fix: resolve Dockerfile ponytail issues H1-H4

Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:trixie
+FROM debian:trixie@sha256:d07d1b51c39f51188e60be9b64e6bf769fa94e187f092bc32b91305cfa34ba5a
 
 # Set environment variables
 ENV DEBIAN_FRONTEND=noninteractive
@@ -10,9 +10,6 @@ ENV LINUX_OUT=/artifacts/linux
 # Add arm64 architecture for cross-compilation
 RUN dpkg --add-architecture arm64 && apt-get update
 
-# Upgrade base system
-RUN apt-get upgrade -y
-
 # Prerequisites
 RUN apt-get install -y \
     git \
@@ -51,7 +48,9 @@ RUN apt-get install -y \
     libostree-dev \
     fakemachine
 
-RUN go install -v github.com/go-debos/debos/cmd/debos@latest
+# ponytail: pinned to v1.1.7 — upstream is transitioning subvolume creation support
+# (go-debos/debos#736/62cb992). Re-pin once the transition settles.
+RUN go install -v github.com/go-debos/debos/cmd/debos@v1.1.7
 
 RUN install -m 755 ~/go/bin/debos /usr/local/bin
 
@@ -69,5 +68,11 @@ RUN apt-get clean && rm -rf /var/lib/apt/lists/* ~/.cargo ~/go
 WORKDIR /flipperone-linux-build-scripts
 RUN git clone --depth=1 https://github.com/flipperdevices/flipperone-linux-build-scripts .
 
-# Entry point
-ENTRYPOINT ./build-uboot.sh && ./build-kernel-mainline.sh && ./build-kernel-bsp.sh && ./build-images.sh
+# Entry point — exec-form ENTRYPOINT with entrypoint.sh replaces the old
+# shell-form `ENTRYPOINT ./build-*.sh && ./build-*.sh && ...` inline chain.
+# COPY is required because Docker build context is the repo root; the script
+# gets injected into the WORKDIR alongside the cloned sources.
+COPY entrypoint.sh /flipperone-linux-build-scripts/entrypoint.sh
+RUN chmod +x /flipperone-linux-build-scripts/entrypoint.sh
+ENTRYPOINT ["/bin/bash", "/flipperone-linux-build-scripts/entrypoint.sh"]
+CMD ["all"]

entrypoint.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+set -e
+
+# Determine build target (default: all)
+BUILD_TARGET="${BUILD_TARGET:-all}"
+
+cd /flipperone-linux-build-scripts
+
+case "${BUILD_TARGET}" in
+    all)
+        ./build-uboot.sh
+        ./build-kernel-mainline.sh
+        ./build-kernel-bsp.sh
+        ./build-ospack.sh
+        ./build-rootfs-img.sh
+        ./build-images.sh
+        ./build-dtbo.sh
+        ;;
+    uboot)
+        ./build-uboot.sh
+        ;;
+    kernel-mainline)
+        ./build-kernel-mainline.sh
+        ;;
+    kernel-bsp)
+        ./build-kernel-bsp.sh
+        ;;
+    ospack)
+        ./build-ospack.sh
+        ;;
+    rootfs-img)
+        ./build-rootfs-img.sh
+        ;;
+    images)
+        ./build-images.sh
+        ;;
+    *)
+        echo "Unknown BUILD_TARGET: ${BUILD_TARGET}"
+        echo "Valid targets: all, uboot, kernel-mainline, kernel-bsp, ospack, rootfs-img, images"
+        exit 1
+        ;;
+esac