Skip to content

v1.4.3: engine-aware docker capability + host-matrix CI

Latest
Latest

Choose a tag to compare

View all tags
@coder-pm coder-pm released this 22 Aug 19:14
v1.4.3
ffa2a8f

The compatibility release. The docker capability now binds the daemon socket where your engine actually runs, so rootless Linux and Colima work instead of pointing at a socket that is not there.

Features

  • Engine-aware docker capability - the socket bind follows the daemon. A VM-backed engine (Docker Desktop, OrbStack, Colima, Rancher Desktop and Lima, on macOS or Linux) gets the in-VM /var/run/docker.sock. A host-local daemon gets its real socket, rootless included (/run/user/<uid>/docker.sock). A remote endpoint gets DOCKER_HOST forwarded. DOCKER_HOST always wins over the active docker context.
  • Loopback tcp counts as local - a daemon reached over tcp://127.0.0.1 (any 127/8 address), localhost in any letter case or [::1] runs on your machine, so the cap binds the host socket instead of handing the box an address that would point at the box itself.
  • TLS remotes warn instead of failing silently - client certificates are host credentials and never enter the cage. When DOCKER_HOST points at a TLS-secured daemon, cleat says the handshake will fail and why, instead of leaving the box to a quiet dead end.

Fixes

  • A missing socket is never bound - the docker cap used to mount /var/run/docker.sock unconditionally. On engines whose socket lives elsewhere, Docker would materialise a phantom directory at that path on the host. The bind is now guarded on a live socket, closing that hazard for good.
  • DOCKER_HOST trailing-slash tolerance - a unix:// endpoint ending in a slash (common from an env file) now resolves to the real socket instead of missing the liveness guard on a running daemon.
  • bash 3.2 strict-mode hardening - the install-shadow scan and cleat status guard BASH_SOURCE under set -u on macOS bash 3.2, with lint-clean quoting in bin/cleat and install.sh.

Changes

  • CI now exercises the whole host matrix - 16 jobs per push: macOS on Apple Silicon and Intel, Ubuntu 22.04, 24.04 and arm64 (the arm64 image is built and booted), Windows via WSL2, real Colima and rootless Docker engines, GNU coreutils on macOS. The macOS suite runs sharded across four parallel runners.
  • The README gained a compatibility matrix and nav badges linking the site.
  • Test infrastructure hardening: the runner trusts bats exit codes so a killed run cannot pass, supports sharding, roots its temp dirs safely on macOS and closes a lock-reclaim race.
  • 2190 (+21) behavioral tests across 56 files. 582 (+20) mutations caught, 0 missed, 0 skipped (583 on a host with inotify-tools).
Assets 3
Loading