Improve robustness, security, and CI-friendliness of run-tests-in-docker.sh

Start by reading bin/run-tests-in-docker.sh and trace its Docker build and run paths. Check how it behaves from a different working directory and how container failures are returned in CI. Done means the requested shell safety, path handling, reproducibility, isolation, read-only mounts, exit-code propagation, and logging changes are covered without changing the script interface.

Description

The bin/run-tests-in-docker.sh script currently works well for local testing, but it can be made more robust, secure, and CI-friendly with a few targeted improvements. These changes align the script more closely with production-grade container execution and common best practices for infrastructure scripts.

Motivation

Improve failure detection and error handling in CI environments

Make the script resilient to being executed from any working directory

Strengthen container sandboxing to better mirror Exercism’s production runner

Improve reproducibility and debuggability for contributors

Proposed Improvements

Stricter shell safety

Use #!/usr/bin/env bash with set -Eeuo pipefail instead of relying solely on -e

Path robustness

Resolve the project root dynamically instead of relying on $PWD

Ensures the script works correctly when executed from any directory or CI runner

More reproducible Docker builds

Add --pull and --no-cache to docker build to avoid stale base images

Stronger container isolation

Add resource limits and security flags:

--pids-limit

--memory

--cpus

--security-opt no-new-privileges

Better reflects the sandboxing used in production test runners

Read-only bind mounts

Mount test data and scripts as read-only to prevent accidental mutation

Explicit exit-code handling

Capture and propagate the container exit code to ensure CI fails correctly on test errors

Lightweight logging

Add clear, minimal log messages to improve traceability during CI failures

Benefits

More reliable CI behavior

Clearer failure modes and logs

Improved security posture of the Docker execution

Easier local and automated testing for contributors

Better alignment with Exercism’s production environment

Backwards Compatibility

These changes do not alter the external behavior of the script or its interface.
They only improve safety, clarity, and reliability.