@atomic-chat/core 0.5.1 → 0.13.2

package/dist/runtime/environment/linux-docker-facts.js

@@ -0,0 +1,342 @@
+/**
+ * What `docker info` and the distribution's package database say about this machine's Docker
+ * install, read without running or changing anything.
+ *
+ * `docker info` alone cannot say *how* Docker got here: a `docker-ce` package and a `moby-engine`
+ * package expose the same daemon shape over the same socket. That distinction matters because the
+ * install plan must never lay `docker-ce` over a `moby-engine` or `docker.io` install (design D2:
+ * they conflict at the package-manager level) and must never touch a snap, rootless, Docker
+ * Desktop or Podman-shim install at all. So install-method detection also reads the package
+ * database (`dpkg-query`/`rpm -q`, both read-only queries) and `docker --version`'s own banner,
+ * which is all `podman-docker`'s `docker` shim actually prints differently.
+ *
+ * `docker info`'s own exit code cannot be trusted either: the CLI shipped in docker-ce/docker.io/
+ * moby-engine through roughly 28.2 (which is what Debian, Ubuntu and Fedora's recipe-qualified
+ * releases carry) still exits `0` and prints a fully-formed JSON document when the daemon call
+ * itself failed — `ServerErrors` holds the real error and every other field is the Go zero value
+ * (`""`/`0`/`null`). 28.3 and later exit non-zero instead. `parseDockerInfo` treats the former the
+ * same as the latter (task 2.4 fix round 2, item 1) — the alternative, trusting `code === 0`, was
+ * reading a `docker.io`/`moby-engine` host that plainly refused a connection as reachable, which
+ * broke both relogin detection and runtime-config planning downstream.
+ *
+ * The installed *engine version* (round 3, ruling 5) is a separate signal from any of the above: it
+ * comes from the package database alone (`dpkg-query`'s `${Version}` field, `rpm -q`'s own
+ * name-version-release string, or `pacman -Q docker`), so it is available even when the daemon
+ * cannot be reached at all. Since task 2.23 it is diagnostic only: whether the GPU reaches a
+ * container no longer depends on Docker's CDI-on-by-default version (see `cdiListsNvidiaGpu`).
+ *
+ * The GPU runtime counts as ready only when `nvidia-ctk cdi list` names an `nvidia.com/gpu` device
+ * (task 2.23, finding F-5, ruling R-core-8). Docker 28.2+ serves `--gpus` through CDI, so without a
+ * spec the card never reaches the container — even with a runtime named `nvidia` registered, which
+ * is what this probe used to accept (the 3.10 host: `nvidia-container-toolkit-base` only, `--gpus`
+ * failed with "unresolvable CDI devices"). An older Docker without CDI serves `--gpus` through the
+ * full toolkit's `nvidia-container-runtime-hook` instead; the recipe installs the full toolkit and
+ * generates the spec, so a host it set up passes on either path. A runtime named `nvidia` is still
+ * read (`nvidia_runtime`), but only to decide whether `nvidia-ctk runtime configure` is needed.
+ */
+const ABSENT = {
+    daemon_reachable: false,
+    engine_identity: null,
+    version: null,
+    gpu_runtime: false,
+    nvidia_runtime: false,
+    selinux: false,
+    docker_root_dir: null,
+    containers_running: 0,
+    rootless: false,
+    desktop: false,
+    server_errors: [],
+};
+/**
+ * `nvidia-ctk cdi list`: read-only, and the only way this probe confirms an NVIDIA CDI device actually
+ * exists — the one readiness signal for the GPU runtime (F-5). It reads the spec directories
+ * (`/etc/cdi`, `/var/run/cdi`) itself, so it answers whether or not the daemon does.
+ */
+export function cdiListsNvidiaGpu(cdiList) {
+    return cdiList !== null && cdiList.code === 0 && /nvidia\.com\/gpu/i.test(cdiList.stdout);
+}
+export function daemonJsonNvidiaRuntimeEvidence(read) {
+    if (read.unreadable)
+        return 'unreadable';
+    if (read.text === null)
+        return 'not-configured';
+    try {
+        const parsed = JSON.parse(read.text);
+        return Object.keys(parsed.runtimes ?? {}).includes('nvidia') ? 'configured' : 'not-configured';
+    }
+    catch {
+        return 'unreadable';
+    }
+}
+/** First `X.Y.Z` substring, ignoring any epoch prefix (`5:`) or distro suffix (`-1~noble1`, `.fc41`). */
+function firstSemverLike(text) {
+    const match = /(\d+\.\d+\.\d+)/.exec(text);
+    return match === null ? null : match[1];
+}
+const ENGINE_PACKAGE_NAMES = ['docker-ce', 'docker.io', 'moby-engine'];
+/** `dpkg-query -W -f '${db:Status-Abbrev} ${Package} ${Version}\n' <candidates>`'s third column, for
+ *  whichever recognised engine package is `ii` (installed). */
+export function dpkgEngineVersion(output) {
+    if (output === null)
+        return null;
+    for (const raw of output.stdout.split('\n')) {
+        const match = /^ii\s+(\S+)\s+(.+)$/.exec(raw.trim());
+        if (match === null)
+            continue;
+        if (!ENGINE_PACKAGE_NAMES.includes(match[1]))
+            continue;
+        const version = firstSemverLike(match[2]);
+        if (version !== null)
+            return version;
+    }
+    return null;
+}
+/** `rpm -q <candidates>`'s name-version-release line for whichever recognised engine package hit. */
+export function rpmEngineVersion(output) {
+    if (output === null)
+        return null;
+    for (const raw of output.stdout.split('\n')) {
+        const line = raw.trim();
+        if (line === '' || line.includes('is not installed'))
+            continue;
+        if (!ENGINE_PACKAGE_NAMES.some((name) => line.startsWith(`${name}-`)))
+            continue;
+        const version = firstSemverLike(line);
+        if (version !== null)
+            return version;
+    }
+    return null;
+}
+/**
+ * `pacman -Q docker docker-desktop`: a `name version` line on stdout per installed name (`docker
+ * 1:28.3.3-1`, with Arch's epoch), an `error: package '...' was not found` line on stderr per
+ * missing one, and exit `1` whenever any name is missing — so the exit code says nothing about
+ * whether `docker` itself is installed; only stdout does (round 4, item E).
+ */
+export function pacmanEngineVersion(output) {
+    if (output === null || output.code === null)
+        return null;
+    const match = /^docker\s+(\S+)/m.exec(output.stdout);
+    return match === null ? null : firstSemverLike(match[1]);
+}
+/** The first engine version any of the three package managers can confirm, or null (round 3, ruling 5). */
+export function detectEngineVersion(dpkgQuery, rpmQuery, pacmanQuery) {
+    return dpkgEngineVersion(dpkgQuery) ?? rpmEngineVersion(rpmQuery) ?? pacmanEngineVersion(pacmanQuery);
+}
+const isNonEmptyString = (value) => typeof value === 'string' && value !== '';
+function stringEntries(value) {
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
+}
+/** `ServerErrors` from whatever JSON document a failed call still printed; `[]` when there is none. */
+function serverErrorsOf(stdout) {
+    try {
+        return stringEntries(JSON.parse(stdout).ServerErrors);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * `docker -H unix:///var/run/docker.sock info --format '{{json .}}'`. The `-H` flag pins the
+ * query to the system socket under the current user and overrides both `DOCKER_HOST` and an
+ * active `DOCKER_CONTEXT`, so this reads the same daemon a `docker` group member would reach —
+ * never a user's own rootless daemon or a context pointed elsewhere (spec: "Доступ к Docker MUST
+ * определяться фактическим вызовом daemon по системному сокету... а не пользовательским Docker
+ * context").
+ *
+ * `cdiList` is {@link cdiListsNvidiaGpu}'s source command.
+ */
+export function parseDockerInfo(output, cdiList) {
+    if (output === null || output.code === null)
+        return ABSENT;
+    // docker CLI ≥28.3 exits non-zero on a failed Info() but still prints the templated document, real
+    // error in ServerErrors. Never reachable; the errors are kept for diagnostics the same way the
+    // ≤28.2 exit-0 shape below keeps them (round 4, item 2).
+    if (output.code !== 0)
+        return { ...ABSENT, server_errors: serverErrorsOf(output.stdout) };
+    try {
+        const info = JSON.parse(output.stdout);
+        const serverErrors = stringEntries(info.ServerErrors);
+        const serverVersion = isNonEmptyString(info.ServerVersion) ? info.ServerVersion : null;
+        // docker CLI ≤28.2 (docker.io, moby-engine, and older docker-ce — all on the recipe list) exits
+        // 0 and prints a fully-templated JSON document even when Info() itself failed: ServerErrors
+        // carries the real error, and every other field is the Go zero value. That is a failed call,
+        // not a reachable daemon with an empty version string (round 2, item 1).
+        if (serverErrors.length > 0 && serverVersion === null) {
+            return { ...ABSENT, server_errors: serverErrors };
+        }
+        const runtimes = Object.keys(info.Runtimes ?? {});
+        const securityOptions = stringEntries(info.SecurityOptions);
+        const nameAndOs = `${typeof info.Name === 'string' ? info.Name : ''} ${typeof info.OperatingSystem === 'string' ? info.OperatingSystem : ''}`.toLowerCase();
+        return {
+            daemon_reachable: true,
+            engine_identity: isNonEmptyString(info.ID) ? info.ID : null,
+            version: serverVersion,
+            // CDI alone decides (F-5): a registered `nvidia` runtime without a spec left the card outside
+            // the container on Docker 29. `CDISpecDirs` is not required either — an older daemon with CDI
+            // off serves `--gpus` through the full toolkit's hook, which the recipe installs too.
+            gpu_runtime: cdiListsNvidiaGpu(cdiList),
+            nvidia_runtime: runtimes.includes('nvidia'),
+            selinux: securityOptions.some((option) => option === 'name=selinux' || option.startsWith('name=selinux')),
+            // An empty string is not a path (round 2, item 1): a probe that read '' and fell back to it
+            // literally, instead of to the default install location, would check free space at "".
+            docker_root_dir: isNonEmptyString(info.DockerRootDir) ? info.DockerRootDir : null,
+            containers_running: typeof info.ContainersRunning === 'number' ? info.ContainersRunning : 0,
+            rootless: securityOptions.some((option) => option === 'rootless' || option.startsWith('name=rootless')),
+            desktop: /docker[ -]desktop/.test(nameAndOs),
+            server_errors: serverErrors,
+        };
+    }
+    catch {
+        return ABSENT;
+    }
+}
+/**
+ * `dpkg-query -W -f '${db:Status-Abbrev} ${Package} ${Version}\n' <candidates>`: one line per
+ * package dpkg has ever heard of, prefixed with its status (`ii` installed, `rc` removed with
+ * config left behind, `un` unknown/never installed, ...). Only `ii` counts as actually installed —
+ * `-W` alone (without the status prefix) would also print a `rc` package's name, which is exactly a
+ * package that `apt remove` (not `purge`) took out, and treating that as present would leave a
+ * stale install undetected. A package dpkg has never heard of at all prints nothing to stdout (and
+ * "no packages found matching ..." to stderr instead), which this simply never matches. The
+ * trailing `${Version}` column (round 3, ruling 5) is read by {@link dpkgEngineVersion}; this
+ * function only ever reads the first two.
+ */
+export function installedDpkgPackages(output, candidates) {
+    if (output === null)
+        return [];
+    const installed = new Set();
+    for (const raw of output.stdout.split('\n')) {
+        const match = /^ii\s+(\S+)/.exec(raw.trim());
+        if (match !== null)
+            installed.add(match[1]);
+    }
+    return candidates.filter((name) => installed.has(name));
+}
+/**
+ * `rpm -q <candidates>`: a hit prints the full name-version-release (`docker-ce-3:28.3.0-1.fc41...`)
+ * on its own line; a miss prints `package <name> is not installed` (to stdout, with a non-zero exit
+ * code this parser does not need to check), which this only has to avoid matching.
+ */
+export function installedRpmPackages(output, candidates) {
+    if (output === null)
+        return [];
+    const found = [];
+    for (const raw of output.stdout.split('\n')) {
+        const line = raw.trim();
+        if (line === '' || line.includes('is not installed'))
+            continue;
+        const match = candidates.find((name) => line === name || line.startsWith(`${name}-`));
+        if (match !== undefined && !found.includes(match))
+            found.push(match);
+    }
+    return found;
+}
+/**
+ * `pacman -Q <candidates>`: one `name version` line on stdout per installed name; a missing name
+ * only adds an error line on stderr (and makes the exit code 1, whatever else was found).
+ */
+export function installedPacmanPackages(output, candidates) {
+    if (output === null)
+        return [];
+    const installed = new Set();
+    for (const raw of output.stdout.split('\n')) {
+        const match = /^(\S+)\s+\S+/.exec(raw.trim());
+        if (match !== null)
+            installed.add(match[1]);
+    }
+    return candidates.filter((name) => installed.has(name));
+}
+/** The package the recipe installs, and the only one that counts as the toolkit (F-5). */
+export const TOOLKIT_PACKAGE = 'nvidia-container-toolkit';
+/**
+ * Whether the full NVIDIA Container Toolkit is installed — the `nvidia-container-toolkit` package,
+ * not `nvidia-container-toolkit-base` alone (F-5). `-base` ships `nvidia-ctk` and
+ * `nvidia-container-runtime`, so `nvidia-ctk --version` answers either way; the package database is
+ * what tells them apart. `query` is the family's own single-package query (`dpkg-query -W -f
+ * '${db:Status-Abbrev} ${Package}\n' nvidia-container-toolkit`, `rpm -q nvidia-container-toolkit` or
+ * `pacman -Q nvidia-container-toolkit`), or null on a family without one, where the CLI answering is
+ * all there is to go by.
+ */
+export function fullToolkitInstalled(family, ctkVersion, query) {
+    if (ctkVersion.code !== 0)
+        return false;
+    if (family === null || family === 'other')
+        return true;
+    const candidates = [TOOLKIT_PACKAGE];
+    const found = family === 'apt'
+        ? installedDpkgPackages(query, candidates)
+        : family === 'dnf'
+            ? installedRpmPackages(query, candidates)
+            : installedPacmanPackages(query, candidates);
+    return found.includes(TOOLKIT_PACKAGE);
+}
+/** Arch's own engine package, and Docker Desktop's package on Arch (round 4, item E). */
+export const PACMAN_PACKAGE_CANDIDATES = ['docker', 'docker-desktop'];
+/** `docker-desktop` is Docker Desktop for Linux's own `.deb`/`.rpm` package name (item 5). */
+export const DOCKER_PACKAGE_CANDIDATES = [
+    'docker-ce',
+    'docker.io',
+    'moby-engine',
+    'podman-docker',
+    'docker-desktop',
+];
+/**
+ * How Docker got onto this machine, or null when none of the signals recognise an install.
+ *
+ * Order matters: a `podman-docker` shim or a snap package is decided before anything from `docker
+ * info` (their `docker` command may not even resolve to a real Engine, so `info`'s own answer is
+ * not trusted over the package database for these).
+ *
+ * Desktop is decided next, but only two ways (round 2, item 4 — the previous order blocked a
+ * working Desktop+Engine host that also happened to have the `docker-desktop` package installed
+ * alongside a real, reachable `docker-ce`): `info.desktop` when the daemon that actually answered
+ * says so directly, or the `docker-desktop` package **only when the system socket did not answer at
+ * all and no recognised engine package is also present** — a reachable `docker-ce`/`moby-engine`/
+ * `docker.io` always wins over a Desktop package that merely happens to be installed alongside it.
+ *
+ * `rootlessSocketPresent` (a leftover `$XDG_RUNTIME_DIR/docker.sock`) only counts when the system
+ * socket itself did not answer *and* `docker.service` is not active either (round 2, item 8) — a
+ * working rootful engine, or one that is simply unreachable for some other reason while the service
+ * is confirmed running, takes priority over a stray rootless socket file from an earlier, abandoned
+ * setup.
+ *
+ * Arch's own `docker` package never becomes an install method here (it is not a
+ * `LinuxDockerInstallMethod`; `assessLinux` recognises it through `distribution.family === 'pacman'
+ * && docker.cli` instead, round 3 item 1). It does count as an installed engine for the Desktop rule
+ * above, and `pacman -Q docker-desktop` counts as the Desktop package, so a Desktop-only Arch host is
+ * read as Docker Desktop, not as an unrecognised install (round 4, item E).
+ */
+export function detectDockerInstallMethod(info, packages, rootlessSocketPresent, serviceActive) {
+    if (packages.dockerVersion !== null &&
+        packages.dockerVersion.code === 0 &&
+        /podman/i.test(packages.dockerVersion.stdout)) {
+        return 'podman-docker';
+    }
+    const found = new Set([
+        ...installedDpkgPackages(packages.dpkgQuery, DOCKER_PACKAGE_CANDIDATES),
+        ...installedRpmPackages(packages.rpmQuery, DOCKER_PACKAGE_CANDIDATES),
+        ...installedPacmanPackages(packages.pacmanQuery, PACMAN_PACKAGE_CANDIDATES),
+    ]);
+    if (found.has('podman-docker'))
+        return 'podman-docker';
+    if (packages.snapList !== null && packages.snapList.code === 0 && /docker/.test(packages.snapList.stdout)) {
+        return 'snap';
+    }
+    const engineInstalled = found.has('docker-ce') || found.has('moby-engine') || found.has('docker.io') || found.has('docker');
+    if (info.desktop)
+        return 'docker-desktop';
+    if (found.has('docker-desktop') && !info.daemon_reachable && !engineInstalled)
+        return 'docker-desktop';
+    if (info.rootless || (!info.daemon_reachable && rootlessSocketPresent && serviceActive !== true)) {
+        return 'rootless';
+    }
+    if (found.has('docker-ce'))
+        return 'docker-ce';
+    if (found.has('moby-engine'))
+        return 'moby-engine';
+    if (found.has('docker.io'))
+        return 'docker.io';
+    return null;
+}
+//# sourceMappingURL=linux-docker-facts.js.map

package/dist/runtime/environment/linux-docker-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-docker-facts.js","sourceRoot":"","sources":["../../../src/runtime/environment/linux-docker-facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAuCH,MAAM,MAAM,GAAoB;IAC9B,gBAAgB,EAAE,KAAK;IACvB,eAAe,EAAE,IAAI;IACrB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,KAAK;IACd,eAAe,EAAE,IAAI;IACrB,kBAAkB,EAAE,CAAC;IACrB,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;IACd,aAAa,EAAE,EAAE;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA6B;IAC7D,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAC3F,CAAC;AAoBD,MAAM,UAAU,+BAA+B,CAAC,IAG/C;IACC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,YAAY,CAAA;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAA2C,CAAA;QAC9E,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAA;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAA;IACrB,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,CAAA;AACrD,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;AAEtE;+DAC+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,MAA4B;IAC5D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACpD,IAAI,KAAK,KAAK,IAAI;YAAE,SAAQ;QAC5B,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC;YAAE,SAAQ;QAChE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAA;QACnD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAA;IACtC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAC,MAA4B;IAC3D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAAE,SAAQ;QAC9D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YAAE,SAAQ;QAC/E,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAA;IACtC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAA;AACpE,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,mBAAmB,CACjC,SAA+B,EAC/B,QAA8B,EAC9B,WAAiC;IAEjC,OAAO,iBAAiB,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAA;AACvG,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAA;AAEvG,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACxG,CAAC;AAED,uGAAuG;AACvG,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,CAAC;QACH,OAAO,aAAa,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAgC,CAAC,YAAY,CAAC,CAAA;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA4B,EAC5B,OAA6B;IAE7B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IAC1D,mGAAmG;IACnG,+FAA+F;IAC/F,yDAAyD;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;IACzF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAUpC,CAAA;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;QAEtF,gGAAgG;QAChG,4FAA4F;QAC5F,6FAA6F;QAC7F,yEAAyE;QACzE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YACtD,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;QACnD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QACjD,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IACjE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EACpE,EAAE,CAAC,WAAW,EAAE,CAAA;QAChB,OAAO;YACL,gBAAgB,EAAE,IAAI;YACtB,eAAe,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YAC3D,OAAO,EAAE,aAAa;YACtB,8FAA8F;YAC9F,8FAA8F;YAC9F,sFAAsF;YACtF,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACvC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3C,OAAO,EAAE,eAAe,CAAC,IAAI,CAC3B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAC3E;YACD,4FAA4F;YAC5F,uFAAuF;YACvF,eAAe,EAAE,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;YACjF,kBAAkB,EAAE,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC3F,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YACvG,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;YAC5C,aAAa,EAAE,YAAY;SAC5B,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA4B,EAAE,UAAoB;IACtF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5C,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B,EAAE,UAAoB;IACrF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAAE,SAAQ;QAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAA;QACrF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA4B,EAAE,UAAoB;IACxF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAA;AAEzD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAiD,EACjD,UAAyB,EACzB,KAA2B;IAE3B,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,UAAU,GAAG,CAAC,eAAe,CAAC,CAAA;IACpC,MAAM,KAAK,GACT,MAAM,KAAK,KAAK;QACd,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC;QAC1C,CAAC,CAAC,MAAM,KAAK,KAAK;YAChB,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC;YACzC,CAAC,CAAC,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAClD,OAAO,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;AACxC,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;AAcrE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,WAAW;IACX,WAAW;IACX,aAAa;IACb,eAAe;IACf,gBAAgB;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAqB,EACrB,QAA8B,EAC9B,qBAA8B,EAC9B,aAAkC;IAElC,IACE,QAAQ,CAAC,aAAa,KAAK,IAAI;QAC/B,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAC7C,CAAC;QACD,OAAO,eAAe,CAAA;IACxB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;QACpB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;QACvE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;QACrE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;KAC5E,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,eAAe,CAAA;IACtD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1G,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,eAAe,GACnB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrG,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,gBAAgB,CAAA;IACzC,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,eAAe;QAAE,OAAO,gBAAgB,CAAA;IACtG,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,IAAI,aAAa,KAAK,IAAI,CAAC,EAAE,CAAC;QACjG,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAA;IAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,aAAa,CAAA;IAClD,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAA;IAC9C,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/runtime/environment/linux-docker-network.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Whether Docker will find an address range for its default bridge on this machine (task 2.23,
+ * finding F-4), read before anything is installed or started.
+ *
+ * When `dockerd` starts it gives the `docker0` bridge the first subnet of its predefined pools that
+ * overlaps no route in the host's routing table. A full-tunnel VPN (`0.0.0.0/1` and `128.0.0.0/1`
+ * through `tun*`, the 3.10 acceptance host) overlaps all of them, and the daemon exits with "all
+ * predefined address pools have been fully subnetted" — the recipe's `docker-service` step fails after
+ * the user consented, and systemd parks the unit in `start-limit-hit`. `bip` or `default-address-pools`
+ * in `/etc/docker/daemon.json` replace that search, so either one set means the user already chose.
+ *
+ * The routes come from `/proc/net/route`: the kernel's main IPv4 table, the one Docker's own overlap
+ * check reads (netlink `RouteList` without a table filter), always present, no binary on `PATH`
+ * needed. The default route has no destination network and never counts; Docker skips it too.
+ *
+ * The pools are Docker's compiled-in defaults, moby `libnetwork/ipamutils/utils.go`
+ * (`localScopeDefaultNetworks`): `172.17.0.0/16`, `172.18.0.0/16`, `172.19.0.0/16`,
+ * `172.20.0.0/14`, `172.24.0.0/14` and `172.28.0.0/14` split into /16s, and `192.168.0.0/16` split
+ * into /20s — 31 candidate subnets.
+ *
+ * Pure: the probe reads the file and `daemon.json`, `assessLinux` turns the answer into a plan
+ * warning (never a blocker: the VPN may be switched off, and the fix is the user's own
+ * configuration, which the recipe never edits).
+ */
+/** An IPv4 network as a 32-bit unsigned address and a prefix length. */
+export interface Ipv4Cidr {
+    address: number;
+    prefix: number;
+}
+/** `a.b.c.d/n`, or a bare address as a /32. Null for anything else (IPv6, `default`, out of range). */
+export declare function parseIpv4Cidr(text: string): Ipv4Cidr | null;
+/** Every subnet Docker would try for a network, in its own order. */
+export declare const DOCKER_DEFAULT_POOL_SUBNETS: readonly string[];
+/** One route of the main IPv4 table: its destination in CIDR form and the interface it goes out of. */
+export interface LinuxRoute {
+    destination: string;
+    device: string;
+}
+/**
+ * The routes of `/proc/net/route` (main IPv4 table), the default route left out. Null when the file
+ * could not be read — an unread table is no evidence either way.
+ */
+export declare function parseProcNetRoute(text: string | null): LinuxRoute[] | null;
+/**
+ * The routes that leave Docker no default subnet, or null when some default subnet is still free —
+ * Docker then just takes that one.
+ *
+ * Only the routes that cause it are returned (task 2.23, review round 1): the smallest set, chosen
+ * greedily, that covers every pool — the route covering the most pools still uncovered first, a
+ * wider one first on a tie — returned in the table's order. A full-tunnel VPN's `128.0.0.0/1` alone covers all 31, so the home LAN
+ * inside `192.168.0.0/20` beside it is not named: it is not what a person has to change.
+ */
+export declare function routesCoveringDockerPools(routes: readonly LinuxRoute[]): LinuxRoute[] | null;
+/**
+ * Whether `/etc/docker/daemon.json` sets `bip` or `default-address-pools`, either of which replaces
+ * Docker's default pool search. `'unknown'` when the file exists but could not be read or parsed.
+ */
+export declare function daemonJsonSetsAddressPools(read: {
+    text: string | null;
+    unreadable: boolean;
+}): boolean | 'unknown';
+/** A plan warning: shown before consent, never blocks it, and never part of `plan_digest`. */
+export interface LinuxPlanWarning {
+    code: 'docker-address-pools-overlap-routes';
+    text: string;
+    params?: Record<string, string>;
+}
+/** What a person does about it; the same words in the plan warning and in the failed step's error. */
+export declare const DOCKER_ADDRESS_POOLS_INSTRUCTION: string;
+/**
+ * The F-4 warning: Docker is not running yet (not installed, or its service inactive), every default
+ * subnet overlaps a non-default route, and `daemon.json` sets neither `bip` nor
+ * `default-address-pools`. Anything this probe could not read suppresses it rather than guessing.
+ * `params.routes` and `params.devices` name only the routes that cause it (`routesCoveringDockerPools`).
+ */
+export declare function dockerAddressPoolWarning(input: {
+    dockerRunning: boolean;
+    addressPoolsConfigured: boolean | 'unknown';
+    routes: readonly LinuxRoute[] | null;
+}): LinuxPlanWarning | null;

package/dist/runtime/environment/linux-docker-network.js

@@ -0,0 +1,195 @@
+/**
+ * Whether Docker will find an address range for its default bridge on this machine (task 2.23,
+ * finding F-4), read before anything is installed or started.
+ *
+ * When `dockerd` starts it gives the `docker0` bridge the first subnet of its predefined pools that
+ * overlaps no route in the host's routing table. A full-tunnel VPN (`0.0.0.0/1` and `128.0.0.0/1`
+ * through `tun*`, the 3.10 acceptance host) overlaps all of them, and the daemon exits with "all
+ * predefined address pools have been fully subnetted" — the recipe's `docker-service` step fails after
+ * the user consented, and systemd parks the unit in `start-limit-hit`. `bip` or `default-address-pools`
+ * in `/etc/docker/daemon.json` replace that search, so either one set means the user already chose.
+ *
+ * The routes come from `/proc/net/route`: the kernel's main IPv4 table, the one Docker's own overlap
+ * check reads (netlink `RouteList` without a table filter), always present, no binary on `PATH`
+ * needed. The default route has no destination network and never counts; Docker skips it too.
+ *
+ * The pools are Docker's compiled-in defaults, moby `libnetwork/ipamutils/utils.go`
+ * (`localScopeDefaultNetworks`): `172.17.0.0/16`, `172.18.0.0/16`, `172.19.0.0/16`,
+ * `172.20.0.0/14`, `172.24.0.0/14` and `172.28.0.0/14` split into /16s, and `192.168.0.0/16` split
+ * into /20s — 31 candidate subnets.
+ *
+ * Pure: the probe reads the file and `daemon.json`, `assessLinux` turns the answer into a plan
+ * warning (never a blocker: the VPN may be switched off, and the fix is the user's own
+ * configuration, which the recipe never edits).
+ */
+/** Docker's default local pools: each `base` is split into subnets of `/size` (see the header). */
+const DOCKER_DEFAULT_POOLS = [
+    { base: '172.17.0.0/16', size: 16 },
+    { base: '172.18.0.0/16', size: 16 },
+    { base: '172.19.0.0/16', size: 16 },
+    { base: '172.20.0.0/14', size: 16 },
+    { base: '172.24.0.0/14', size: 16 },
+    { base: '172.28.0.0/14', size: 16 },
+    { base: '192.168.0.0/16', size: 20 },
+];
+const toDotted = (address) => [address >>> 24, (address >>> 16) & 0xff, (address >>> 8) & 0xff, address & 0xff].join('.');
+const format = (cidr) => `${toDotted(cidr.address)}/${cidr.prefix}`;
+const maskOf = (prefix) => (prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0);
+/** `a.b.c.d/n`, or a bare address as a /32. Null for anything else (IPv6, `default`, out of range). */
+export function parseIpv4Cidr(text) {
+    const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})(?:\/(\d{1,2}))?$/.exec(text.trim());
+    if (match === null)
+        return null;
+    const octets = match.slice(1, 5).map(Number);
+    const prefix = match[5] === undefined ? 32 : Number(match[5]);
+    if (octets.some((octet) => octet > 255) || prefix > 32)
+        return null;
+    const address = ((octets[0] << 24) |
+        (octets[1] << 16) |
+        (octets[2] << 8) |
+        octets[3]) >>>
+        0;
+    return { address: (address & maskOf(prefix)) >>> 0, prefix };
+}
+/** Every subnet Docker would try for a network, in its own order. */
+export const DOCKER_DEFAULT_POOL_SUBNETS = DOCKER_DEFAULT_POOLS.flatMap(({ base, size }) => {
+    const pool = parseIpv4Cidr(base);
+    const count = 2 ** (size - pool.prefix);
+    const step = 2 ** (32 - size);
+    return Array.from({ length: count }, (_, index) => format({ address: pool.address + index * step, prefix: size }));
+});
+/** Two networks overlap when the wider one contains the other's network address. */
+function overlaps(a, b) {
+    const mask = maskOf(Math.min(a.prefix, b.prefix));
+    return (a.address & mask) >>> 0 === (b.address & mask) >>> 0;
+}
+/** One `/proc/net/route` hex field (the kernel prints the network-order word as a host-order number). */
+function hexWord(field) {
+    if (field === undefined || !/^[0-9A-Fa-f]{8}$/.test(field))
+        return null;
+    const value = Number.parseInt(field, 16);
+    // Both supported architectures (x86_64, aarch64) are little-endian: the first octet is the low byte.
+    return ((((value & 0xff) << 24) |
+        (((value >>> 8) & 0xff) << 16) |
+        (((value >>> 16) & 0xff) << 8) |
+        (value >>> 24)) >>>
+        0);
+}
+const prefixOf = (mask) => {
+    let bits = 0;
+    while (bits < 32 && ((mask << bits) & 0x80000000) !== 0)
+        bits += 1;
+    return bits;
+};
+/**
+ * The routes of `/proc/net/route` (main IPv4 table), the default route left out. Null when the file
+ * could not be read — an unread table is no evidence either way.
+ */
+export function parseProcNetRoute(text) {
+    if (text === null)
+        return null;
+    const routes = [];
+    for (const raw of text.split('\n').slice(1)) {
+        const fields = raw.trim().split(/\s+/);
+        const destination = hexWord(fields[1]);
+        const mask = hexWord(fields[7]);
+        if (destination === null || mask === null)
+            continue;
+        const prefix = prefixOf(mask);
+        if (prefix === 0)
+            continue; // the default route
+        routes.push({
+            destination: format({ address: (destination & maskOf(prefix)) >>> 0, prefix }),
+            device: fields[0],
+        });
+    }
+    return routes;
+}
+/**
+ * The routes that leave Docker no default subnet, or null when some default subnet is still free —
+ * Docker then just takes that one.
+ *
+ * Only the routes that cause it are returned (task 2.23, review round 1): the smallest set, chosen
+ * greedily, that covers every pool — the route covering the most pools still uncovered first, a
+ * wider one first on a tie — returned in the table's order. A full-tunnel VPN's `128.0.0.0/1` alone covers all 31, so the home LAN
+ * inside `192.168.0.0/20` beside it is not named: it is not what a person has to change.
+ */
+export function routesCoveringDockerPools(routes) {
+    const pools = DOCKER_DEFAULT_POOL_SUBNETS.map((subnet) => parseIpv4Cidr(subnet));
+    const candidates = routes.flatMap((route) => {
+        const cidr = parseIpv4Cidr(route.destination);
+        if (cidr === null || cidr.prefix === 0)
+            return [];
+        const covers = pools.filter((pool) => overlaps(cidr, pool));
+        return covers.length === 0 ? [] : [{ route, cidr, covers }];
+    });
+    const uncovered = new Set(pools);
+    const chosen = [];
+    while (uncovered.size > 0) {
+        let best = null;
+        let bestCount = 0;
+        for (const candidate of candidates) {
+            const count = candidate.covers.filter((pool) => uncovered.has(pool)).length;
+            if (count > bestCount ||
+                (count === bestCount && count > 0 && best !== null && candidate.cidr.prefix < best.cidr.prefix)) {
+                best = candidate;
+                bestCount = count;
+            }
+        }
+        if (best === null)
+            return null;
+        chosen.push(best.route);
+        for (const pool of best.covers)
+            uncovered.delete(pool);
+    }
+    // In the table's own order, whichever order they were picked in.
+    return routes.filter((route) => chosen.includes(route));
+}
+/**
+ * Whether `/etc/docker/daemon.json` sets `bip` or `default-address-pools`, either of which replaces
+ * Docker's default pool search. `'unknown'` when the file exists but could not be read or parsed.
+ */
+export function daemonJsonSetsAddressPools(read) {
+    if (read.unreadable)
+        return 'unknown';
+    if (read.text === null)
+        return false;
+    try {
+        const parsed = JSON.parse(read.text);
+        const bip = typeof parsed.bip === 'string' && parsed.bip.trim() !== '';
+        const pools = Array.isArray(parsed['default-address-pools']) && parsed['default-address-pools'].length > 0;
+        return bip || pools;
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/** What a person does about it; the same words in the plan warning and in the failed step's error. */
+export const DOCKER_ADDRESS_POOLS_INSTRUCTION = "Exclude Docker's ranges (172.17.0.0/16 to 172.31.0.0/16 and 192.168.0.0/16) from the VPN, or set " +
+    '"default-address-pools" (or "bip") in /etc/docker/daemon.json to a range no route uses, before continuing.';
+/**
+ * The F-4 warning: Docker is not running yet (not installed, or its service inactive), every default
+ * subnet overlaps a non-default route, and `daemon.json` sets neither `bip` nor
+ * `default-address-pools`. Anything this probe could not read suppresses it rather than guessing.
+ * `params.routes` and `params.devices` name only the routes that cause it (`routesCoveringDockerPools`).
+ */
+export function dockerAddressPoolWarning(input) {
+    if (input.dockerRunning || input.addressPoolsConfigured !== false || input.routes === null)
+        return null;
+    const covering = routesCoveringDockerPools(input.routes);
+    if (covering === null)
+        return null;
+    const named = covering.map((route) => `${route.destination} via ${route.device}`).join(', ');
+    const devices = [...new Set(covering.map((route) => route.device))];
+    return {
+        code: 'docker-address-pools-overlap-routes',
+        text: `Docker will not be able to start: the route${covering.length > 1 ? 's' : ''} ${named} ` +
+            `(often a full-tunnel VPN) cover${covering.length > 1 ? '' : 's'} every address range Docker uses ` +
+            `for its networks by default. ${DOCKER_ADDRESS_POOLS_INSTRUCTION}`,
+        params: {
+            routes: covering.map((route) => route.destination).join(','),
+            devices: devices.join(','),
+        },
+    };
+}
+//# sourceMappingURL=linux-docker-network.js.map

package/dist/runtime/environment/linux-docker-network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-docker-network.js","sourceRoot":"","sources":["../../../src/runtime/environment/linux-docker-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,mGAAmG;AACnG,MAAM,oBAAoB,GAAkD;IAC1E,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE;IACnC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE;IACnC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE;IACnC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE;IACnC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE;IACnC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE;IACnC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE;CACrC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAU,EAAE,CAC3C,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE7F,MAAM,MAAM,GAAG,CAAC,IAAc,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAA;AAErF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAEnG,uGAAuG;AACvG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9F,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAA;IACnE,MAAM,OAAO,GACX,CAAC,CAAE,MAAM,CAAC,CAAC,CAAY,IAAI,EAAE,CAAC;QAC5B,CAAE,MAAM,CAAC,CAAC,CAAY,IAAI,EAAE,CAAC;QAC7B,CAAE,MAAM,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAY,CAAC;QACxB,CAAC,CAAA;IACH,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC9D,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,2BAA2B,GAAsB,oBAAoB,CAAC,OAAO,CACxF,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;IACjB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAa,CAAA;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IAC7B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAChD,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC/D,CAAA;AACH,CAAC,CACF,CAAA;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,CAAW,EAAE,CAAW;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACjD,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED,yGAAyG;AACzG,SAAS,OAAO,CAAC,KAAyB;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACxC,qGAAqG;IACrG,OAAO,CACL,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QACjB,CAAC,CACF,CAAA;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;IACxC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,OAAO,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;QAAE,IAAI,IAAI,CAAC,CAAA;IAClE,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAQD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/B,IAAI,WAAW,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,SAAQ;QACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,MAAM,KAAK,CAAC;YAAE,SAAQ,CAAC,oBAAoB;QAC/C,MAAM,CAAC,IAAI,CAAC;YACV,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAC9E,MAAM,EAAE,MAAM,CAAC,CAAC,CAAW;SAC5B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAA6B;IACrE,MAAM,KAAK,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAa,CAAC,CAAA;IAC5F,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC3D,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,IAAI,GAAuC,IAAI,CAAA;QACnD,IAAI,SAAS,GAAG,CAAC,CAAA;QACjB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;YAC3E,IACE,KAAK,GAAG,SAAS;gBACjB,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAC/F,CAAC;gBACD,IAAI,GAAG,SAAS,CAAA;gBAChB,SAAS,GAAG,KAAK,CAAA;YACnB,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD,CAAC;IACD,iEAAiE;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAG1C;IACC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACrC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAA2D,CAAA;QAC9F,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,MAAM,CAAC,uBAAuB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;QAC1G,OAAO,GAAG,IAAI,KAAK,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AASD,sGAAsG;AACtG,MAAM,CAAC,MAAM,gCAAgC,GAC3C,mGAAmG;IACnG,4GAA4G,CAAA;AAE9G;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACC,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,sBAAsB,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACvG,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACxD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5F,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACnE,OAAO;QACL,IAAI,EAAE,qCAAqC;QAC3C,IAAI,EACF,8CAA8C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,GAAG;YACxF,kCAAkC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,mCAAmC;YACnG,gCAAgC,gCAAgC,EAAE;QACpE,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5D,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;SAC3B;KACF,CAAA;AACH,CAAC"}