@celilo/e2e 0.6.0 → 0.6.2

package/README.md

@@ -187,7 +187,8 @@ c machine add 192.168.0.254 --ssh-user root --earmark iptables
 c machine add 10.0.10.10 --ssh-user root
 
 # Pre-configure secrets and non-derivable config
-c module secret set namecheap ddns_password test123
+c module config set namecheap domains '["iamtheinternet.org"]'
+c module secret set namecheap ddns_passwords '{"iamtheinternet.org":"test123"}'
 c module config set greenwave router_ip 192.168.0.1
 c module secret set greenwave router_username admin
 c module secret set greenwave router_password admin

package/config/dns/celilo.computer.zone

@@ -0,0 +1,16 @@
+$ORIGIN celilo.computer.
+$TTL 300
+
+@ IN SOA ns1.celilo.computer. admin.celilo.computer. (
+    2024020117 300 60 604800 300
+)
+
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
+@       IN NS   ns1.celilo.computer.
+ns1     IN A    100.64.0.55
+@    IN A    100.100.0.100
+www     IN A    100.100.0.100

package/config/dns/iamtheinternet.org.zone

@@ -2,14 +2,16 @@ $ORIGIN iamtheinternet.org.
 $TTL 300
 
 @ IN SOA ns1.iamtheinternet.org. admin.iamtheinternet.org. (
-    2024010821 300 60 604800 300
+    2024020250 300 60 604800 300
 )
 
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
 @       IN NS   ns1.iamtheinternet.org.
 ns1     IN A    100.64.0.55
 @    IN A    0.0.0.0
-caddy    IN A    100.100.0.100
 www    IN A    100.100.0.100
-deathstar    IN A    100.100.0.100
-test    IN A    0.0.0.0
 auth    IN A    100.100.0.100

package/config/dns/knot-namecheap.conf

@@ -6,6 +6,14 @@ zone:
     file: "/config/iamtheinternet.org.zone"
     storage: "/var/lib/knot"
 
+  - domain: "celilo.computer"
+    file: "/config/celilo.computer.zone"
+    storage: "/var/lib/knot"
+
+  - domain: "lunacycle.net"
+    file: "/config/lunacycle.net.zone"
+    storage: "/var/lib/knot"
+
   - domain: "park-your-domain.com"
     file: "/config/park-your-domain.com.zone"
     storage: "/var/lib/knot"

package/config/dns/knot-tld.conf

@@ -9,3 +9,7 @@ zone:
   - domain: "org"
     file: "/config/org.zone"
     storage: "/var/lib/knot"
+
+  - domain: "net"
+    file: "/config/net.zone"
+    storage: "/var/lib/knot"

package/config/dns/lunacycle.net.zone

@@ -0,0 +1,16 @@
+$ORIGIN lunacycle.net.
+$TTL 300
+
+@ IN SOA ns1.lunacycle.net. admin.lunacycle.net. (
+    2024020108 300 60 604800 300
+)
+
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
+@       IN NS   ns1.lunacycle.net.
+ns1     IN A    100.64.0.55
+@       IN A    100.100.0.100
+www     IN A    100.100.0.100

package/config/dns/net.zone

@@ -0,0 +1,11 @@
+$ORIGIN net.
+$TTL 86400
+
+@ IN SOA tld-dns.lab. admin.lab. (
+    2024010101 1800 900 604800 86400
+)
+
+net.                    IN NS   tld-dns.lab.
+
+lunacycle               IN NS   ns1.lunacycle.net.
+ns1.lunacycle.net.      IN A    100.64.0.55

package/config/dns/org.zone

@@ -10,5 +10,10 @@ org.                    IN NS   tld-dns.lab.
 iamtheinternet          IN NS   ns1.iamtheinternet.org.
 ns1.iamtheinternet.org. IN A    100.64.0.55
 
+; External prober simulator — mimics isitup.org's JSON API.
+; Served directly by tld-dns rather than delegated, since we only need a
+; single A record (no subdomains, no SOA of its own).
+isitup                  IN A    100.64.0.57
+
 ; Note: Let's Encrypt ACME endpoints are handled by unbound local-data
 ; (resolves acme-v02.api.letsencrypt.org → 100.64.0.100 directly)

package/config/dns/root.zone

@@ -12,3 +12,5 @@ com.        IN NS   tld-dns.lab.
 tld-dns.lab.    IN A    100.64.0.54
 
 org.        IN NS   tld-dns.lab.
+
+net.        IN NS   tld-dns.lab.

package/config/dns/templates/iamtheinternet.org.zone

@@ -0,0 +1,16 @@
+$ORIGIN iamtheinternet.org.
+$TTL 300
+
+@ IN SOA ns1.iamtheinternet.org. admin.iamtheinternet.org. (
+    2024020247 300 60 604800 300
+)
+
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
+@       IN NS   ns1.iamtheinternet.org.
+ns1     IN A    100.64.0.55
+@       IN A    0.0.0.0
+www     IN A    100.100.0.100

package/config/dns/templates/lunacycle.net.zone

@@ -0,0 +1,16 @@
+$ORIGIN lunacycle.net.
+$TTL 300
+
+@ IN SOA ns1.lunacycle.net. admin.lunacycle.net. (
+    2024020108 300 60 604800 300
+)
+
+; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
+; the e2e simulation is to model real internet connectivity, where
+; private IPs are unreachable from outside. All public-facing names
+; resolve to the firewall's external IP (100.100.0.100), which DNATs
+; inbound to the right internal host.
+@       IN NS   ns1.lunacycle.net.
+ns1     IN A    100.64.0.55
+@       IN A    100.100.0.100
+www     IN A    100.100.0.100

package/config/resolver/unbound.conf

@@ -11,12 +11,22 @@ server:
     # Let's Encrypt ACME endpoints → Pebble
     local-data: "acme-v02.api.letsencrypt.org. IN A 100.64.0.100"
     local-data: "acme-staging-v02.api.letsencrypt.org. IN A 100.64.0.100"
+    # E2E registry container
+    local-data: "e2e-registry.lab. IN A 100.64.0.56"
+    # External website prober simulator — without this override, isitup.org
+    # falls through the "forward-zone: ." below and resolves to the REAL
+    # Namecheap-parked domain on the public internet.
+    local-data: "isitup.org. IN A 100.64.0.57"
 
 # Simulated domains → namecheap-dns (authoritative)
 stub-zone:
     name: "iamtheinternet.org."
     stub-addr: 100.64.0.55
 
+stub-zone:
+    name: "lunacycle.net."
+    stub-addr: 100.64.0.55
+
 stub-zone:
     name: "park-your-domain.com."
     stub-addr: 100.64.0.55

package/config/routing/management-routes.sh

@@ -34,6 +34,25 @@ ip route add 10.0.30.0/24 via 192.168.0.254    # secure via fw-main
 # Fall back to the simulated public resolver if Technitium is not yet up.
 printf 'nameserver 192.168.0.10\nnameserver 100.100.0.1\n' > /etc/resolv.conf
 
+# Fetch Pebble's runtime ACME root CA (Pebble generates a fresh root at each
+# startup, unlike the static /config/pebble/pebble-ca.crt baked in at build
+# time which only signs Pebble's own API endpoint). Without this, management
+# can't verify certs that Caddy obtained from Pebble (iamtheinternet.org,
+# isitup.org, etc.). Mirrors the equivalent block in fw-ext-routes.sh.
+echo "Waiting for Pebble ACME root CA..."
+(
+  for i in $(seq 1 60); do
+    if curl -sk https://100.64.0.100:15000/roots/0 -o /usr/local/share/ca-certificates/pebble-acme-root.crt 2>/dev/null; then
+      if [ -s /usr/local/share/ca-certificates/pebble-acme-root.crt ]; then
+        update-ca-certificates 2>/dev/null
+        echo "Pebble ACME root CA installed"
+        break
+      fi
+    fi
+    sleep 2
+  done
+) &
+
 # Create celilo data directory (Linux default: /var/lib/celilo/)
 mkdir -p /var/lib/celilo/modules
 

package/config/routing/resolver-internal-routes.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+set -e
+
+# CADDY_IP: IP of the caddy container in the DMZ (default 10.0.10.10).
+# All test-domain queries resolve to this IP so management can reach
+# caddy directly without hairpin NAT through the external interface.
+CADDY_IP="${CADDY_IP:-10.0.10.10}"
+
+# DOMAINS: comma-separated list of e2e test domains that should be
+# split-horizon redirected to caddy. Default covers the canonical
+# (iamtheinternet.org) plus the cross-domain test's second domain
+# (lunacycle.net). Tests can override via DEFAULT_GATEWAY/DOMAINS env
+# vars in docker-compose.
+DOMAINS="${DOMAINS:-iamtheinternet.org,lunacycle.net}"
+
+# Routing — reach comcast-resolver (100.100.0.1) via fw-main or fw-isp.
+# DEFAULT_GATEWAY is set by docker-compose from the topology config.
+GATEWAY="${DEFAULT_GATEWAY:-192.168.0.254}"
+ip route del default 2>/dev/null || true
+ip route add default via "$GATEWAY"
+
+# Build per-domain split-horizon blocks.
+# local-zone "redirect" returns the single A record for ALL names under
+# the zone (including subdomains), so every hostname in the test domain
+# reaches caddy which then reverse-proxies to the correct backend.
+SPLIT_HORIZON_BLOCK=""
+IFS=',' read -ra DOMAIN_LIST <<< "${DOMAINS}"
+for d in "${DOMAIN_LIST[@]}"; do
+    SPLIT_HORIZON_BLOCK="${SPLIT_HORIZON_BLOCK}    local-zone: \"${d}.\" redirect\n    local-data: \"${d}. IN A ${CADDY_IP}\"\n"
+done
+
+# Generate unbound config with split-horizon for each test domain plus
+# the standard simulator overrides (Pebble, registry).
+cat > /etc/unbound/unbound.conf << EOF
+server:
+    interface: 0.0.0.0
+    access-control: 0.0.0.0/0 allow
+    cache-min-ttl: 0
+    cache-max-ttl: 60
+    verbosity: 1
+    do-daemonize: no
+    do-not-query-localhost: no
+
+$(printf "${SPLIT_HORIZON_BLOCK}")
+    # Mirror the public resolver's simulated endpoint overrides so that
+    # management uses Pebble for ACME and the e2e registry for modules.
+    local-data: "acme-v02.api.letsencrypt.org. IN A 100.64.0.100"
+    local-data: "acme-staging-v02.api.letsencrypt.org. IN A 100.64.0.100"
+    local-data: "e2e-registry.lab. IN A 100.64.0.56"
+
+forward-zone:
+    name: "."
+    forward-addr: 100.100.0.1
+EOF
+
+/usr/sbin/unbound -d &
+
+echo "internal resolver ready (split-horizon: ${DOMAINS} -> ${CADDY_IP})"
+sleep infinity

package/docker/Dockerfile.internal-resolver

@@ -0,0 +1,16 @@
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y \
+    unbound \
+    iproute2 \
+    iputils-ping \
+    net-tools \
+    dnsutils \
+    procps \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY config/routing/resolver-internal-routes.sh /startup.sh
+RUN chmod +x /startup.sh
+
+EXPOSE 53/tcp 53/udp
+CMD ["/startup.sh"]

package/docker/Dockerfile.isitup

@@ -0,0 +1,37 @@
+FROM oven/bun:latest
+
+# Caddy (for ACME/TLS termination) + tools needed by entrypoint.sh.
+# iproute2 provides `ip` so the entrypoint can rewrite the default route
+# through fw-ext (same pattern as Dockerfile.pebble); without it DNS for
+# simulated public hostnames fails.
+RUN apt-get update && apt-get install -y \
+    ca-certificates \
+    curl \
+    iproute2 \
+    debian-keyring \
+    debian-archive-keyring \
+    apt-transport-https \
+    gnupg \
+    && curl -fsSL 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
+       | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg \
+    && curl -fsSL 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
+       > /etc/apt/sources.list.d/caddy-stable.list \
+    && apt-get update && apt-get install -y caddy \
+    && rm -rf /var/lib/apt/lists/*
+
+# Trust Pebble CA so Caddy's ACME client accepts the directory endpoint
+COPY config/pebble/pebble-ca.crt /usr/local/share/ca-certificates/pebble-ca.crt
+RUN update-ca-certificates
+
+# Simulator app
+COPY simulators/isitup/server.ts /simulator/server.ts
+
+# Caddy config
+COPY simulators/isitup/Caddyfile /etc/caddy/Caddyfile
+
+# Entrypoint
+COPY simulators/isitup/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 80 443
+CMD ["/entrypoint.sh"]

package/docker/Dockerfile.registry

@@ -0,0 +1,34 @@
+FROM oven/bun:1
+
+WORKDIR /app
+
+# Install the shared @celilo/registry-server package.
+# Both this e2e stand-in and the celilo-registry module run the same code —
+# packages/registry-server is the single source of truth.
+COPY registry-server/package.json ./package.json
+COPY registry-server/tsconfig.json ./tsconfig.json
+COPY registry-server/src ./src
+
+RUN bun install --production
+
+# Bootstrap mode: the shared-infra stand-in serves modules directly from the
+# repo's modules/ directory (volume-mounted read-only). This preserves the
+# pre-unification convenience where tests can `celilo module import
+# public-registry namecheap` without having to publish namecheap first.
+#
+# The production celilo-registry module does NOT set BOOTSTRAP_MODULES_DIR
+# and only serves pre-published packages.
+ENV DATA_DIR=/var/lib/celilo-registry \
+    BOOTSTRAP_MODULES_DIR=/modules \
+    BOOTSTRAP_UPLOADS_DIR=/uploads \
+    BOOTSTRAP_CACHE_DIR=/cache \
+    PATH_PREFIX= \
+    PORT=80
+
+# /uploads is the drop-zone for .netapps that tests push via
+# `docker compose cp`. Create the dir at build time so `docker cp` has
+# somewhere to put files before the server runs.
+RUN mkdir -p /uploads
+
+EXPOSE 80
+CMD ["bun", "run", "src/index.ts"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -31,6 +31,7 @@
     "README.md"
   ],
   "dependencies": {
+    "@celilo/cli-display": "0.1.4",
     "yaml": "^2.8.0"
   },
   "devDependencies": {

package/simulators/isitup/Caddyfile

@@ -0,0 +1,11 @@
+{
+    email admin@isitup.org
+    # Pebble listens on 443 with a TLS cert whose SAN is
+    # acme-v02.api.letsencrypt.org (not an IP), so we use the hostname and
+    # rely on comcast-resolver's local-data override to reach 100.64.0.100.
+    acme_ca https://acme-v02.api.letsencrypt.org/dir
+}
+
+isitup.org {
+    reverse_proxy localhost:8080
+}

package/simulators/isitup/entrypoint.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# Start the Bun API server in the background, then Caddy in the foreground.
+# Caddy terminates TLS (with a cert issued by Pebble) and reverse-proxies
+# /api.json to Bun on localhost:8080.
+
+set -e
+
+# Route through fw-ext so we can reach comcast-resolver on isp-external
+# (Docker's default bridge gateway has no path across networks). Without
+# this, DNS for acme-v02.api.letsencrypt.org fails, Caddy never gets its
+# cert, and port 443 never opens. Mirrors config/routing/pebble-startup.sh.
+# fw-ext is a per-test container so this route is unreachable when shared
+# infra runs alone — harmless; the test brings fw-ext up before the prober
+# is exercised.
+ip route del default 2>/dev/null || true
+ip route add default via 100.64.0.1
+
+# Fetch Pebble's runtime ACME root CA so the simulator trusts certs presented
+# by the targets it probes (e.g. Caddy on iamtheinternet.org uses a Pebble-
+# issued cert). Pebble regenerates its root on every startup, so the static
+# pebble-ca.crt baked in at build time isn't enough.
+echo "Waiting for Pebble ACME root CA..."
+for i in $(seq 1 60); do
+  if curl -sk https://100.64.0.100:15000/roots/0 -o /usr/local/share/ca-certificates/pebble-acme-root.crt 2>/dev/null; then
+    if [ -s /usr/local/share/ca-certificates/pebble-acme-root.crt ]; then
+      update-ca-certificates 2>/dev/null
+      echo "Pebble ACME root CA installed"
+      break
+    fi
+  fi
+  sleep 2
+done
+
+cd /simulator
+bun run server.ts &
+BUN_PID=$!
+
+# Wait briefly for Bun to come up before Caddy starts proxying
+for i in $(seq 1 10); do
+  if curl -sf http://127.0.0.1:8080/health >/dev/null 2>&1; then
+    break
+  fi
+  sleep 0.3
+done
+
+# Caddy runs in foreground so the container lifecycle follows it
+exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile

package/simulators/isitup/server.ts

@@ -0,0 +1,112 @@
+/**
+ * isitup.org Simulator
+ *
+ * Mimics the isitup.org JSON API:
+ *   GET /api.json?url=<domain>
+ *
+ * status_code values match the real API:
+ *   1 = site is up
+ *   2 = site is down (connection failed / non-2xx/3xx)
+ *   3 = bad URL (malformed)
+ *
+ * The simulator is deployed on internet-external and probes the target
+ * from that network position — so it exercises the same public-facing
+ * path a real external prober would.
+ */
+
+const PORT = Number(process.env.PORT) || 8080;
+
+interface ProbeResponse {
+  domain: string;
+  port: number;
+  status_code: 1 | 2 | 3;
+  response_ip: string;
+  response_code: number;
+  response_time: number;
+}
+
+async function probe(targetUrl: string): Promise<ProbeResponse> {
+  let parsed: URL;
+  const withScheme = targetUrl.includes('://') ? targetUrl : `https://${targetUrl}`;
+  try {
+    parsed = new URL(withScheme);
+  } catch {
+    return {
+      domain: targetUrl,
+      port: 443,
+      status_code: 3,
+      response_ip: '',
+      response_code: 0,
+      response_time: 0,
+    };
+  }
+
+  const port = parsed.port
+    ? Number(parsed.port)
+    : parsed.protocol === 'https:'
+      ? 443
+      : 80;
+
+  const start = Date.now();
+  try {
+    const response = await fetch(withScheme, {
+      signal: AbortSignal.timeout(10_000),
+      redirect: 'follow',
+    });
+    const responseTime = (Date.now() - start) / 1000;
+    // Real isitup treats 2xx/3xx as up. Anything else (or unreachable) is down.
+    const isUp = response.status >= 200 && response.status < 400;
+    console.log(`[isitup] ${withScheme} → HTTP ${response.status} in ${responseTime.toFixed(2)}s`);
+    return {
+      domain: parsed.hostname,
+      port,
+      status_code: isUp ? 1 : 2,
+      response_ip: '',
+      response_code: response.status,
+      response_time: responseTime,
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.log(`[isitup] ${withScheme} → probe error: ${message}`);
+    return {
+      domain: parsed.hostname,
+      port,
+      status_code: 2,
+      response_ip: '',
+      response_code: 0,
+      response_time: (Date.now() - start) / 1000,
+    };
+  }
+}
+
+const server = Bun.serve({
+  port: PORT,
+  async fetch(req) {
+    const url = new URL(req.url);
+
+    if (url.pathname === '/api.json') {
+      const target = url.searchParams.get('url');
+      if (!target) {
+        return Response.json({
+          domain: '',
+          port: 443,
+          status_code: 3,
+          response_ip: '',
+          response_code: 0,
+          response_time: 0,
+        });
+      }
+      const result = await probe(target);
+      console.log(`[isitup] ${target} → ${result.status_code} (${result.response_code})`);
+      return Response.json(result);
+    }
+
+    if (url.pathname === '/' || url.pathname === '/health') {
+      return Response.json({ ok: true, service: 'isitup.org simulator' });
+    }
+
+    return new Response('Not Found', { status: 404 });
+  },
+});
+
+console.log(`[isitup] simulator listening on port ${server.port}`);

package/simulators/namecheap-ddns/server.ts

@@ -11,9 +11,38 @@
 import { updateZone } from './zone-updater';
 import type { DdnsRecord } from './types';
 
-const VALID_PASSWORD = process.env.DDNS_PASSWORD || 'test123';
+// Real Namecheap DDNS uses a separate password per domain. The simulator
+// supports two modes:
+//   1. DDNS_PASSWORDS (JSON object mapping domain→password). Per-domain
+//      lookup; password must match the entry for the requested domain.
+//   2. DDNS_PASSWORD (single string fallback). Accepted for any domain.
+//      Default `test123` keeps single-domain tests working unchanged.
+// Mode 1 wins when set; the cross-domain e2e test exercises it via
+// docker-compose env to verify per-domain password routing.
+const PASSWORD_MAP: Record<string, string> = (() => {
+  const raw = process.env.DDNS_PASSWORDS;
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      const out: Record<string, string> = {};
+      for (const [k, v] of Object.entries(parsed)) {
+        if (typeof v === 'string') out[k] = v;
+      }
+      return out;
+    }
+  } catch {
+    console.warn(`[ddns] Failed to parse DDNS_PASSWORDS env var: ${raw}`);
+  }
+  return {};
+})();
+const FALLBACK_PASSWORD = process.env.DDNS_PASSWORD || 'test123';
 const PORT = Number(process.env.DDNS_PORT) || 8080;
 
+function expectedPasswordFor(domain: string): string {
+  return PASSWORD_MAP[domain] ?? FALLBACK_PASSWORD;
+}
+
 // Track registered records for debugging
 const records: Map<string, DdnsRecord> = new Map();
 
@@ -66,7 +95,7 @@ const server = Bun.serve({
         return xmlResponse(1, '', ['Missing required parameters: host, domain']);
       }
 
-      if (password !== VALID_PASSWORD) {
+      if (password !== expectedPasswordFor(domain)) {
         return xmlResponse(1, ip, ['Passwords do not match']);
       }
 

package/src/cli/build.ts

@@ -110,17 +110,27 @@ function buildDockerImages(pkgDir: string): void {
   const total = dockerfiles.length;
   const buildStart = Date.now();
 
+  // Per-Dockerfile build-context overrides. Default context is the e2e
+  // package root. Dockerfiles that need access to sibling packages (e.g.
+  // Dockerfile.registry COPYs from packages/registry-server) get `..`
+  // (= packages/). Must match the compose-time context in
+  // docker-compose-generator.ts.
+  const contextOverrides: Record<string, string> = {
+    'Dockerfile.registry': '..',
+  };
+
   for (let i = 0; i < total; i++) {
     const file = dockerfiles[i];
     const name = file.replace('Dockerfile.', '');
     const tag = `celilo-e2e/${name}`;
+    const context = contextOverrides[file] ?? '.';
 
     process.stdout.write(`  [${i + 1}/${total}] ${String(name).padEnd(25)} `);
 
     const start = Date.now();
     const result = spawnSync(
       'docker',
-      ['build', '-t', tag, '-f', join(dockerDir, file), '.'],
+      ['build', '-t', tag, '-f', join(dockerDir, file), context],
       { cwd: pkgDir, stdio: 'pipe' },
     );
     const elapsed = Math.round((Date.now() - start) / 1000);
@@ -178,11 +188,15 @@ export function runBuild(options: BuildOptions): void {
   mkdirSync(netappsDir, { recursive: true });
 
   if (!skipModules) {
-    // Explicit dirs take precedence; fall back to auto-discovering all modules.
+    // Explicit dirs take precedence; fall back to auto-discovering all
+    // modules. Try CWD first so a globally-installed cele2e finds the
+    // user's monorepo (the package's own dir is in
+    // ~/.bun/install/global/... and won't have a `modules/` sibling).
+    // Fall back to the package dir for the in-monorepo dev case.
     const dirs = moduleDirs.length > 0
       ? moduleDirs
       : (() => {
-          const root = findMonorepoRoot(pkgDir);
+          const root = findMonorepoRoot(process.cwd()) ?? findMonorepoRoot(pkgDir);
           return root ? discoverModuleDirs(root) : [];
         })();