From d12e6658b450ff7e5c3c9d1950a10f37685b57bf Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Thu, 27 Feb 2025 14:39:02 +0000
Subject: [PATCH 01/12] ci: move packages needed to run `dash-qt` into
 `develop` container

---
 contrib/containers/ci/Dockerfile      | 11 -----------
 contrib/containers/develop/Dockerfile | 17 ++++++++++++++---
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/contrib/containers/ci/Dockerfile b/contrib/containers/ci/Dockerfile
index cdce794c5731a..be3e0836adca6 100644
--- a/contrib/containers/ci/Dockerfile
+++ b/contrib/containers/ci/Dockerfile
@@ -51,17 +51,6 @@ RUN set -ex; \
     git \
     gnupg \
     libtool \
-    libxcb-icccm4 \
-    libxcb-image0 \
-    libxcb-keysyms1 \
-    libxcb-randr0 \
-    libxcb-render-util0 \
-    libxcb-shape0 \
-    libxcb-sync1 \
-    libxcb-xfixes0 \
-    libxcb-xinerama0 \
-    libxcb-xkb1 \
-    libxkbcommon-x11-0 \
     lsb-release \
     software-properties-common \
     unzip \
diff --git a/contrib/containers/develop/Dockerfile b/contrib/containers/develop/Dockerfile
index fa0926ad0d9db..5d92a96ab906e 100644
--- a/contrib/containers/develop/Dockerfile
+++ b/contrib/containers/develop/Dockerfile
@@ -8,12 +8,23 @@ INCLUDE+ ci/Dockerfile
 # just started configuring this image, give us root access
 USER root
 
-# Make development environment more standalone
-RUN apt-get update && \
-    apt-get install $APT_ARGS \
+# Make development environment more standalone, allow running Dash Qt
+RUN set -ex; \
+    apt-get update && apt-get install ${APT_ARGS} \
     apt-cacher-ng \
     gdb \
     gpg \
+    libxcb-icccm4 \
+    libxcb-image0 \
+    libxcb-keysyms1 \
+    libxcb-randr0 \
+    libxcb-render-util0 \
+    libxcb-shape0 \
+    libxcb-sync1 \
+    libxcb-xfixes0 \
+    libxcb-xinerama0 \
+    libxcb-xkb1 \
+    libxkbcommon-x11-0 \
     lsb-release \
     nano \
     openssh-client \

From c12f8b17851195d2dec60e1429ef1e3df074e669 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Fri, 28 Feb 2025 14:49:49 +0000
Subject: [PATCH 02/12] ci: rename `ci/Dockerfile`, switch to
 `devthefuture/dockerfile-x`

---
 .dockerignore                                       | 2 +-
 .github/workflows/build-container.yml               | 6 +++---
 .github/workflows/build-depends.yml                 | 6 +++---
 .github/workflows/build-src.yml                     | 4 ++--
 .gitlab-ci.yml                                      | 7 ++++---
 contrib/containers/ci/{Dockerfile => ci.Dockerfile} | 0
 contrib/containers/develop/Dockerfile               | 6 ++----
 7 files changed, 15 insertions(+), 16 deletions(-)
 rename contrib/containers/ci/{Dockerfile => ci.Dockerfile} (100%)

diff --git a/.dockerignore b/.dockerignore
index ff58920f492c8..90228ed9f7107 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,4 +1,4 @@
 **
-!contrib/containers/ci/Dockerfile
+!contrib/containers/ci/ci.Dockerfile
 !contrib/containers/deploy/Dockerfile
 !contrib/containers/develop/Dockerfile
diff --git a/.github/workflows/build-container.yml b/.github/workflows/build-container.yml
index f4f1010430dce..b98fc132d0115 100644
--- a/.github/workflows/build-container.yml
+++ b/.github/workflows/build-container.yml
@@ -45,14 +45,14 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: ./contrib/containers/ci
-          file: ./contrib/containers/ci/Dockerfile
+          file: ./contrib/containers/ci/ci.Dockerfile
           push: true
           tags: |
-            ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ hashFiles('./contrib/containers/ci/Dockerfile') }}
+            ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ hashFiles('./contrib/containers/ci/ci.Dockerfile') }}
             ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ steps.prepare.outputs.tag }}
             ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:latest
           cache-from: |
-            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ hashFiles('./contrib/containers/ci/Dockerfile') }}
+            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ hashFiles('./contrib/containers/ci/ci.Dockerfile') }}
             type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ steps.prepare.outputs.tag }}
             type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:latest
           cache-to: type=inline
diff --git a/.github/workflows/build-depends.yml b/.github/workflows/build-depends.yml
index 5eafd46f9ca56..b2fefcba010cd 100644
--- a/.github/workflows/build-depends.yml
+++ b/.github/workflows/build-depends.yml
@@ -70,10 +70,10 @@ jobs:
           path: |
             depends/built
             depends/${{ steps.setup.outputs.HOST }}
-          key: depends-${{ hashFiles('contrib/containers/ci/Dockerfile') }}-${{ inputs.build-target }}-${{ steps.setup.outputs.DEP_HASH }}-${{ hashFiles('depends/packages/*') }}
+          key: depends-${{ hashFiles('contrib/containers/ci/ci.Dockerfile') }}-${{ inputs.build-target }}-${{ steps.setup.outputs.DEP_HASH }}-${{ hashFiles('depends/packages/*') }}
           restore-keys: |
-            depends-${{ hashFiles('contrib/containers/ci/Dockerfile') }}-${{ inputs.build-target }}-${{ steps.setup.outputs.DEP_HASH }}-
-            depends-${{ hashFiles('contrib/containers/ci/Dockerfile') }}-${{ inputs.build-target }}-
+            depends-${{ hashFiles('contrib/containers/ci/ci.Dockerfile') }}-${{ inputs.build-target }}-${{ steps.setup.outputs.DEP_HASH }}-
+            depends-${{ hashFiles('contrib/containers/ci/ci.Dockerfile') }}-${{ inputs.build-target }}-
 
       - name: Build depends
         run: |
diff --git a/.github/workflows/build-src.yml b/.github/workflows/build-src.yml
index 67a363975a45d..16a7ed4b4dcda 100644
--- a/.github/workflows/build-src.yml
+++ b/.github/workflows/build-src.yml
@@ -70,9 +70,9 @@ jobs:
         with:
           path: |
             /cache
-          key: ccache-${{ hashFiles('contrib/containers/ci/Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-${{ github.sha }}
+          key: ccache-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-${{ github.sha }}
           restore-keys: |
-            ccache-${{ hashFiles('contrib/containers/ci/Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-
+            ccache-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-
 
       - name: Build source
         run: |
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index cd25b42f9fdbd..ec42402e5d6d5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -29,9 +29,10 @@ builder-image:
     - echo $CI_JOB_TOKEN | docker login -u gitlab-ci-token --password-stdin $CI_REGISTRY
   script:
     - cd contrib/containers/ci
+    - export DOCKER_BUILDKIT=1
     - docker pull $CI_REGISTRY_IMAGE:builder-$CI_COMMIT_REF_SLUG || true
     - docker pull $CI_REGISTRY_IMAGE:builder-develop || true
-    - docker build --cache-from $CI_REGISTRY_IMAGE:builder-$CI_COMMIT_REF_SLUG --cache-from $CI_REGISTRY_IMAGE:builder-develop -t $CI_REGISTRY_IMAGE:builder-$CI_COMMIT_REF_SLUG -f Dockerfile .
+    - docker build --cache-from $CI_REGISTRY_IMAGE:builder-$CI_COMMIT_REF_SLUG --cache-from $CI_REGISTRY_IMAGE:builder-develop -t $CI_REGISTRY_IMAGE:builder-$CI_COMMIT_REF_SLUG -f ci.Dockerfile .
     - docker push $CI_REGISTRY_IMAGE:builder-$CI_COMMIT_REF_SLUG
 
 .build-depends-template:
@@ -56,7 +57,7 @@ builder-image:
     # Let all branches share the same cache, which is ok because the depends subsystem is able to handle this properly (it works with hashes of all scripts)
     key:
       files:
-        - contrib/containers/ci/Dockerfile
+        - contrib/containers/ci/ci.Dockerfile
       prefix: ${CI_JOB_NAME}
     paths:
       - depends/built
@@ -116,7 +117,7 @@ builder-image:
     # Let all branches share the same cache, which is ok because ccache is able to handle it
     key:
       files:
-        - contrib/containers/ci/Dockerfile
+        - contrib/containers/ci/ci.Dockerfile
       prefix: ${CI_JOB_NAME}
     paths:
       - cache/ccache
diff --git a/contrib/containers/ci/Dockerfile b/contrib/containers/ci/ci.Dockerfile
similarity index 100%
rename from contrib/containers/ci/Dockerfile
rename to contrib/containers/ci/ci.Dockerfile
diff --git a/contrib/containers/develop/Dockerfile b/contrib/containers/develop/Dockerfile
index 5d92a96ab906e..9ced569a454e2 100644
--- a/contrib/containers/develop/Dockerfile
+++ b/contrib/containers/develop/Dockerfile
@@ -1,8 +1,6 @@
-# syntax = edrevo/dockerfile-plus
+# syntax = devthefuture/dockerfile-x
 
-FROM ubuntu:noble
-
-INCLUDE+ ci/Dockerfile
+FROM ./ci/ci.Dockerfile
 
 # The inherited Dockerfile switches to non-privileged context and we've
 # just started configuring this image, give us root access

From e675f3b732a0896a99c04e7ec353db7592b6a251 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Thu, 27 Feb 2025 16:49:04 +0000
Subject: [PATCH 03/12] ci: stop using LLVM setup script to setup repo

The upcoming slim container will be installing fewer packages than
default to allow for TSan to work. Also lets us drop a few packages.
---
 contrib/containers/ci/ci.Dockerfile | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/contrib/containers/ci/ci.Dockerfile b/contrib/containers/ci/ci.Dockerfile
index be3e0836adca6..f2d562e487a16 100644
--- a/contrib/containers/ci/ci.Dockerfile
+++ b/contrib/containers/ci/ci.Dockerfile
@@ -49,26 +49,23 @@ RUN set -ex; \
     g++ \
     gettext \
     git \
-    gnupg \
     libtool \
-    lsb-release \
-    software-properties-common \
     unzip \
-    wget \
     m4 \
     pkg-config \
     zlib1g-dev \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Clang+LLVM and set it as default
-# We don't need all packages but the default set doesn't include some
-# packages we want so we will need to install some of them manually.
 ARG LLVM_VERSION=18
 RUN set -ex; \
     echo "Installing LLVM and Clang ${LLVM_VERSION}..."; \
-    curl -sL https://apt.llvm.org/llvm.sh | bash -s -- "${LLVM_VERSION}"; \
-    echo "Installing additional packages..."; \
-    apt-get update && apt-get install $APT_ARGS \
+    . /etc/os-release; \
+    curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key > /etc/apt/trusted.gpg.d/apt.llvm.org.asc; \
+    echo "deb [signed-by=/etc/apt/trusted.gpg.d/apt.llvm.org.asc] http://apt.llvm.org/${UBUNTU_CODENAME}/  llvm-toolchain-${UBUNTU_CODENAME}-${LLVM_VERSION} main" > /etc/apt/sources.list.d/llvm.list; \
+    apt-get update && apt-get install ${APT_ARGS} \
+    "clang-${LLVM_VERSION}" \
+    "clangd-${LLVM_VERSION}" \
     "clang-format-${LLVM_VERSION}" \
     "clang-tidy-${LLVM_VERSION}" \
     "libc++-${LLVM_VERSION}-dev" \
@@ -76,6 +73,7 @@ RUN set -ex; \
     "libclang-${LLVM_VERSION}-dev" \
     "libclang-rt-${LLVM_VERSION}-dev" \
     "lld-${LLVM_VERSION}" \
+    "lldb-${LLVM_VERSION}" \
     "llvm-${LLVM_VERSION}-dev"; \
     rm -rf /var/lib/apt/lists/*; \
     echo "Setting defaults..."; \

From f7702ff980cd19e61c6478fd7390c4d12d75e283 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Fri, 28 Feb 2025 16:48:49 +0000
Subject: [PATCH 04/12] ci: extract minimum environment needed to run
 functional tests

We don't need multiple (cross) compilers to run tests and GitHub Actions
currently hamstrings our ability to thin down the runner using
conventional means, so we thin down the container itself.
---
 .dockerignore                            |   1 +
 contrib/containers/ci/ci-slim.Dockerfile | 118 +++++++++++++++++++++++
 contrib/containers/ci/ci.Dockerfile      | 116 ++--------------------
 contrib/containers/develop/Dockerfile    |   5 +-
 4 files changed, 131 insertions(+), 109 deletions(-)
 create mode 100644 contrib/containers/ci/ci-slim.Dockerfile

diff --git a/.dockerignore b/.dockerignore
index 90228ed9f7107..b2487d0205fc8 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,4 +1,5 @@
 **
 !contrib/containers/ci/ci.Dockerfile
+!contrib/containers/ci/ci-slim.Dockerfile
 !contrib/containers/deploy/Dockerfile
 !contrib/containers/develop/Dockerfile
diff --git a/contrib/containers/ci/ci-slim.Dockerfile b/contrib/containers/ci/ci-slim.Dockerfile
new file mode 100644
index 0000000000000..2bfb3baea2432
--- /dev/null
+++ b/contrib/containers/ci/ci-slim.Dockerfile
@@ -0,0 +1,118 @@
+# Builder for cppcheck
+FROM debian:bookworm-slim AS cppcheck-builder
+ARG CPPCHECK_VERSION=2.13.0
+RUN set -ex; \
+    apt-get update && apt-get install -y --no-install-recommends \
+        curl \
+        ca-certificates \
+        cmake \
+        make \
+        g++ \
+    && rm -rf /var/lib/apt/lists/*; \
+    echo "Downloading Cppcheck version: ${CPPCHECK_VERSION}"; \
+    curl -fL "https://github.com/danmar/cppcheck/archive/${CPPCHECK_VERSION}.tar.gz" -o /tmp/cppcheck.tar.gz; \
+    mkdir -p /src/cppcheck && tar -xzf /tmp/cppcheck.tar.gz -C /src/cppcheck --strip-components=1; \
+    rm /tmp/cppcheck.tar.gz; \
+    cd /src/cppcheck; \
+    mkdir build && cd build && cmake .. && cmake --build . -j"$(nproc)"; \
+    strip bin/cppcheck
+
+# Main image
+FROM ubuntu:noble
+
+# Include built assets
+COPY --from=cppcheck-builder /src/cppcheck/build/bin/cppcheck /usr/local/bin/cppcheck
+COPY --from=cppcheck-builder /src/cppcheck/cfg /usr/local/share/Cppcheck/cfg
+ENV PATH="/usr/local/bin:${PATH}"
+
+# Needed to prevent tzdata hanging while expecting user input
+ENV DEBIAN_FRONTEND="noninteractive" TZ="Europe/London"
+
+# Build and base stuff
+ENV APT_ARGS="-y --no-install-recommends --no-upgrade"
+
+# Packages needed to build Python and extract artifacts
+RUN set -ex; \
+    apt-get update && apt-get install ${APT_ARGS} \
+    build-essential \
+    ca-certificates \
+    curl \
+    g++ \
+    git \
+    libbz2-dev \
+    libffi-dev \
+    liblzma-dev \
+    libncurses5-dev \
+    libncursesw5-dev \
+    libreadline-dev \
+    libsqlite3-dev \
+    libssl-dev \
+    make \
+    tk-dev \
+    xz-utils \
+    zlib1g-dev \
+    zstd \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Python and set it as default
+ENV PYENV_ROOT="/usr/local/pyenv"
+ENV PATH="${PYENV_ROOT}/shims:${PYENV_ROOT}/bin:${PATH}"
+# PYTHON_VERSION should match the value in .python-version
+ARG PYTHON_VERSION=3.9.18
+RUN set -ex; \
+    curl https://pyenv.run | bash \
+    && pyenv update \
+    && pyenv install ${PYTHON_VERSION} \
+    && pyenv global ${PYTHON_VERSION} \
+    && pyenv rehash
+
+# Install Python packages
+RUN set -ex; \
+    pip3 install --no-cache-dir \
+    codespell==1.17.1 \
+    flake8==3.8.3 \
+    jinja2 \
+    lief==0.13.2 \
+    multiprocess \
+    mypy==0.910 \
+    pyzmq==22.3.0 \
+    vulture==2.3
+
+# Install packages relied on by tests
+ARG DASH_HASH_VERSION=1.4.0
+RUN set -ex; \
+    cd /tmp; \
+    git clone --depth 1 --no-tags --branch=${DASH_HASH_VERSION} https://github.com/dashpay/dash_hash; \
+    cd dash_hash && pip3 install -r requirements.txt .; \
+    cd .. && rm -rf dash_hash
+
+ARG SHELLCHECK_VERSION=v0.7.1
+RUN set -ex; \
+    curl -fL "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" -o /tmp/shellcheck.tar.xz; \
+    mkdir -p /opt/shellcheck && tar -xf /tmp/shellcheck.tar.xz -C /opt/shellcheck --strip-components=1 && rm /tmp/shellcheck.tar.xz
+ENV PATH="/opt/shellcheck:${PATH}"
+
+# Packages needed to be able to run sanitizer builds
+ARG LLVM_VERSION=18
+RUN set -ex; \
+    . /etc/os-release; \
+    curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key > /etc/apt/trusted.gpg.d/apt.llvm.org.asc; \
+    echo "deb [signed-by=/etc/apt/trusted.gpg.d/apt.llvm.org.asc] http://apt.llvm.org/${UBUNTU_CODENAME}/  llvm-toolchain-${UBUNTU_CODENAME}-${LLVM_VERSION} main" > /etc/apt/sources.list.d/llvm.list; \
+    apt-get update && apt-get install ${APT_ARGS} \
+    "llvm-${LLVM_VERSION}-dev"; \
+    rm -rf /var/lib/apt/lists/*;
+
+# Setup unprivileged user and configuration files
+ARG USER_ID=1000 \
+    GROUP_ID=1000
+RUN set -ex; \
+    groupmod -g ${GROUP_ID} -n dash ubuntu; \
+    usermod -u ${USER_ID} -md /home/dash -l dash ubuntu; \
+    chown ${USER_ID}:${GROUP_ID} -R /home/dash; \
+    mkdir -p /src/dash && \
+    chown ${USER_ID}:${GROUP_ID} /src && \
+    chown ${USER_ID}:${GROUP_ID} -R /src
+
+WORKDIR /src/dash
+
+USER dash
diff --git a/contrib/containers/ci/ci.Dockerfile b/contrib/containers/ci/ci.Dockerfile
index f2d562e487a16..b9839c5ad6915 100644
--- a/contrib/containers/ci/ci.Dockerfile
+++ b/contrib/containers/ci/ci.Dockerfile
@@ -1,36 +1,10 @@
-# cppcheck builder
-FROM debian:bookworm-slim AS cppcheck-builder
-ARG CPPCHECK_VERSION=2.13.0
-RUN set -ex; \
-    apt-get update && apt-get install -y --no-install-recommends \
-        curl \
-        ca-certificates \
-        cmake \
-        make \
-        g++ \
-    && rm -rf /var/lib/apt/lists/*; \
-    echo "Downloading Cppcheck version: ${CPPCHECK_VERSION}"; \
-    curl -fL "https://github.com/danmar/cppcheck/archive/${CPPCHECK_VERSION}.tar.gz" -o /tmp/cppcheck.tar.gz; \
-    mkdir -p /src/cppcheck && tar -xzf /tmp/cppcheck.tar.gz -C /src/cppcheck --strip-components=1; \
-    rm /tmp/cppcheck.tar.gz; \
-    cd /src/cppcheck; \
-    mkdir build && cd build && cmake .. && cmake --build . -j"$(nproc)"; \
-    strip bin/cppcheck
-
-# Final Image
-FROM ubuntu:noble
-COPY --from=cppcheck-builder /src/cppcheck/build/bin/cppcheck /usr/local/bin/cppcheck
-COPY --from=cppcheck-builder /src/cppcheck/cfg /usr/local/share/Cppcheck/cfg
+# syntax = devthefuture/dockerfile-x
 
-# Set Path
-ENV PATH="/usr/local/bin:${PATH}"
+FROM ./ci-slim.Dockerfile
 
-# Needed to prevent tzdata hanging while expecting user input
-ENV DEBIAN_FRONTEND="noninteractive" TZ="Europe/London"
-
-# Build and base stuff
-# (zlib1g-dev is needed for the Qt host binary builds, but should not be used by target binaries)
-ENV APT_ARGS="-y --no-install-recommends --no-upgrade"
+# The inherited Dockerfile switches to non-privileged context and we've
+# just started configuring this image, give us root access
+USER root
 
 # Install common packages
 RUN set -ex; \
@@ -41,28 +15,18 @@ RUN set -ex; \
     autoconf \
     bear \
     bison \
-    build-essential \
     bsdmainutils \
-    curl \
     ccache \
     cmake \
-    g++ \
     gettext \
-    git \
     libtool \
     unzip \
     m4 \
     pkg-config \
-    zlib1g-dev \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Clang+LLVM and set it as default
-ARG LLVM_VERSION=18
+# Install Clang + LLVM and set it as default
 RUN set -ex; \
-    echo "Installing LLVM and Clang ${LLVM_VERSION}..."; \
-    . /etc/os-release; \
-    curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key > /etc/apt/trusted.gpg.d/apt.llvm.org.asc; \
-    echo "deb [signed-by=/etc/apt/trusted.gpg.d/apt.llvm.org.asc] http://apt.llvm.org/${UBUNTU_CODENAME}/  llvm-toolchain-${UBUNTU_CODENAME}-${LLVM_VERSION} main" > /etc/apt/sources.list.d/llvm.list; \
     apt-get update && apt-get install ${APT_ARGS} \
     "clang-${LLVM_VERSION}" \
     "clangd-${LLVM_VERSION}" \
@@ -73,8 +37,7 @@ RUN set -ex; \
     "libclang-${LLVM_VERSION}-dev" \
     "libclang-rt-${LLVM_VERSION}-dev" \
     "lld-${LLVM_VERSION}" \
-    "lldb-${LLVM_VERSION}" \
-    "llvm-${LLVM_VERSION}-dev"; \
+    "lldb-${LLVM_VERSION}"; \
     rm -rf /var/lib/apt/lists/*; \
     echo "Setting defaults..."; \
     lldbUpdAltArgs="update-alternatives --install /usr/bin/llvm-config llvm-config /usr/bin/llvm-config-${LLVM_VERSION} 100"; \
@@ -88,48 +51,6 @@ RUN set -ex; \
 # LD_LIBRARY_PATH is empty by default, this is the first entry
 ENV LD_LIBRARY_PATH="/usr/lib/llvm-${LLVM_VERSION}/lib"
 
-# Python setup
-# PYTHON_VERSION should match the value in .python-version
-ARG PYTHON_VERSION=3.9.18
-RUN apt-get update && apt-get install $APT_ARGS \
-    ca-certificates \
-    libbz2-dev \
-    libffi-dev \
-    liblzma-dev \
-    libncurses5-dev \
-    libncursesw5-dev \
-    libreadline-dev \
-    libsqlite3-dev \
-    libssl-dev \
-    make \
-    tk-dev \
-    xz-utils \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV PYENV_ROOT="/usr/local/pyenv"
-ENV PATH="${PYENV_ROOT}/shims:${PYENV_ROOT}/bin:${PATH}"
-RUN curl https://pyenv.run | bash \
-    && pyenv update \
-    && pyenv install $PYTHON_VERSION \
-    && pyenv global $PYTHON_VERSION \
-    && pyenv rehash
-RUN pip3 install --no-cache-dir \
-    codespell==1.17.1 \
-    flake8==3.8.3 \
-    jinja2 \
-    lief==0.13.2 \
-    multiprocess \
-    mypy==0.910 \
-    pyzmq==22.3.0 \
-    vulture==2.3
-
-ARG DASH_HASH_VERSION=1.4.0
-RUN set -ex; \
-    cd /tmp; \
-    git clone --depth 1 --no-tags --branch=${DASH_HASH_VERSION} https://github.com/dashpay/dash_hash; \
-    cd dash_hash && pip3 install -r requirements.txt .; \
-    cd .. && rm -rf dash_hash
-
 RUN set -ex; \
     git clone --depth=1 "https://github.com/include-what-you-use/include-what-you-use" -b "clang_${LLVM_VERSION}" /opt/iwyu; \
     cd /opt/iwyu; \
@@ -138,22 +59,6 @@ RUN set -ex; \
     make install -j "$(( $(nproc) - 1 ))"; \
     cd /opt && rm -rf /opt/iwyu;
 
-ARG SHELLCHECK_VERSION=v0.7.1
-RUN set -ex; \
-    curl -fL "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" -o /tmp/shellcheck.tar.xz; \
-    mkdir -p /opt/shellcheck && tar -xf /tmp/shellcheck.tar.xz -C /opt/shellcheck --strip-components=1 && rm /tmp/shellcheck.tar.xz
-ENV PATH="/opt/shellcheck:${PATH}"
-
-# Setup unprivileged user and configuration files
-ARG USER_ID=1000 \
-    GROUP_ID=1000
-RUN set -ex; \
-    groupmod -g ${GROUP_ID} -n dash ubuntu; \
-    usermod -u ${USER_ID} -md /home/dash -l dash ubuntu; \
-    mkdir -p /home/dash/.config/gdb; \
-    echo "add-auto-load-safe-path /usr/lib/llvm-${LLVM_VERSION}/lib" | tee /home/dash/.config/gdb/gdbinit; \
-    chown ${USER_ID}:${GROUP_ID} -R /home/dash
-
 # Packages needed for all target builds
 RUN apt-get update && apt-get install $APT_ARGS \
     bc \
@@ -171,7 +76,6 @@ RUN apt-get update && apt-get install $APT_ARGS \
     wine-stable \
     wine64 \
     zip \
-    zstd \
     && rm -rf /var/lib/apt/lists/*
 
 # Make sure std::thread and friends is available
@@ -181,15 +85,11 @@ RUN \
   exit 0
 
 RUN \
-  mkdir -p /src/dash && \
   mkdir -p /cache/ccache && \
   mkdir /cache/depends && \
   mkdir /cache/sdk-sources && \
-  chown ${USER_ID}:${GROUP_ID} /src && \
-  chown ${USER_ID}:${GROUP_ID} -R /src && \
   chown ${USER_ID}:${GROUP_ID} /cache && \
   chown ${USER_ID}:${GROUP_ID} -R /cache
 
-WORKDIR /src/dash
-
+# We're done, switch back to non-privileged user
 USER dash
diff --git a/contrib/containers/develop/Dockerfile b/contrib/containers/develop/Dockerfile
index 9ced569a454e2..90694d7e443eb 100644
--- a/contrib/containers/develop/Dockerfile
+++ b/contrib/containers/develop/Dockerfile
@@ -41,7 +41,10 @@ RUN set -ex; \
 #
 RUN groupadd docker && \
     usermod -aG sudo dash && \
-    echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
+    echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers; \
+    mkdir -p /home/dash/.config/gdb; \
+    echo "add-auto-load-safe-path /usr/lib/llvm-${LLVM_VERSION}/lib" | tee /home/dash/.config/gdb/gdbinit; \
+    chown ${USER_ID}:${GROUP_ID} -R /home/dash
 
 # Disable noninteractive mode
 ENV DEBIAN_FRONTEND="dialog"

From 7213701995343aacee5d56a1f59b75bc9f9a4ce8 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Thu, 27 Feb 2025 16:53:11 +0000
Subject: [PATCH 05/12] ci: consolidate package installation in `ci` container

They don't need to be done in two separate layers, should save us a bit
of time.
---
 contrib/containers/ci/ci.Dockerfile | 56 +++++++++++++----------------
 1 file changed, 25 insertions(+), 31 deletions(-)

diff --git a/contrib/containers/ci/ci.Dockerfile b/contrib/containers/ci/ci.Dockerfile
index b9839c5ad6915..1aada82e65bf6 100644
--- a/contrib/containers/ci/ci.Dockerfile
+++ b/contrib/containers/ci/ci.Dockerfile
@@ -6,25 +6,44 @@ FROM ./ci-slim.Dockerfile
 # just started configuring this image, give us root access
 USER root
 
-# Install common packages
+# Install packages
 RUN set -ex; \
-    apt-get update && \
-    apt-get install $APT_ARGS \
-    autotools-dev \
-    automake \
+    apt-get update && apt-get install ${APT_ARGS} \
     autoconf \
+    automake \
+    autotools-dev \
+    bc \
     bear \
     bison \
     bsdmainutils \
     ccache \
     cmake \
+    g++-11 \
+    g++-14 \
+    g++-arm-linux-gnueabihf \
+    g++-mingw-w64-x86-64 \
+    gawk \
     gettext \
+    jq \
     libtool \
-    unzip \
+    libz-dev \
     m4 \
+    nsis \
+    parallel \
     pkg-config \
+    python3-zmq \
+    unzip \
+    valgrind \
+    wine-stable \
+    wine64 \
+    zip \
     && rm -rf /var/lib/apt/lists/*
 
+# Make sure std::thread and friends are available
+RUN update-alternatives --set x86_64-w64-mingw32-gcc  /usr/bin/x86_64-w64-mingw32-gcc-posix; \
+    update-alternatives --set x86_64-w64-mingw32-g++  /usr/bin/x86_64-w64-mingw32-g++-posix; \
+    exit 0
+
 # Install Clang + LLVM and set it as default
 RUN set -ex; \
     apt-get update && apt-get install ${APT_ARGS} \
@@ -59,31 +78,6 @@ RUN set -ex; \
     make install -j "$(( $(nproc) - 1 ))"; \
     cd /opt && rm -rf /opt/iwyu;
 
-# Packages needed for all target builds
-RUN apt-get update && apt-get install $APT_ARGS \
-    bc \
-    gawk \
-    g++-11 \
-    g++-14 \
-    g++-arm-linux-gnueabihf \
-    g++-mingw-w64-x86-64 \
-    jq \
-    libz-dev \
-    nsis \
-    python3-zmq \
-    parallel \
-    valgrind \
-    wine-stable \
-    wine64 \
-    zip \
-    && rm -rf /var/lib/apt/lists/*
-
-# Make sure std::thread and friends is available
-RUN \
-  update-alternatives --set x86_64-w64-mingw32-gcc  /usr/bin/x86_64-w64-mingw32-gcc-posix; \
-  update-alternatives --set x86_64-w64-mingw32-g++  /usr/bin/x86_64-w64-mingw32-g++-posix; \
-  exit 0
-
 RUN \
   mkdir -p /cache/ccache && \
   mkdir /cache/depends && \

From 9f3ed19c66941b6bb60b3f820d680bc09eee1946 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Thu, 27 Feb 2025 16:37:49 +0530
Subject: [PATCH 06/12] ci: remove old dependencies, packages not used in
 building or testing

---
 contrib/containers/ci/ci.Dockerfile | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/contrib/containers/ci/ci.Dockerfile b/contrib/containers/ci/ci.Dockerfile
index 1aada82e65bf6..35bc51d32a960 100644
--- a/contrib/containers/ci/ci.Dockerfile
+++ b/contrib/containers/ci/ci.Dockerfile
@@ -24,16 +24,10 @@ RUN set -ex; \
     g++-mingw-w64-x86-64 \
     gawk \
     gettext \
-    jq \
     libtool \
-    libz-dev \
     m4 \
-    nsis \
     parallel \
     pkg-config \
-    python3-zmq \
-    unzip \
-    valgrind \
     wine-stable \
     wine64 \
     zip \

From ac6cde54a3dde5acf3b52a867d493736a9a6ccfd Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Fri, 28 Feb 2025 12:22:57 +0000
Subject: [PATCH 07/12] ci: use slim container for functional tests

---
 .github/workflows/build-container.yml | 31 +++++++++++++++++++--------
 .github/workflows/build.yml           | 28 +++++++++++++++++-------
 2 files changed, 42 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/build-container.yml b/.github/workflows/build-container.yml
index b98fc132d0115..74bae11b1f3b7 100644
--- a/.github/workflows/build-container.yml
+++ b/.github/workflows/build-container.yml
@@ -2,10 +2,23 @@ name: Build container
 
 on:
   workflow_call:
+    inputs:
+      context:
+        description: "Path to use for build context"
+        required: true
+        type: string
+      file:
+        description: "Path to Dockerfile"
+        required: true
+        type: string
+      name:
+        description: "Container name"
+        required: true
+        type: string
     outputs:
       path:
         description: "Path to built container"
-        value: ghcr.io/${{ jobs.build.outputs.repo }}/dashcore-ci-runner:${{ jobs.build.outputs.tag }}
+        value: ghcr.io/${{ jobs.build.outputs.repo }}/${{ inputs.name }}:${{ jobs.build.outputs.tag }}
 
 env:
   DOCKER_DRIVER: overlay2
@@ -44,15 +57,15 @@ jobs:
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
         with:
-          context: ./contrib/containers/ci
-          file: ./contrib/containers/ci/ci.Dockerfile
+          context: ${{ inputs.context }}
+          file: ${{ inputs.file }}
           push: true
           tags: |
-            ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ hashFiles('./contrib/containers/ci/ci.Dockerfile') }}
-            ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ steps.prepare.outputs.tag }}
-            ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:latest
+            ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:${{ hashFiles(inputs.file) }}
+            ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:${{ steps.prepare.outputs.tag }}
+            ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:latest
           cache-from: |
-            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ hashFiles('./contrib/containers/ci/ci.Dockerfile') }}
-            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:${{ steps.prepare.outputs.tag }}
-            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/dashcore-ci-runner:latest
+            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:${{ hashFiles(inputs.file) }}
+            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:${{ steps.prepare.outputs.tag }}
+            type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo }}/${{ inputs.name }}:latest
           cache-to: type=inline
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 296cdb13cf8a5..5b7730e7afef2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,6 +16,18 @@ jobs:
   container:
     name: Build container
     uses: ./.github/workflows/build-container.yml
+    with:
+      context: ./contrib/containers/ci
+      file: ./contrib/containers/ci/ci.Dockerfile
+      name: dashcore-ci-runner
+
+  container-slim:
+    name: Build slim container
+    uses: ./.github/workflows/build-container.yml
+    with:
+      context: ./contrib/containers/ci
+      file: ./contrib/containers/ci/ci-slim.Dockerfile
+      name: dashcore-ci-slim
 
   depends-arm-linux:
     name: arm-linux-gnueabihf
@@ -158,35 +170,35 @@ jobs:
   test-linux64:
     name: linux64-test
     uses: ./.github/workflows/test-src.yml
-    needs: [container, src-linux64]
+    needs: [container-slim, src-linux64]
     with:
       bundle-key: ${{ needs.src-linux64.outputs.key }}
       build-target: linux64
-      container-path: ${{ needs.container.outputs.path }}
+      container-path: ${{ needs.container-slim.outputs.path }}
 
   test-linux64_nowallet:
     name: linux64_nowallet-test
     uses: ./.github/workflows/test-src.yml
-    needs: [container, src-linux64_nowallet]
+    needs: [container-slim, src-linux64_nowallet]
     with:
       bundle-key: ${{ needs.src-linux64_nowallet.outputs.key }}
       build-target: linux64_nowallet
-      container-path: ${{ needs.container.outputs.path }}
+      container-path: ${{ needs.container-slim.outputs.path }}
 
   test-linux64_sqlite:
     name: linux64_sqlite-test
     uses: ./.github/workflows/test-src.yml
-    needs: [container, src-linux64_sqlite]
+    needs: [container-slim, src-linux64_sqlite]
     with:
       bundle-key: ${{ needs.src-linux64_sqlite.outputs.key }}
       build-target: linux64_sqlite
-      container-path: ${{ needs.container.outputs.path }}
+      container-path: ${{ needs.container-slim.outputs.path }}
 
   test-linux64_ubsan:
     name: linux64_ubsan-test
     uses: ./.github/workflows/test-src.yml
-    needs: [container, src-linux64_ubsan]
+    needs: [container-slim, src-linux64_ubsan]
     with:
       bundle-key: ${{ needs.src-linux64_ubsan.outputs.key }}
       build-target: linux64_ubsan
-      container-path: ${{ needs.container.outputs.path }}
+      container-path: ${{ needs.container-slim.outputs.path }}

From 75968c6ee175b6572f5750d2dcae730c34958bb7 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Fri, 28 Feb 2025 12:30:35 +0000
Subject: [PATCH 08/12] ci: avoid making copies when collecting logs, misc.
 script fixes

---
 ci/dash/build_src.sh             | 2 +-
 ci/dash/slim-workspace.sh        | 2 +-
 ci/dash/test_integrationtests.sh | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/ci/dash/build_src.sh b/ci/dash/build_src.sh
index 13be0a761fe5b..5028ea39c9340 100755
--- a/ci/dash/build_src.sh
+++ b/ci/dash/build_src.sh
@@ -77,7 +77,7 @@ if [ "${RUN_TIDY}" = "true" ]; then
     "src/rpc/signmessage.cpp" \
     -p . "${MAKEJOBS}" \
     -- -Xiwyu --cxx17ns -Xiwyu --mapping_file="${BASE_ROOT_DIR}/contrib/devtools/iwyu/bitcoin.core.imp" \
-    |& tee "/tmp/iwyu_ci.out"
+    2>&1 | tee "/tmp/iwyu_ci.out"
   cd src
   fix_includes.py --nosafe_headers < /tmp/iwyu_ci.out
   git --no-pager diff
diff --git a/ci/dash/slim-workspace.sh b/ci/dash/slim-workspace.sh
index 1a3aa3a601896..0ccb4de778306 100755
--- a/ci/dash/slim-workspace.sh
+++ b/ci/dash/slim-workspace.sh
@@ -32,7 +32,7 @@ TARGETS=(
   "build-ci/dashcore-${BUILD_TARGET}/src/qt/qrc_dash_locale.cpp"
 )
 
-# Delete directories we don't need
+# Delete what we don't need
 for target in "${TARGETS[@]}"
 do
   if [[ -d "${target}" ]] || [[ -f "${target}" ]]; then
diff --git a/ci/dash/test_integrationtests.sh b/ci/dash/test_integrationtests.sh
index 86a00c8f1b0ce..ac726522a2cb1 100755
--- a/ci/dash/test_integrationtests.sh
+++ b/ci/dash/test_integrationtests.sh
@@ -64,7 +64,7 @@ if [ "$BASEDIR" != "" ]; then
     for f in $LOGFILES; do
       d2="testlogs/$d/$(dirname $f)"
       mkdir -p $d2
-      cp testdatadirs/$BASEDIR/$d/$f $d2/
+      mv testdatadirs/$BASEDIR/$d/$f $d2/
     done
   done
 fi

From bdbb9d02ce9a98b53ceef4de9a9ba590d82773b8 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Wed, 26 Feb 2025 18:12:07 +0000
Subject: [PATCH 09/12] trivial: `lldbUpdAltArgs` -> `llvmUpdAltArgs`

Fix typo
---
 contrib/containers/ci/ci.Dockerfile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/contrib/containers/ci/ci.Dockerfile b/contrib/containers/ci/ci.Dockerfile
index 35bc51d32a960..7cc4ce9a7d66c 100644
--- a/contrib/containers/ci/ci.Dockerfile
+++ b/contrib/containers/ci/ci.Dockerfile
@@ -53,14 +53,14 @@ RUN set -ex; \
     "lldb-${LLVM_VERSION}"; \
     rm -rf /var/lib/apt/lists/*; \
     echo "Setting defaults..."; \
-    lldbUpdAltArgs="update-alternatives --install /usr/bin/llvm-config llvm-config /usr/bin/llvm-config-${LLVM_VERSION} 100"; \
+    llvmUpdAltArgs="update-alternatives --install /usr/bin/llvm-config llvm-config /usr/bin/llvm-config-${LLVM_VERSION} 100"; \
     for binName in clang clang++ clang-apply-replacements clang-format clang-tidy clangd dsymutil lld lldb lldb-server llvm-ar llvm-cov llvm-nm llvm-objdump llvm-ranlib llvm-strip run-clang-tidy; do \
-        lldbUpdAltArgs="${lldbUpdAltArgs} --slave /usr/bin/${binName} ${binName} /usr/bin/${binName}-${LLVM_VERSION}"; \
+        llvmUpdAltArgs="${llvmUpdAltArgs} --slave /usr/bin/${binName} ${binName} /usr/bin/${binName}-${LLVM_VERSION}"; \
     done; \
     for binName in ld64.lld ld.lld lld-link wasm-ld; do \
-        lldbUpdAltArgs="${lldbUpdAltArgs} --slave /usr/bin/${binName} ${binName} /usr/bin/lld-${LLVM_VERSION}"; \
+        llvmUpdAltArgs="${llvmUpdAltArgs} --slave /usr/bin/${binName} ${binName} /usr/bin/lld-${LLVM_VERSION}"; \
     done; \
-    sh -c "${lldbUpdAltArgs}";
+    sh -c "${llvmUpdAltArgs}";
 # LD_LIBRARY_PATH is empty by default, this is the first entry
 ENV LD_LIBRARY_PATH="/usr/lib/llvm-${LLVM_VERSION}/lib"
 

From 0f173889a724dc0206db62ffd3c208e7a7cb3eed Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Thu, 27 Feb 2025 11:40:03 +0530
Subject: [PATCH 10/12] revert: tentatively drop multiprocess and tsan
 functional tests

reverts:
- 3461c14155f99fa0981b3b412fb4a8b084123d07.
---
 .github/workflows/build.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5b7730e7afef2..53a1d9ef807f2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -176,6 +176,15 @@ jobs:
       build-target: linux64
       container-path: ${{ needs.container-slim.outputs.path }}
 
+  test-linux64_multiprocess:
+    name: linux64_multiprocess-test
+    uses: ./.github/workflows/test-src.yml
+    needs: [container-slim, src-linux64_multiprocess]
+    with:
+      bundle-key: ${{ needs.src-linux64_multiprocess.outputs.key }}
+      build-target: linux64_multiprocess
+      container-path: ${{ needs.container-slim.outputs.path }}
+
   test-linux64_nowallet:
     name: linux64_nowallet-test
     uses: ./.github/workflows/test-src.yml
@@ -194,6 +203,15 @@ jobs:
       build-target: linux64_sqlite
       container-path: ${{ needs.container-slim.outputs.path }}
 
+  test-linux64_tsan:
+    name: linux64_tsan-test
+    uses: ./.github/workflows/test-src.yml
+    needs: [container-slim, src-linux64_tsan]
+    with:
+      bundle-key: ${{ needs.src-linux64_tsan.outputs.key }}
+      build-target: linux64_tsan
+      container-path: ${{ needs.container-slim.outputs.path }}
+
   test-linux64_ubsan:
     name: linux64_ubsan-test
     uses: ./.github/workflows/test-src.yml

From 55a0d0d52b675f2d074941c43de44eacdd697426 Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Fri, 28 Feb 2025 19:01:07 +0000
Subject: [PATCH 11/12] ci: split out `multiprocess` linting to a separate step
 on Actions

---
 .github/workflows/build-src.yml |  8 ++++++++
 ci/dash/build_src.sh            | 25 +++++++------------------
 ci/dash/lint-tidy.sh            | 29 +++++++++++++++++++++++++++++
 3 files changed, 44 insertions(+), 18 deletions(-)
 create mode 100755 ci/dash/lint-tidy.sh

diff --git a/.github/workflows/build-src.yml b/.github/workflows/build-src.yml
index 16a7ed4b4dcda..9af8b19b2e00b 100644
--- a/.github/workflows/build-src.yml
+++ b/.github/workflows/build-src.yml
@@ -87,6 +87,14 @@ jobs:
           ccache -c
         shell: bash
 
+      - name: Run linters
+        if: inputs.build-target == 'linux64_multiprocess'
+        run: |
+          export BUILD_TARGET="${{ inputs.build-target }}"
+          source ./ci/dash/matrix.sh
+          ./ci/dash/lint-tidy.sh
+        shell: bash
+
       - name: Run unit tests
         run: |
           BASE_OUTDIR="/output"
diff --git a/ci/dash/build_src.sh b/ci/dash/build_src.sh
index 5028ea39c9340..3b2aaa7e36022 100755
--- a/ci/dash/build_src.sh
+++ b/ci/dash/build_src.sh
@@ -11,8 +11,7 @@ set -e
 
 source ./ci/dash/matrix.sh
 
-unset CC; unset CXX
-unset DISPLAY
+unset CC CXX DISPLAY;
 
 if [ "$PULL_REQUEST" != "false" ]; then test/lint/commit-script-check.sh $COMMIT_RANGE; fi
 
@@ -51,6 +50,8 @@ make distdir VERSION=$BUILD_TARGET
 cd dashcore-$BUILD_TARGET
 bash -c "./configure $BITCOIN_CONFIG_ALL $BITCOIN_CONFIG" || ( cat config.log && false)
 
+# This step influences compilation and therefore will always be a part of the
+# compile step
 if [ "${RUN_TIDY}" = "true" ]; then
   MAYBE_BEAR="bear --config src/.bear-tidy-config"
   MAYBE_TOKEN="--"
@@ -65,22 +66,10 @@ if [ -n "$USE_VALGRIND" ]; then
     ${BASE_ROOT_DIR}/ci/test/wrap-valgrind.sh
 fi
 
-if [ "${RUN_TIDY}" = "true" ]; then
-  set -eo pipefail
-  cd src
-  ( run-clang-tidy -quiet "${MAKEJOBS}" ) | grep -C5 "error"
-  cd ..
-  iwyu_tool.py \
-    "src/compat" \
-    "src/init" \
-    "src/rpc/fees.cpp" \
-    "src/rpc/signmessage.cpp" \
-    -p . "${MAKEJOBS}" \
-    -- -Xiwyu --cxx17ns -Xiwyu --mapping_file="${BASE_ROOT_DIR}/contrib/devtools/iwyu/bitcoin.core.imp" \
-    2>&1 | tee "/tmp/iwyu_ci.out"
-  cd src
-  fix_includes.py --nosafe_headers < /tmp/iwyu_ci.out
-  git --no-pager diff
+# GitHub Actions can segment a job into steps, linting is a separate step
+# so Actions runners will perform this step separately.
+if [ "${RUN_TIDY}" = "true" ] && [ "${GITHUB_ACTIONS}" != "true" ]; then
+  ${BASE_ROOT_DIR}/ci/dash/lint-tidy.sh
 fi
 
 if [ "$RUN_SECURITY_TESTS" = "true" ]; then
diff --git a/ci/dash/lint-tidy.sh b/ci/dash/lint-tidy.sh
new file mode 100755
index 0000000000000..50b7cc11464f0
--- /dev/null
+++ b/ci/dash/lint-tidy.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Copyright (c) 2025 The Dash Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+set -eo pipefail
+
+# Warning: This script does not generate the compilation database these linters rely
+#          only on nor do they set the requisite build parameters. Make sure you do
+#          that *before* running this script.
+
+cd "${BASE_ROOT_DIR}/build-ci/dashcore-${BUILD_TARGET}/src"
+( run-clang-tidy -quiet "${MAKEJOBS}" ) | grep -C5 "error"
+
+cd "${BASE_ROOT_DIR}/build-ci/dashcore-${BUILD_TARGET}"
+iwyu_tool.py \
+  "src/compat" \
+  "src/init" \
+  "src/rpc/fees.cpp" \
+  "src/rpc/signmessage.cpp" \
+  -p . "${MAKEJOBS}" \
+  -- -Xiwyu --cxx17ns -Xiwyu --mapping_file="${BASE_ROOT_DIR}/contrib/devtools/iwyu/bitcoin.core.imp" \
+  2>&1 | tee "/tmp/iwyu_ci.out"
+
+cd "${BASE_ROOT_DIR}/build-ci/dashcore-${BUILD_TARGET}/src"
+fix_includes.py --nosafe_headers < /tmp/iwyu_ci.out
+git --no-pager diff

From c63f5d848a81c81bd42fbc901c92783f8ca49d1d Mon Sep 17 00:00:00 2001
From: Kittywhiskers Van Gogh <63189531+kwvg@users.noreply.github.com>
Date: Sat, 1 Mar 2025 03:47:58 +0000
Subject: [PATCH 12/12] doc: update container documentation

---
 contrib/containers/README.md | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/contrib/containers/README.md b/contrib/containers/README.md
index 9393053a6ece6..b0a1dea4af170 100644
--- a/contrib/containers/README.md
+++ b/contrib/containers/README.md
@@ -1,27 +1,33 @@
 ## Containers
 
-This directory contains configuration files for containerization utilities.
+This directory contains configuration files for containers. Containers that depends on other containers require BuildKit to
+be enabled in order for syntax extensions to work correctly.
 
-Currently two Docker containers exist, `ci` defines how Dash's GitLab CI container is built and the `dev` builds on top of the `ci` to provide a containerized development environment that is as close as possible to CI for contributors! See also [Dash on Docker Hub](https://hub.docker.com/u/dashpay) i.e. for the [dashd container](https://hub.docker.com/r/dashpay/dashd).
+| Name      | Depends On | Purpose                                                                    |
+| --------- | -----------| -------------------------------------------------------------------------- |
+| `ci-slim` | None       | Slimmed down container used to run functional tests and (some) linters     |
+| `ci`      | `ci-slim`  | Full container used to (cross) compile                                     |
+| `develop` | `ci`       | Interactive environment to allow debugging in an environment that's 1:1 CI |
+| `deploy`  | None       | Packaging of builds for release on Docker Hub                              |
+| `guix`    | None       | Interactive environment for building (and packaging) with Guix             |
 
 ### Usage Guide
 
-We utilise edrevo's [dockerfile-plus](https://github.com/edrevo/dockerfile-plus), a syntax extension that
-leverages Docker [BuildKit](https://docs.docker.com/develop/develop-images/build_enhancements/) to reduce
+We utilise edrevo's [devthefuture/dockerfile-x](https://codeberg.org/devthefuture/dockerfile-x), a syntax extension that
+leverages Docker [BuildKit](https://docs.docker.com/build/buildkit/) to reduce
 the amount of repetitive code.
 
-As BuildKit is opt-in within many currently supported versions of Docker (as of this writing), you need to
-set the following environment variables before continuing. While not needed after the initial `docker compose build`
-(barring updates to the `Dockerfile`), we recommend placing this in your `~/.bash_profile`/`~/.zshrc` or equivalent
+As BuildKit is opt-in within some versions of Docker, you may need to set the following environment variables before
+continuing. While not needed after the initial `docker compose build` (barring updates to the `Dockerfile`), we
+recommend placing this in your `~/.bash_profile`/`~/.zshrc` or equivalent
 
 ```bash
 export DOCKER_BUILDKIT=1
 export COMPOSE_DOCKER_CLI_BUILD=1
 ```
 
-After that, it's simply a matter of building and running your own development container. You can use extensions
-for your IDE like Visual Studio Code's [Remote Containers](https://code.visualstudio.com/docs/remote/containers)
-to run terminal commands from inside the terminal and build Dash Core.
+You can use extensions for your IDE like Visual Studio Code's [Remote Containers](https://code.visualstudio.com/docs/remote/containers)
+to run terminal commands from inside the terminal and work with Dash Core.
 
 ```bash
 cd contrib/containers/develop