/messagequeue api/runway/messagequeue api/runway api/submitqueue/gateway api/submitqueue/orchestrator api/stovepipe stovepipe/core/messagequeue
 
-# Set REPO_ROOT for docker-compose
-export REPO_ROOT := $(shell pwd)
+# Local Compose builds use the repository checkout as their build context.
+export SQ_DOCKER_BUILD_CONTEXT := $(shell pwd)
 
 # Fails if git working tree is dirty. Usage: $(call assert_clean,fix command)
 define assert_clean
@@ -132,7 +132,7 @@ clean-proto: ## Clean generated proto files
 deps: tidy-go ## Download and tidy Go dependencies
 	@echo "Dependencies installed!"
 
-e2e-test: build-all-linux ## Run end-to-end tests (hermetic, auto-builds binaries; runs in parallel)
+e2e-test: ## Run end-to-end tests (Bazel builds declared Docker inputs; runs in parallel)
 	@echo "Running end-to-end tests (parallel)..."
 	@$(BAZEL) test //test/e2e/... --test_output=errors
 
@@ -147,7 +147,7 @@ gazelle: ## Update BUILD.bazel files
 	@echo "Running Gazelle to update BUILD files..."
 	@$(BAZEL) run //:gazelle
 
-integration-test: build-all-linux ## Run all integration tests (auto-builds binaries; runs in parallel)
+integration-test: ## Run all integration tests (Bazel builds declared Docker inputs; runs in parallel)
 	@echo "Running all integration tests (parallel)..."
 	@$(BAZEL) test //test/integration/... --test_output=errors
 
@@ -159,11 +159,11 @@ integration-test-extensions: ## Run extension integration tests (runs in paralle
 	@echo "Running extension integration tests (parallel)..."
 	@$(BAZEL) test //test/integration/submitqueue/extension/... //test/integration/extension/... --test_output=errors
 
-integration-test-submitqueue-gateway: build-submitqueue-gateway-linux ## Run Gateway integration tests (auto-builds binary)
+integration-test-submitqueue-gateway: ## Run Gateway integration tests (Bazel builds declared Docker inputs)
 	@echo "Running Gateway integration tests..."
 	@$(BAZEL) test //test/integration/submitqueue/gateway:go_default_test --test_output=streamed
 
-integration-test-submitqueue-orchestrator: build-submitqueue-orchestrator-linux ## Run Orchestrator integration tests (auto-builds binary)
+integration-test-submitqueue-orchestrator: ## Run Orchestrator integration tests (Bazel builds declared Docker inputs)
 	@echo "Running Orchestrator integration tests..."
 	@$(BAZEL) test //test/integration/submitqueue/orchestrator:go_default_test --test_output=streamed
 

doc/howto/TESTING.md

@@ -62,7 +62,7 @@ make e2e-test
 
 # Build
 make build                          # Build all targets
-make build-all-linux                # Build Linux binaries for Docker
+make build-all-linux                # Build Linux binaries for manual Compose workflows
 ```
 
 ### Testing Levels
@@ -88,10 +88,13 @@ make build-all-linux                # Build Linux binaries for Docker
 
 Tests use **docker-compose** via `ComposeStack` to spin up containers automatically:
 
-1. `NewComposeStack()` registers cleanup (stop log tailing, tear down containers)
-2. `Up()` starts containers, waits for healthchecks (`--wait`), and auto-tails container logs to stderr
-3. Tests run against those containers with **real-time log output**
-4. On cleanup, containers are torn down automatically (set `SKIP_CLEANUP=true` to keep them for inspection)
+1. Each `go_test` declares its Compose file, schemas, Dockerfiles, configuration, and cross-compiled Linux service binaries in Bazel `data`.
+2. `NewComposeStack()` resolves only those Bazel runfiles and stages the declared Docker build-context files in a temporary directory.
+3. `Up()` starts containers, waits for healthchecks (`--wait`), and auto-tails container logs to stderr.
+4. Tests run against those containers with **real-time log output**.
+5. On cleanup, containers are torn down automatically (set `SKIP_CLEANUP=true` to keep them for inspection).
+
+Automated Docker tests do not discover or mount the repository checkout. A test that adds a build-context input must add it to its Bazel `data` dependencies and its `ComposeConfig.DockerBuildContext` mapping.
 
 ---
 

service/runway/server/BUILD.bazel

@@ -1,4 +1,14 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
+
+filegroup(
+    name = "docker_test_context",
+    testonly = True,
+    srcs = [
+        "Dockerfile",
+        ":runway_linux_amd64",
+    ],
+    visibility = ["//test:__subpackages__"],
+)
 
 go_library(
     name = "go_default_library",
@@ -32,3 +42,9 @@ go_binary(
     embed = [":go_default_library"],
     visibility = ["//visibility:public"],
 )
+
+go_cross_binary(
+    name = "runway_linux_amd64",
+    platform = "@rules_go//go/toolchain:linux_amd64",
+    target = ":runway",
+)

service/runway/server/docker-compose.yml

@@ -37,7 +37,7 @@ services:
   runway-service:
     image: ${SQ_DOCKER_IMAGE_PREFIX:-submitqueue}-runway-service:latest
     build:
-      context: ${REPO_ROOT}
+      context: ${SQ_DOCKER_BUILD_CONTEXT}
       dockerfile: service/runway/server/Dockerfile
     ports:
       - "8080" # Random ephemeral port to avoid conflicts

service/stovepipe/docker-compose.yml

@@ -59,7 +59,7 @@ services:
   stovepipe-service:
     image: ${SQ_DOCKER_IMAGE_PREFIX:-submitqueue}-stovepipe-service:latest
     build:
-      context: ${REPO_ROOT}
+      context: ${SQ_DOCKER_BUILD_CONTEXT}
       dockerfile: service/stovepipe/server/Dockerfile
     ports:
       - "8080" # Random ephemeral port to avoid conflicts

service/stovepipe/server/BUILD.bazel

@@ -1,4 +1,14 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
+
+filegroup(
+    name = "docker_test_context",
+    testonly = True,
+    srcs = [
+        "Dockerfile",
+        ":stovepipe_linux_amd64",
+    ],
+    visibility = ["//test:__subpackages__"],
+)
 
 go_library(
     name = "go_default_library",
@@ -40,3 +50,9 @@ go_binary(
     embed = [":go_default_library"],
     visibility = ["//visibility:public"],
 )
+
+go_cross_binary(
+    name = "stovepipe_linux_amd64",
+    platform = "@rules_go//go/toolchain:linux_amd64",
+    target = ":stovepipe",
+)

service/submitqueue/docker-compose.yml

@@ -52,7 +52,7 @@ services:
   gateway-service:
     image: ${SQ_DOCKER_IMAGE_PREFIX:-submitqueue}-gateway-service:latest
     build:
-      context: ${REPO_ROOT}
+      context: ${SQ_DOCKER_BUILD_CONTEXT}
       dockerfile: service/submitqueue/gateway/server/Dockerfile
     ports:
       - "8080" # Random ephemeral port to avoid conflicts
@@ -75,7 +75,7 @@ services:
   orchestrator-service:
     image: ${SQ_DOCKER_IMAGE_PREFIX:-submitqueue}-orchestrator-service:latest
     build:
-      context: ${REPO_ROOT}
+      context: ${SQ_DOCKER_BUILD_CONTEXT}
       dockerfile: service/submitqueue/orchestrator/server/Dockerfile
     ports:
       - "8080" # Random ephemeral port to avoid conflicts
@@ -100,7 +100,7 @@ services:
   runway-service:
     image: ${SQ_DOCKER_IMAGE_PREFIX:-submitqueue}-runway-service:latest
     build:
-      context: ${REPO_ROOT}
+      context: ${SQ_DOCKER_BUILD_CONTEXT}
       dockerfile: service/runway/server/Dockerfile
     ports:
       - "8080" # Random ephemeral port to avoid conflicts

service/submitqueue/gateway/server/BUILD.bazel

@@ -1,10 +1,21 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
+load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library", "go_test")
 
 exports_files(
     ["docker-compose.yml"],
     visibility = ["//visibility:public"],
 )
 
+filegroup(
+    name = "docker_test_context",
+    testonly = True,
+    srcs = [
+        "Dockerfile",
+        "queues.yaml",
+        ":gateway_linux_amd64",
+    ],
+    visibility = ["//test:__subpackages__"],
+)
+
 go_library(
     name = "gateway_lib",
     srcs = ["main.go"],
@@ -41,6 +52,12 @@ go_binary(
     visibility = ["//visibility:public"],
 )
 
+go_cross_binary(
+    name = "gateway_linux_amd64",
+    platform = "@rules_go//go/toolchain:linux_amd64",
+    target = ":gateway",
+)
+
 go_test(
     name = "go_default_test",
     srcs = ["main_test.go"],

service/submitqueue/gateway/server/docker-compose.yml

@@ -52,7 +52,7 @@ services:
   gateway-service:
     image: ${SQ_DOCKER_IMAGE_PREFIX:-submitqueue}-gateway-service:latest
     build:
-      context: ${REPO_ROOT}
+      context: ${SQ_DOCKER_BUILD_CONTEXT}
       dockerfile: service/submitqueue/gateway/server/Dockerfile
     ports:
       - "8080" # Random ephemeral port to avoid conflicts

service/submitqueue/orchestrator/server/BUILD.bazel

@@ -1,10 +1,20 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
 
 exports_files(
     ["docker-compose.yml"],
     visibility = ["//visibility:public"],
 )
 
+filegroup(
+    name = "docker_test_context",
+    testonly = True,
+    srcs = [
+        "Dockerfile",
+        ":orchestrator_linux_amd64",
+    ],
+    visibility = ["//test:__subpackages__"],
+)
+
 go_library(
     name = "orchestrator_lib",
     srcs = ["main.go"],
@@ -71,3 +81,9 @@ go_binary(
     embed = [":orchestrator_lib"],
     visibility = ["//visibility:public"],
 )
+
+go_cross_binary(
+    name = "orchestrator_linux_amd64",
+    platform = "@rules_go//go/toolchain:linux_amd64",
+    target = ":orchestrator",
+)

service/submitqueue/orchestrator/server/docker-compose.yml

@@ -52,7 +52,7 @@ services:
   orchestrator-service:
     image: ${SQ_DOCKER_IMAGE_PREFIX:-submitqueue}-orchestrator-service:latest
     build:
-      context: ${REPO_ROOT}
+      context: ${SQ_DOCKER_BUILD_CONTEXT}
       dockerfile: service/submitqueue/orchestrator/server/Dockerfile
     ports:
       - "8080" # Random ephemeral port to avoid conflicts

test/e2e/stovepipe/BUILD.bazel

@@ -7,16 +7,16 @@ go_test(
         "suite_test.go",
     ],
     data = [
-        "//:MODULE.bazel",
-        "//:go.mod",
         "//platform/extension/messagequeue/mysql/schema",
         "//service/stovepipe:docker-compose.yml",
+        "//service/stovepipe/server:docker_test_context",
         "//stovepipe/extension/storage/mysql/schema",
     ],
     tags = [
         "e2e",
         "external",
         "integration",
+        "requires-network",
     ],
     deps = [
         "//api/stovepipe/protopb:go_default_library",

test/e2e/stovepipe/suite_test.go

@@ -16,13 +16,12 @@ package e2e_test
 
 // Stovepipe end-to-end tests.
 //
-// These tests use docker-compose from service/stovepipe/docker-compose.yml,
-// which requires a pre-built Linux binary. Run with the make target (builds
-// binaries + runs the test):
+// These tests use docker-compose from service/stovepipe/docker-compose.yml.
+// Bazel cross-compiles and declares every Docker build-context input. Run with:
 //
 //   make e2e-test
 //
-// or only this package (after building the binary):
+// or only this package:
 //
 //   bazel test //test/e2e/stovepipe:stovepipe_test
 //
@@ -35,7 +34,6 @@ package e2e_test
 import (
 	"context"
 	"database/sql"
-	"path/filepath"
 	"testing"
 	"time"
 
@@ -80,12 +78,13 @@ func (s *StovepipeE2ESuite) SetupSuite() {
 
 	s.log.Logf("Starting Stovepipe e2e test suite using docker-compose")
 
-	// Set REPO_ROOT for the docker-compose build context.
-	repoRoot := testutil.FindRepoRoot(t)
-	t.Setenv("REPO_ROOT", repoRoot)
-
-	composeFile := filepath.Join(repoRoot, "service/stovepipe/docker-compose.yml")
-	s.stack = testutil.NewComposeStack(t, s.log, s.ctx, composeFile, "e2e-stovepipe")
+	s.stack = testutil.NewComposeStack(t, s.log, s.ctx, testutil.ComposeConfig{
+		ComposeFile: "service/stovepipe/docker-compose.yml",
+		DockerBuildContext: []testutil.DockerBuildContextFile{
+			{Runfile: "service/stovepipe/server/stovepipe_linux_amd64", Path: ".docker-bin/stovepipe"},
+			{Runfile: "service/stovepipe/server/Dockerfile", Path: "service/stovepipe/server/Dockerfile"},
+		},
+	}, "e2e-stovepipe")
 
 	err := s.stack.Up()
 	require.NoError(t, err, "failed to start compose stack")

test/e2e/submitqueue/BUILD.bazel

@@ -7,17 +7,19 @@ go_test(
         "suite_test.go",
     ],
     data = [
-        "//:MODULE.bazel",
-        "//:go.mod",
         "//platform/extension/counter/mysql/schema",
         "//platform/extension/messagequeue/mysql/schema",
+        "//service/runway/server:docker_test_context",
         "//service/submitqueue:docker-compose.yml",
+        "//service/submitqueue/gateway/server:docker_test_context",
+        "//service/submitqueue/orchestrator/server:docker_test_context",
         "//submitqueue/extension/storage/mysql/schema",
     ],
     tags = [
         "e2e",
         "external",
         "integration",
+        "requires-network",
     ],
     deps = [
         "//api/base/change/protopb:go_default_library",

test/e2e/submitqueue/suite_test.go

@@ -16,16 +16,15 @@ package e2e_test
 
 // E2E Integration Tests
 //
-// These tests use docker-compose from service/submitqueue/docker-compose.yml
-// which requires pre-built Linux binaries.
+// These tests use docker-compose from service/submitqueue/docker-compose.yml.
+// Bazel cross-compiles and declares every Docker build-context input.
 //
-// Run with make target (builds binaries + runs test):
+// Run with:
 //   make e2e-test
 
 import (
 	"context"
 	"database/sql"
-	"path/filepath"
 	"testing"
 	"time"
 
@@ -76,14 +75,18 @@ func (s *E2EIntegrationSuite) SetupSuite() {
 
 	s.log.Logf("Starting E2E integration test suite using docker-compose")
 
-	// Set REPO_ROOT for docker-compose volume mounts and build context
-	repoRoot := testutil.FindRepoRoot(t)
-	t.Setenv("REPO_ROOT", repoRoot)
-
-	// Use docker-compose from service/submitqueue (full stack)
-	// NOTE: Assumes Linux binaries are pre-built via make target
-	composeFile := filepath.Join(repoRoot, "service/submitqueue/docker-compose.yml")
-	s.stack = testutil.NewComposeStack(t, s.log, s.ctx, composeFile, "e2e-submitqueue")
+	s.stack = testutil.NewComposeStack(t, s.log, s.ctx, testutil.ComposeConfig{
+		ComposeFile: "service/submitqueue/docker-compose.yml",
+		DockerBuildContext: []testutil.DockerBuildContextFile{
+			{Runfile: "service/submitqueue/gateway/server/gateway_linux_amd64", Path: ".docker-bin/gateway"},
+			{Runfile: "service/submitqueue/gateway/server/Dockerfile", Path: "service/submitqueue/gateway/server/Dockerfile"},
+			{Runfile: "service/submitqueue/gateway/server/queues.yaml", Path: "service/submitqueue/gateway/server/queues.yaml"},
+			{Runfile: "service/submitqueue/orchestrator/server/orchestrator_linux_amd64", Path: ".docker-bin/orchestrator"},
+			{Runfile: "service/submitqueue/orchestrator/server/Dockerfile", Path: "service/submitqueue/orchestrator/server/Dockerfile"},
+			{Runfile: "service/runway/server/runway_linux_amd64", Path: ".docker-bin/runway"},
+			{Runfile: "service/runway/server/Dockerfile", Path: "service/runway/server/Dockerfile"},
+		},
+	}, "e2e-submitqueue")
 
 	// Start the compose stack (Gateway + Orchestrator + 2 MySQL DBs)
 	err := s.stack.Up()