fix(core): recognize every Docker socket mount shape and provider-syntax models

[PunGrumpy]

Description

Running the 0.5.0 Compose rules against the compose files in docker/compose-for-agents and the mcp-gateway examples showed two misses.

no-docker-socket-mount caught 1 of 5 socket mounts. It compared the volume source against the literal /var/run/docker.sock. Agent stacks rarely write it that way:

volumes:
  - ${DOCKER_SOCK:-/var/run/docker.sock}:/var/run/docker.sock   # mcp-gateway examples; the inner colon also broke split(":")
  - /run/docker.sock:/var/run/docker.sock                        # systemd hosts
  - ~/.docker/run/docker.sock:/var/run/docker.sock               # Docker Desktop on macOS
  - //var/run/docker.sock:/var/run/docker.sock                   # Git Bash on Windows
  - \\.\pipe\docker_engine:\\.\pipe\docker_engine                # Windows named pipe

The rule now resolves ${VAR:-default} to its default, splits the short syntax only at brace depth zero, and matches the socket by basename on any path-shaped source. Named volumes cannot start with /, ., ~, or a drive letter, so they stay clean.

Two deliberate calls:

• A ${VAR} source with no default names no host path. The rule flags it only when the target is /var/run/docker.sock, because that target says what the container expects to find there.
• A lone /var/run/docker.sock entry is an anonymous volume at that path, not a bind mount of the host socket. It was flagged before and is not now.

pin-model-version was silent on the provider syntax. It only walked the top-level models: element. Compose 2.35 to 2.37 bind models through services.*.provider: { type: model, options: { model: … } }, and the compose-for-agents examples still use that form. The rule now collects bindings from both places and reports each on its own line.

Related Issues

N/A. Found while probing the 0.5.0 rules with the mount and model shapes real agent stacks use, as the first patch after the Compose + AI release.

Checklist

• I've reviewed my code
• I've written tests
• I've generated a changeset file, if this changes a published package
• I've updated the docs, if necessary

Screenshots (if applicable)

N/A, CLI output only. The new agent-stack fixture is the before/after: on main it reports nothing, on this branch it reports the socket mount on line 11 and the unpinned provider model on line 27.

Additional Notes

Tested at three layers: unit tests in packages/core for every socket spelling and the clean cases (named volume, ./docker.sock.bak, lone path, unknown source with a non-socket target, type: volume at the socket target), a provider-syntax unit test that also confirms a non-model provider is ignored, and a CLI test over the new fixture that pins rule and line. bun x ultracite check and bun run docs:rules are clean.

Not covered on purpose: Windows drive-letter sources in short syntax (C:\path:/target) split wrong today and did before; nothing in this rule depends on them.

Sibling PR #124 fixes the resource-limits and secret-value misses from the same probe.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docker-doctor	Ready	Preview	Sep 5, 2026 10:31am UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: fc57603

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@docker-doctor/cli	Patch
docker-doctor-kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

The latest Docker Doctor scan for this pull request. Learn more about Docker Doctor.

File	Status	Issues	Updated
Dockerfile	Error	1 error, 2 info	Sep 5, 2026 10:30am UTC

Score: 84 / 100 · Good

3 issues

Dockerfile

• Dockerfile:2 Potential secret found in ENV: 'DB_PASSWORD'. no-secrets-in-env
• Dockerfile:1 No HEALTHCHECK instruction found. require-healthcheck
• Dockerfile:1 No LABEL metadata was found in this Dockerfile. require-labels

_{Scanned by Docker Doctor for commit fc57603.}