The official rust images confusingly have these components linked in $CARGO_HOME/bin, but nothing behind in $RUSTUP_HOME. I laud the desire to keep the images minimal. And also the checking functionalities would seem a must-have for CI/CD.
I don’t know if these tools’ file-modifying features can be turned off. For this scenario that would make sence. And it would make the binaries smaller.
You might think about having a cargo-slim / std variant in the corresponding OS-slim / std images. For symmetry’s sake the same might then need to be done for Alpine.
We have supply-chain safe channels for hub.docker.com and crates.io, but not for rustup. For the latter it is not even clear what would need to be configured on Artifactory. The idea of setting up an https_proxy or even socks, received no love from our admins.
As a workaround we’d be happy enough, if it were just possible to cargo install clippy rustfmt. Somehow that doesn’t seem possible at all. (Or extremely outdated…)
The docker images don't have rustup at all, so there is no $RUSTUP_HOME.
You can pass --check to rustfmt or not pass --fix to clippy. Neither would get smaller from disabling the file modification functionality. For rustfmt it would only skip the final std::fs::write as the checking is done after fully formatting it in memory. And for clippy I suspect it reuses the existing cargo fix of cargo.
I doubt this would help much. Rustc + the C toolchain is way bigger than the base OS. And basically everything other than rustfmt needs a C toolchain to build build script and proc macros.
Rustup has the RUSTUP_DIST_SERVER env var to determine the server to download from. You can download from https://static.rust-lang.org and point rustup to the server you downloaded it to.
Neither clippy nor rustfmt is published to crates.io. They are tied to a single rustc version as they use internal compiler api's that are not available on stable, hence why they are distributed as components for the rust toolchain.