ci: add reusable headless Docker build environment

ddk-parent/pom.xml

@@ -474,6 +474,21 @@
         <osgi.arch>x86_64</osgi.arch>
       </properties>
     </profile>
+    <profile>
+      <activation>
+        <os>
+          <name>linux</name>
+          <arch>aarch64</arch>
+          <family>unix</family>
+        </os>
+      </activation>
+      <id>64bit_linux_aarch64</id>
+      <properties>
+        <osgi.os>linux</osgi.os>
+        <osgi.ws>gtk</osgi.ws>
+        <osgi.arch>aarch64</osgi.arch>
+      </properties>
+    </profile>
     <profile>
       <id>macosx</id>
       <activation>

docker/.gitignore

@@ -0,0 +1 @@
+*.local

docker/Dockerfile

@@ -0,0 +1,31 @@
+FROM maven:3.9-eclipse-temurin-21
+
+# Install Xvfb and the GTK libraries required by Eclipse/SWT UI tests.
+# libgtk-3-0 covers the current DDK target platform; libgtk-4-1 is kept
+# as a fallback for newer Eclipse releases.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        xvfb \
+        libgtk-3-0 \
+        libgtk-4-1 \
+        libglib2.0-0 \
+        libpango-1.0-0 \
+        libcairo2 \
+        libatk1.0-0 \
+        libatk-bridge2.0-0 \
+        libgdk-pixbuf2.0-0 \
+        libepoxy0 \
+        libxcomposite1 \
+        libxdamage1 \
+        libxfixes3 \
+        libxrandr2 \
+        libxrender1 \
+        libxtst6 \
+        libxi6 \
+        libgbm1 \
+        libasound2t64 \
+        libxkbcommon0 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Default working directory for mounted DDK workspace.
+WORKDIR /workspace

docker/README.md

@@ -0,0 +1,57 @@
+# DDK Docker Build Environment
+
+Reusable Docker image for building and testing DSL DevKit in a Linux container.
+
+## Build the image
+
+```bash
+docker build -t ddk-build docker/
+```
+
+If your environment blocks `docker.io`, create a `docker/Dockerfile.local` (gitignored) that is identical to `Dockerfile` except for the first line, pointing `FROM` at a mirror of the base image available on your network:
+
+```dockerfile
+FROM <your-registry-mirror>/maven:3.9-eclipse-temurin-21
+```
+
+and build from that instead:
+
+```bash
+docker build -t ddk-build -f docker/Dockerfile.local docker/
+```
+
+## Run the full CI suite
+
+From the repository root:
+
+```bash
+docker run --rm -it --init \
+  -v "$(pwd):/workspace" \
+  -w /workspace \
+  ddk-build \
+  xvfb-run mvn clean verify checkstyle:check pmd:pmd pmd:cpd pmd:check pmd:cpd-check spotbugs:check \
+    -f ./ddk-parent/pom.xml --batch-mode --fail-at-end -T 2C
+```
+
+`--init` is required: without it `xvfb-run` runs as PID 1 inside the container, never receives Xvfb's readiness signal (PID 1 ignores signals without installed handlers), and `mvn` is never started — the container hangs silently.
+
+To cache Maven and p2 downloads between runs (each fresh container otherwise re-downloads everything), add `-v ddk-m2:/root/.m2` to the `docker run` command.
+
+> **Windows / MSYS note:** mount with an absolute Windows path (e.g. `-v "C:\dev\dsl-devkit:/workspace"`) and set `MSYS_NO_PATHCONV=1` so Docker receives Unix-style container paths such as `/workspace` instead of translated Windows paths.
+
+> **Git worktree note:** mount a full clone, not a linked worktree. A worktree's `.git` file points at the parent clone outside the mount, so Tycho's `build-qualifier` fails with `repository not found`. If you must build from a worktree, additionally mount the parent clone's `.git` directory at the same absolute path it has on the host.
+
+## TLS-intercepting networks
+
+If the build fails to resolve Eclipse p2 or Maven repositories with `PKIX path building failed`, import your organization's CA bundle into the container's Java truststore:
+
+```bash
+docker cp ca-bundle.pem <container>:/tmp/ca-bundle.pem
+docker exec <container> keytool -importcert -trustcacerts -alias corporate-ca \
+  -file /tmp/ca-bundle.pem -keystore /opt/java/openjdk/lib/security/cacerts \
+  -storepass changeit -noprompt
+```
+
+## Base image
+
+- `maven:3.9-eclipse-temurin-21` (Docker Hub)