@celilo/e2e 0.19.2 → 0.20.0

package/src/docker-compose-generator.ts

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
 import { basename, join } from 'node:path';
-import { stringify } from 'yaml';
+import { parse as parseYaml, stringify } from 'yaml';
 import { normalizeObservers, observerEnv, observerPlacement } from './observer';
 import { PROXMOX_SIM_IP, SIMULATOR_IPS } from './simulator-ips';
 import type { MachineSpec, NetworkConfig, TopologyPreset, Zone } from './types';
@@ -113,21 +113,35 @@ function zoneNetworkDef(zone: Zone) {
 }
 
 /**
- * Image tag prefix for pre-built e2e images. When images with these
- * tags exist locally, `docker compose build` skips rebuilding them.
- * The e2e-build script creates these tags; e2e-save/e2e-load persist
- * them across colima restarts.
+ * Image tag prefix for baked e2e images. `cele2e build-infra` creates these
+ * tags; e2e-save/e2e-load persist them across colima restarts. A compose
+ * referencing one of these tags never builds it — a missing tag is a loud
+ * failure naming the remedy (see referencedImages / container-manager).
  */
 const IMAGE_PREFIX = 'celilo-e2e';
 
-function imageTag(dockerfile: string): string {
+/**
+ * The image tag `baseService` assigns a service built from `dockerfile`.
+ * Stable across runs (unlike compose's `<project>-<service>` default), which is
+ * what lets callers rebuild a sim image by tag — e.g. the bake re-building the
+ * registry sim after re-staging tarballs (celilo#1299).
+ */
+export function imageTag(dockerfile: string): string {
   // docker/Dockerfile.management -> celilo-e2e/management
   const name = dockerfile.replace('docker/Dockerfile.', '');
   return `${IMAGE_PREFIX}/${name}`;
 }
 
 function baseService(opts: {
-  build?: { context: string; dockerfile: string };
+  /**
+   * Which Dockerfile bakes this image: `docker/Dockerfile.firewall` ->
+   * `celilo-e2e/firewall`. The yaml carries `image:` ONLY. `cele2e
+   * build-infra` is the one builder (it owns the network phase); a suite
+   * run verifies the tag exists instead of building, so a missing image
+   * fails loudly rather than silently resolving FROM from docker.io.
+   * See tests/composes-reference-baked-images.test.ts.
+   */
+  dockerfile?: string;
   image?: string;
   networks: Record<string, { ipv4_address: string }>;
   cap_add?: string[];
@@ -148,11 +162,12 @@ function baseService(opts: {
   /** Host devices to expose, e.g. `/dev/net/tun` for a userspace WireGuard tunnel. */
   devices?: string[];
 }) {
-  // Auto-assign an image tag from the Dockerfile name so Docker can
-  // skip builds when pre-built images exist.
-  const service: Record<string, unknown> = { ...opts, restart: 'unless-stopped' };
-  if (opts.build && !opts.image) {
-    service.image = imageTag(opts.build.dockerfile);
+  // The Dockerfile name drives the tag but must NOT reach the yaml: compose
+  // rejects unknown service keys. The emitted service carries `image:` only.
+  const { dockerfile, ...rest } = opts;
+  const service: Record<string, unknown> = { ...rest, restart: 'unless-stopped' };
+  if (dockerfile && !opts.image) {
+    service.image = imageTag(dockerfile);
   }
   return service;
 }
@@ -162,6 +177,30 @@ function baseService(opts: {
 // manager and per-test compose files (to reference external networks).
 // ---------------------------------------------------------------------------
 
+/**
+ * The baked images a run needs — every service's `celilo-e2e/*` tag, paired
+ * with the tag `baseService` assigned it.
+ *
+ * Used to answer "is everything the compose references present?" before the
+ * run. The yaml carries `image:` only (never `build:`), so this is the full
+ * set: a missing tag is a loud failure naming `cele2e build-infra`, never a
+ * silent suite-time build resolving FROM from docker.io (tasks.md 5b.2).
+ *
+ * Pure and parsed back out of the emitted YAML rather than computed alongside
+ * it, so it reports what the compose file actually says. A service that gains
+ * a reference is covered without anyone remembering to add it here.
+ */
+export function referencedImages(yaml: string): string[] {
+  const compose = parseYaml(yaml) as {
+    services?: Record<string, { image?: string }>;
+  };
+  const images = new Set<string>();
+  for (const service of Object.values(compose.services ?? {})) {
+    if (service.image) images.add(service.image);
+  }
+  return [...images].sort();
+}
+
 export const SHARED_PROJECT_NAME = 'celilo-e2e-shared';
 
 /** Docker network names as created by the shared infrastructure project */
@@ -186,14 +225,38 @@ export const SHARED_NETWORKS = {
 const SECURE_MGMT_GATEWAY = ZONE_GATEWAYS['secure-mgmt'];
 const SECURE_MGMT_MANAGEMENT_IP = zoneIp('secure-mgmt', 100);
 
+/**
+ * Zones deliberately LEFT OUT of the no-NAT class, each mapped to the reason it
+ * is excluded. The no-NAT set is computed as every declared zone (ZONE_SUBNETS)
+ * minus these, so a zone added to the Zone type joins the class by default and
+ * leaving one out is a deliberate edit to this map, never an omission. A test
+ * over this map is the recurrence gate for celilo#1263: the suite once
+ * reproduced that bug class by listing these zones by hand, and a hand-written
+ * list rots the moment a zone is added.
+ */
+export const NO_NAT_EXCLUDED_ZONES: Partial<Record<Zone, string>> = {
+  internal:
+    'A LAN device’s DNS query must arrive SNAT’d to a zone-gateway address so it matches the passthrough view and gets the natIp answer, not the protected one (ISS-0156).',
+};
+
 /**
  * The zones fw-main routes between WITHOUT NAT, so the dmz-resident resolver
  * sees each client's real zone (source-based split-horizon, ISS-0156).
- * `internal` is deliberately absent: a LAN device's query must arrive SNAT'd to
- * a zone-gateway address so it matches the passthrough view and gets the natIp
- * answer, not the protected one.
+ *
+ * Computed, never listed: every declared zone minus
+ * {@link NO_NAT_EXCLUDED_ZONES}. THE COST OF EXCLUDING `internal`, recorded so
+ * the next reader can connect it (celilo#1263): traffic in the other direction —
+ * from a no-NAT zone to an internal host, e.g. the control plane on secure-mgmt
+ * reaching fw-isp at 10.226.1.1 — matches no RETURN row and falls through to the
+ * blanket MASQUERADE. Traffic to every other declared zone keeps its source;
+ * traffic to internal does not. Whether that asymmetry is tolerable is a
+ * control-plane question, not a fixture typo.
  */
-const PROTECTED_SUBNETS = (['dmz', 'app', 'secure', 'secure-mgmt'] as const)
+export function noNatZones(): Zone[] {
+  return (Object.keys(ZONE_SUBNETS) as Zone[]).filter((zone) => !(zone in NO_NAT_EXCLUDED_ZONES));
+}
+
+const PROTECTED_SUBNETS = noNatZones()
   .map((zone) => ZONE_SUBNETS[zone])
   .join(' ');
 
@@ -239,7 +302,7 @@ function firewallNetworks(topology: TopologyPreset): Record<string, { ipv4_addre
 function defaultTopologyServices(config: NetworkConfig): Record<string, unknown> {
   return {
     'fw-main': baseService({
-      build: { context: '.', dockerfile: 'docker/Dockerfile.firewall' },
+      dockerfile: 'docker/Dockerfile.firewall',
       networks: firewallNetworks('default'),
       cap_add: ['NET_ADMIN', 'SYS_ADMIN'],
       // A firewall may also terminate a VPN (the admin tunnel the `wireguard`
@@ -251,7 +314,7 @@ function defaultTopologyServices(config: NetworkConfig): Record<string, unknown>
       environment: { PROTECTED_SUBNETS },
     }),
     'fw-isp': baseService({
-      build: { context: '.', dockerfile: 'docker/Dockerfile.greenwave-sim' },
+      dockerfile: 'docker/Dockerfile.greenwave-sim',
       networks: {
         internal: { ipv4_address: greenwaveRouterIp() },
         'isp-external': { ipv4_address: '203.0.113.100' },
@@ -284,7 +347,7 @@ function defaultTopologyServices(config: NetworkConfig): Record<string, unknown>
 function directInternetTopologyServices(): Record<string, unknown> {
   return {
     'fw-main': baseService({
-      build: { context: '.', dockerfile: 'docker/Dockerfile.firewall' },
+      dockerfile: 'docker/Dockerfile.firewall',
       networks: firewallNetworks('direct-internet'),
       cap_add: ['NET_ADMIN', 'SYS_ADMIN'],
       // A firewall may also terminate a VPN (the admin tunnel the `wireguard`
@@ -332,7 +395,7 @@ export function generateSharedInfraYaml(): string {
   const services: Record<string, unknown> = {};
 
   services['root-dns'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.authoritative-dns' },
+    dockerfile: 'docker/Dockerfile.authoritative-dns',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.ROOT_DNS } },
     cap_add: ['NET_ADMIN'],
     volumes: [
@@ -342,7 +405,7 @@ export function generateSharedInfraYaml(): string {
   });
 
   services['tld-dns'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.authoritative-dns' },
+    dockerfile: 'docker/Dockerfile.authoritative-dns',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.TLD_DNS } },
     cap_add: ['NET_ADMIN'],
     volumes: [
@@ -354,7 +417,7 @@ export function generateSharedInfraYaml(): string {
   });
 
   services['namecheap-dns'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.namecheap-dns' },
+    dockerfile: 'docker/Dockerfile.namecheap-dns',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.NAMECHEAP_DNS } },
     cap_add: ['NET_ADMIN'],
     // Per-domain DDNS passwords for the cross-domain test. Fallback
@@ -384,7 +447,7 @@ export function generateSharedInfraYaml(): string {
   // cycle. See CLAUDE.md history for details.
 
   services.letsencrypt = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.pebble' },
+    dockerfile: 'docker/Dockerfile.pebble',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.PEBBLE } },
     cap_add: ['NET_ADMIN'],
     command: '-config /config/pebble-config.json -dnsserver 203.0.113.1:53',
@@ -400,7 +463,7 @@ export function generateSharedInfraYaml(): string {
   // the package (bundled at build time from packages/registry-server,
   // shipped in the npm tarball). See packages/e2e/src/registry-bundle.ts.
   services.registry = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.registry' },
+    dockerfile: 'docker/Dockerfile.registry',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.REGISTRY } },
     cap_add: ['NET_ADMIN'],
     volumes: getRegistryVolumes(),
@@ -422,7 +485,7 @@ export function generateSharedInfraYaml(): string {
   // internet-external with the authoritative servers, so it needs no route
   // through fw-ext to reach them.
   services['public-resolver'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.resolver' },
+    dockerfile: 'docker/Dockerfile.resolver',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.PUBLIC_RESOLVER } },
     cap_add: ['NET_ADMIN'],
     command: '/public-resolver-startup.sh',
@@ -434,7 +497,7 @@ export function generateSharedInfraYaml(): string {
   // check's EXPECTATION comes from; comparing public DNS against the
   // registrar's own response would be self-agreement.
   services['ip-echo'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.ip-echo' },
+    dockerfile: 'docker/Dockerfile.ip-echo',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.IP_ECHO } },
     cap_add: ['NET_ADMIN'],
   });
@@ -445,7 +508,7 @@ export function generateSharedInfraYaml(): string {
   // at 203.0.113.1 as DNS so it can recursively resolve the simulated public
   // zones (e.g. iamtheinternet.org).
   services.isitup = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.isitup' },
+    dockerfile: 'docker/Dockerfile.isitup',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.ISITUP } },
     cap_add: ['NET_ADMIN'],
     dns: ['203.0.113.1'],
@@ -457,7 +520,7 @@ export function generateSharedInfraYaml(): string {
   // without reaching the real internet. Static content is staged into the
   // image at build time from modules/celilo-website/site/dist/.
   services['celilo-website'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.celilo-website-sim' },
+    dockerfile: 'docker/Dockerfile.celilo-website-sim',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.WEBSITE } },
     cap_add: ['NET_ADMIN'],
     dns: ['203.0.113.1'],
@@ -474,13 +537,13 @@ export function generateSharedInfraYaml(): string {
   // DNS resolves tangohost.com straight to this address. It runs its own Apache
   // and its own pre-installed TLS — celilo governs none of it.
   services['cpanel-host'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.cpanel-host-sim' },
+    dockerfile: 'docker/Dockerfile.cpanel-host-sim',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.CPANEL_HOST } },
     cap_add: ['NET_ADMIN'],
   });
 
   services['npm-registry'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.npm-registry-sim' },
+    dockerfile: 'docker/Dockerfile.npm-registry-sim',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.NPM_REGISTRY } },
     cap_add: ['NET_ADMIN'],
   });
@@ -492,7 +555,7 @@ export function generateSharedInfraYaml(): string {
   // inside the image (Dockerfile.apt-repo-sim). Drives the bootstrap-apt
   // test's `apt install celilo-bootstrap`.
   services['apt-repo'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.apt-repo-sim' },
+    dockerfile: 'docker/Dockerfile.apt-repo-sim',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.APT_REPO } },
     cap_add: ['NET_ADMIN'],
   });
@@ -505,7 +568,7 @@ export function generateSharedInfraYaml(): string {
   // Drives the migration restore e2e (push via `backup --storage`, pull via
   // `backup pull`).
   services.minio = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.minio' },
+    dockerfile: 'docker/Dockerfile.minio',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.MINIO } },
     cap_add: ['NET_ADMIN'],
   });
@@ -533,7 +596,7 @@ export function generateSharedInfraYaml(): string {
  */
 function proxmoxSimService() {
   return baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.proxmox-sim' },
+    dockerfile: 'docker/Dockerfile.proxmox-sim',
     networks: { 'secure-mgmt': { ipv4_address: PROXMOX_SIM_IP } },
     volumes: ['/var/run/docker.sock:/var/run/docker.sock'],
     // Compose substitutes this at up-time from `-p`, so the generator does not
@@ -592,14 +655,17 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
 
   // Pick the management image based on variant. Both branches use
   // `image:` (not `build:`) so docker compose uses the existing tag —
-  // critical, because `cele2e build-infra` runs install.sh and
-  // `docker commit`s the result onto :latest (Phase 2 bake step). If
-  // we used `build: { Dockerfile.management }` here, every test's
-  // streamingBuild would rebuild from the Dockerfile and OVERWRITE
-  // the bake commit, destroying the post-install.sh image. Confirmed
-  // bitten on 2026-05-06: caddy-custom-hostname test failed with
-  // `celilo: command not found` because the compose rebuild had
-  // wiped install.sh's output.
+  // critical for two reasons. First, `cele2e build-infra` runs
+  // install.sh and `docker commit`s the result onto :latest (Phase 2
+  // bake step). If compose rebuilt from Dockerfile.management it would
+  // OVERWRITE the bake commit, destroying the post-install.sh image.
+  // Confirmed bitten on 2026-05-06: caddy-custom-hostname test failed
+  // with `celilo: command not found` because the compose rebuild had
+  // wiped install.sh's output. Second, no compose anywhere may carry a
+  // `build:` section: a suite-time build resolves FROM from docker.io
+  // and fetches over the network (tasks.md 5b.2). Every generated
+  // compose is image-references-only; the gate is
+  // tests/composes-reference-baked-images.test.ts.
   //
   //   :vanilla — bun + unzip + bunfig, no celilo. Used by the
   //              install-sh regression test.
@@ -683,6 +749,14 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
         DEFAULT_GATEWAY: zone === 'secure-mgmt' ? SECURE_MGMT_GATEWAY : managementDefaultGw,
         ...(zone === 'secure-mgmt' ? { FW_MAIN_HOP: SECURE_MGMT_GATEWAY } : {}),
         CELILO_REGISTRY_URL: 'http://e2e-registry.lab',
+        // `cele2e run --source-cli` sets this, and the image's shim reads it to
+        // run the mounted workspace instead of the CLI install.sh installed.
+        // Off by default: the installed CLI is the artifact under test, and
+        // running the source over the bind mount roughly doubles a celilo
+        // command's start-up (see the shim's comment in bin/e2e-bake-management).
+        ...(process.env.CELILO_E2E_SOURCE_CLI
+          ? { CELILO_E2E_SOURCE_CLI: process.env.CELILO_E2E_SOURCE_CLI }
+          : {}),
       },
     });
 
@@ -707,7 +781,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
     config.dmzMachines[0]?.ip ??
     zoneIp('dmz', 10);
   services['dns-int'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.internal-resolver' },
+    dockerfile: 'docker/Dockerfile.internal-resolver',
     networks: { internal: { ipv4_address: internalResolverIp() } },
     cap_add: ['NET_ADMIN'],
     environment: {
@@ -734,7 +808,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
 
   // --- Routing infrastructure (bridges per-test to shared infra) ---
   services['fw-ext'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.router' },
+    dockerfile: 'docker/Dockerfile.router',
     networks: {
       'isp-external': { ipv4_address: '203.0.113.101' },
       'internet-external': { ipv4_address: '100.64.0.1' },
@@ -745,7 +819,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   });
 
   services['comcast-resolver'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.resolver' },
+    dockerfile: 'docker/Dockerfile.resolver',
     networks: {
       'isp-external': { ipv4_address: '203.0.113.1' },
       'real-internet': { ipv4_address: '172.30.0.4' },
@@ -780,7 +854,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
     }
 
     services[machine.name] = baseService({
-      build: { context: '.', dockerfile },
+      dockerfile,
       networks: { [zoneNetwork]: { ipv4_address: machine.ip } },
       privileged: true,
       volumes: machineVolumes,
@@ -792,7 +866,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   // --- Optional DHCP client ---
   if (config.dhcpClient) {
     services['dhcp-client'] = baseService({
-      build: { context: '.', dockerfile: 'docker/Dockerfile.dhcp-client' },
+      dockerfile: 'docker/Dockerfile.dhcp-client',
       networks: { internal: { ipv4_address: zoneIp('internal', 210) } },
       cap_add: ['NET_ADMIN'],
     });
@@ -804,7 +878,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   // on internet-external. Unlinked: the JSON-RPC surface needs no account.
   if (config.signalCli) {
     services['signal-cli'] = baseService({
-      build: { context: '.', dockerfile: 'docker/Dockerfile.signal-cli' },
+      dockerfile: 'docker/Dockerfile.signal-cli',
       networks: { internal: { ipv4_address: zoneIp('internal', 90) } },
       cap_add: ['NET_ADMIN'],
     });
@@ -815,7 +889,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   // module downloads FROM the internet at deploy time.
   if (config.signalRelease) {
     services['signal-release'] = baseService({
-      build: { context: '.', dockerfile: 'docker/Dockerfile.signal-release' },
+      dockerfile: 'docker/Dockerfile.signal-release',
       networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.SIGNAL_RELEASE } },
       cap_add: ['NET_ADMIN'],
     });
@@ -826,7 +900,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   // other without touching the module's configured endpoint.
   if (config.signalSim) {
     services['signal-sim'] = baseService({
-      build: { context: '.', dockerfile: 'docker/Dockerfile.signal-sim' },
+      dockerfile: 'docker/Dockerfile.signal-sim',
       networks: { internal: { ipv4_address: zoneIp('internal', 91) } },
       cap_add: ['NET_ADMIN'],
       environment: {
@@ -848,7 +922,7 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
   for (const spec of normalizeObservers(config.observers ?? [])) {
     const p = observerPlacement(spec.vantage);
     services[p.service] = baseService({
-      build: { context: '.', dockerfile: 'docker/Dockerfile.observer' },
+      dockerfile: 'docker/Dockerfile.observer',
       networks: { [p.network]: { ipv4_address: p.ip } },
       cap_add: ['NET_ADMIN'],
       // A vantage may dial a VPN and probe from INSIDE the tunnel — the only way
@@ -894,7 +968,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
     config.topology === 'direct-internet' ? ZONE_GATEWAYS.internal : greenwaveRouterIp();
 
   services.management = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.management' },
+    dockerfile: 'docker/Dockerfile.management',
     networks: { internal: { ipv4_address: zoneIp('internal', 100) } },
     cap_add: ['NET_ADMIN'],
     volumes: [
@@ -916,7 +990,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
     config.dmzMachines[0]?.ip ??
     zoneIp('dmz', 10);
   services['dns-int'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.internal-resolver' },
+    dockerfile: 'docker/Dockerfile.internal-resolver',
     networks: { internal: { ipv4_address: internalResolverIp() } },
     cap_add: ['NET_ADMIN'],
     environment: {
@@ -927,7 +1001,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   });
 
   services['fw-ext'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.router' },
+    dockerfile: 'docker/Dockerfile.router',
     networks: {
       'isp-external': { ipv4_address: '203.0.113.101' },
       'internet-external': { ipv4_address: '100.64.0.1' },
@@ -938,7 +1012,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   });
 
   services['comcast-resolver'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.resolver' },
+    dockerfile: 'docker/Dockerfile.resolver',
     networks: {
       'isp-external': { ipv4_address: '203.0.113.1' },
       'real-internet': { ipv4_address: '172.30.0.4' },
@@ -947,7 +1021,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   });
 
   services['root-dns'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.authoritative-dns' },
+    dockerfile: 'docker/Dockerfile.authoritative-dns',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.ROOT_DNS } },
     cap_add: ['NET_ADMIN'],
     volumes: [
@@ -957,7 +1031,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   });
 
   services['tld-dns'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.authoritative-dns' },
+    dockerfile: 'docker/Dockerfile.authoritative-dns',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.TLD_DNS } },
     cap_add: ['NET_ADMIN'],
     volumes: [
@@ -969,7 +1043,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   });
 
   services['namecheap-dns'] = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.namecheap-dns' },
+    dockerfile: 'docker/Dockerfile.namecheap-dns',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.NAMECHEAP_DNS } },
     cap_add: ['NET_ADMIN'],
     // Per-domain DDNS passwords for the cross-domain test. Fallback
@@ -999,7 +1073,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   // cycle. See CLAUDE.md history for details.
 
   services.letsencrypt = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.pebble' },
+    dockerfile: 'docker/Dockerfile.pebble',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.PEBBLE } },
     cap_add: ['NET_ADMIN'],
     command: '-config /config/pebble-config.json -dnsserver 203.0.113.1:53',
@@ -1015,7 +1089,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
   // the package (bundled at build time from packages/registry-server,
   // shipped in the npm tarball). See packages/e2e/src/registry-bundle.ts.
   services.registry = baseService({
-    build: { context: '.', dockerfile: 'docker/Dockerfile.registry' },
+    dockerfile: 'docker/Dockerfile.registry',
     networks: { 'internet-external': { ipv4_address: SIMULATOR_IPS.REGISTRY } },
     cap_add: ['NET_ADMIN'],
     volumes: getRegistryVolumes(),
@@ -1045,7 +1119,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
     }
 
     services[machine.name] = baseService({
-      build: { context: '.', dockerfile },
+      dockerfile,
       networks: { [zoneNetwork]: { ipv4_address: machine.ip } },
       privileged: true,
       volumes: machineVolumes,
@@ -1056,7 +1130,7 @@ export function generateComposeYaml(config: NetworkConfig, celiloRoot = '..'): s
 
   if (config.dhcpClient) {
     services['dhcp-client'] = baseService({
-      build: { context: '.', dockerfile: 'docker/Dockerfile.dhcp-client' },
+      dockerfile: 'docker/Dockerfile.dhcp-client',
       networks: { internal: { ipv4_address: zoneIp('internal', 210) } },
       cap_add: ['NET_ADMIN'],
     });