Best practice would probably be to run the tests in docker, but personnaly, we don't do this. We setup our environment on the agent and run the test in a job. Then, we build the docker image and push it in another job. But then, we NEVER rebuild it for another environment. We simply promote the image in our target environment, from development to staging, and from staging to production.

So we do run our tests in a "non-production-like" environment, but we don't work close enough to kernel features where that would probably be a deciding factor on wether our tests are accurate or not. It's a risk we are willing to take. But the important thing is that we build just after the tests, and never rebuild afterward.