@norskvideo/ctl-sdk 0.1.19 → 0.1.21

package/docker-runner.d.ts

@@ -1,3 +1,4 @@
+export declare const CONTAINER_INTERNAL_PORT = 4321;
 /** Role label stamped on every product control-plane container. The daemon's
  *  infrastructure view discovers managed singletons by the presence of a
  *  `norsk-ctl.role` label (proxy, proxy-oauth2, cpu-monitor, product); the
@@ -16,6 +17,9 @@ export declare function productContainerName(productName: string): string;
 export declare function isDigestRef(image: string): boolean;
 export declare function dockerPull(image: string): Promise<void>;
 export declare function dockerRun(image: string, hostPort: number): Promise<string>;
+/** The container's address on its first network (the default bridge for a
+ *  product container), or undefined when docker cannot say. */
+export declare function dockerAddress(containerId: string): Promise<string | undefined>;
 export declare function dockerRm(containerId: string): Promise<void>;
 /** Best-effort rename of a running container. The product is tracked by
  *  container id, never by name, so a rename failure (e.g. a stale container

package/docker-runner.js

@@ -1,5 +1,5 @@
 import { ProductError } from "./product-error.js";
-const CONTAINER_INTERNAL_PORT = 4321;
+export const CONTAINER_INTERNAL_PORT = 4321;
 /** Role label stamped on every product control-plane container. The daemon's
  *  infrastructure view discovers managed singletons by the presence of a
  *  `norsk-ctl.role` label (proxy, proxy-oauth2, cpu-monitor, product); the
@@ -53,6 +53,16 @@ export async function dockerRun(image, hostPort) {
     }
     return stdout;
 }
+/** The container's address on its first network (the default bridge for a
+ *  product container), or undefined when docker cannot say. */
+export async function dockerAddress(containerId) {
+    const proc = Bun.spawn(["docker", "inspect", "-f", "{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}", containerId], { stdout: "pipe", stderr: "pipe" });
+    const exitCode = await proc.exited;
+    const stdout = (await new Response(proc.stdout).text()).trim();
+    if (exitCode !== 0 || !stdout)
+        return undefined;
+    return stdout.split(/\s+/)[0];
+}
 export async function dockerRm(containerId) {
     const proc = Bun.spawn(["docker", "rm", "-f", containerId], { stdout: "pipe", stderr: "pipe" });
     await proc.exited;

package/index.d.ts

@@ -12,6 +12,7 @@ export * from "./manifest-fetch.js";
 export * from "./manifest-router.js";
 export * from "./openapi-router.js";
 export * from "./product-health-monitor.js";
+export * from "./product-reach.js";
 export * from "./product-service.js";
 export * from "./product-template-materials.js";
 export * from "./proxy-middleware.js";

package/index.js

@@ -14,6 +14,7 @@ export * from "./manifest-fetch.js";
 export * from "./manifest-router.js";
 export * from "./openapi-router.js";
 export * from "./product-health-monitor.js";
+export * from "./product-reach.js";
 export * from "./product-service.js";
 export * from "./product-template-materials.js";
 export * from "./proxy-middleware.js";

package/manifest-fetch.d.ts

@@ -1,5 +1,5 @@
 import { type Manifest } from "./manifest-schema.js";
-import type { ProductSpec } from "./product-types.js";
+import type { ProductRegistration, ProductSpec } from "./product-types.js";
 /**
  * Fast liveness probe for a registered product. A dev-mode product is
  * externally owned, so the only way to know it's actually up is to ask it.
@@ -8,7 +8,14 @@ import type { ProductSpec } from "./product-types.js";
  * because it runs on the product-list render path.
  */
 export declare function isDevUrlAlive(baseUrl: string): Promise<boolean>;
-export declare function specBaseUrl(spec: ProductSpec, port?: number): string;
+/** Where the daemon dials a product. A container product is loopback-published
+ *  on `port`; a daemon that itself runs in a container cannot reach that
+ *  loopback and dials the container's own address (`reachHost`) on the internal
+ *  port instead — see product-reach.ts. */
+export declare function specBaseUrl(spec: ProductSpec, port?: number, reachHost?: string): string;
+/** specBaseUrl for a registration — the one call every dial site should make,
+ *  so a recorded reachHost is never forgotten. */
+export declare function productBaseUrl(reg: Pick<ProductRegistration, "spec" | "port" | "reachHost">): string;
 export declare function fetchManifest(baseUrl: string): Promise<Manifest>;
 export declare function waitForReady(baseUrl: string): Promise<void>;
 /**

package/manifest-fetch.js

@@ -1,3 +1,4 @@
+import { CONTAINER_INTERNAL_PORT } from "./docker-runner.js";
 import { ManifestSchema } from "./manifest-schema.js";
 import { ProductError } from "./product-error.js";
 const READINESS_TIMEOUT_MS = 60_000;
@@ -19,13 +20,24 @@ export async function isDevUrlAlive(baseUrl) {
         return false;
     }
 }
-export function specBaseUrl(spec, port) {
+/** Where the daemon dials a product. A container product is loopback-published
+ *  on `port`; a daemon that itself runs in a container cannot reach that
+ *  loopback and dials the container's own address (`reachHost`) on the internal
+ *  port instead — see product-reach.ts. */
+export function specBaseUrl(spec, port, reachHost) {
     if (spec.kind === "dev")
         return spec.url.replace(/\/$/, "");
+    if (reachHost !== undefined)
+        return `http://${reachHost}:${CONTAINER_INTERNAL_PORT}`;
     if (port === undefined)
         throw new Error("container spec requires port");
     return `http://127.0.0.1:${port}`;
 }
+/** specBaseUrl for a registration — the one call every dial site should make,
+ *  so a recorded reachHost is never forgotten. */
+export function productBaseUrl(reg) {
+    return specBaseUrl(reg.spec, reg.port, reg.reachHost);
+}
 export async function fetchManifest(baseUrl) {
     let response;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-sdk",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "type": "module",
   "exports": {
     ".": {

package/product-health-monitor.js

@@ -1,5 +1,5 @@
 import { logger } from "@norskvideo/ctl-foundation";
-import { specBaseUrl } from "./manifest-fetch.js";
+import { productBaseUrl } from "./manifest-fetch.js";
 const UNKNOWN = { status: "unknown", consecutiveFailures: 0, restartAttempts: 0 };
 /**
  * Periodically probes each container product's health endpoint and, after
@@ -123,7 +123,7 @@ export async function probeProductHealth(reg, timeoutMs = 3_000) {
     if (reg.spec.kind !== "container" || reg.port === undefined)
         return false;
     const path = reg.manifest.api?.healthCheckPath ?? "/healthz";
-    const base = specBaseUrl(reg.spec, reg.port);
+    const base = productBaseUrl(reg);
     try {
         const r = await fetch(`${base}${path.startsWith("/") ? path : `/${path}`}`, {
             signal: AbortSignal.timeout(timeoutMs),

package/product-reach.d.ts

@@ -0,0 +1,9 @@
+export type ProductReach = "host" | "container-address";
+/** The 64-hex docker container id from a /proc/self/cgroup dump, or null on a
+ *  bare host. Present in both cgroup v1 (`/docker/<id>`) and v2
+ *  (`docker-<id>.scope`) layouts. */
+export declare function parseContainerIdFromCgroup(text: string): string | null;
+export declare function detectProductReach(opts: {
+    cgroup?: () => string;
+    env?: Record<string, string | undefined>;
+}): ProductReach;

package/product-reach.js

@@ -0,0 +1,32 @@
+// How the daemon reaches a product's control-plane container. The container is
+// loopback-published (`-p 127.0.0.1:<host port>:4321`), which is right when the
+// daemon runs on the docker host. When the daemon itself runs in a container —
+// a docker-outside-of-docker CI runner — that loopback belongs to the docker
+// host, not to the daemon, and every registration times out at readiness. The
+// container's own bridge address on the internal port is what such a daemon
+// can dial, so a containerised daemon uses that and remembers it on the
+// registration (`reachHost`). Detection reads the daemon's own cgroup, the
+// same tell the test harness uses; NORSK_CTL_PRODUCT_REACH overrides it.
+import { readFileSync } from "node:fs";
+const CGROUP_PATH = "/proc/self/cgroup";
+const REACH_ENV = "NORSK_CTL_PRODUCT_REACH";
+/** The 64-hex docker container id from a /proc/self/cgroup dump, or null on a
+ *  bare host. Present in both cgroup v1 (`/docker/<id>`) and v2
+ *  (`docker-<id>.scope`) layouts. */
+export function parseContainerIdFromCgroup(text) {
+    const m = text.match(/[0-9a-f]{64}/);
+    return m ? m[0] : null;
+}
+export function detectProductReach(opts) {
+    const env = opts.env ?? process.env;
+    const forced = env[REACH_ENV];
+    if (forced === "host" || forced === "container-address")
+        return forced;
+    const read = opts.cgroup ?? (() => readFileSync(CGROUP_PATH, "utf-8"));
+    try {
+        return parseContainerIdFromCgroup(read()) ? "container-address" : "host";
+    }
+    catch {
+        return "host";
+    }
+}

package/product-service.d.ts

@@ -1,4 +1,5 @@
 import { type LicenseStager } from "./license-registration.js";
+import { type ProductReach } from "./product-reach.js";
 import type { ProductTemplateSource } from "./product-template-record.js";
 import type { ProductLicense, ProductRegistration, ProductSpec } from "./product-types.js";
 /**
@@ -11,6 +12,22 @@ export interface AddProductResult {
     registration: ProductRegistration;
     warnings: string[];
 }
+/** Result of `reload`. `containerRestarted` is false for dev products, which
+ *  are externally owned. `productTemplates` reports the manifest-declared
+ *  default templates handed to the host's refresh callback: `skipped` carries
+ *  the host's reason (typically "in use"), and every skip is also a warning. */
+export interface ReloadProductResult {
+    registration: ProductRegistration;
+    warnings: string[];
+    containerRestarted: boolean;
+    productTemplates: {
+        refreshed: string[];
+        skipped: Array<{
+            name: string;
+            reason: string;
+        }>;
+    };
+}
 export interface AddProductOpts {
     /** Per-product license stored on the registration record (#313). Callers
      *  typically seed this from their global license setting when the operator
@@ -49,6 +66,13 @@ export type ImportProductTemplateBytesFn = (opts: {
         kind: "product-default";
     }>;
 }) => Promise<void>;
+/** `reload`'s counterpart to ImportProductTemplateBytesFn: re-render the
+ *  stored snapshot of a product-default template from fresh bytes, or store
+ *  it if the product only started declaring it. The host owns the refusal
+ *  rules (a template an instance is using, one that is not product-default);
+ *  it throws, and the SDK reports the message as a skip rather than failing
+ *  the reload. */
+export type RefreshProductTemplateBytesFn = ImportProductTemplateBytesFn;
 /** Every container operation this service performs, behind an interface so
  *  tests can drive them without shelling out to Docker. Defaults wire straight
  *  to docker-runner + the readiness probe. Reach for these rather than the
@@ -60,6 +84,10 @@ export interface ProductContainerOps {
     remove(containerId: string): Promise<void>;
     rename(containerId: string, name: string): Promise<void>;
     waitForReady(baseUrl: string): Promise<void>;
+    /** The container's own address, consulted only under reach
+     *  "container-address" (see product-reach.ts). Optional: a host without it
+     *  falls back to the loopback host port. */
+    address?(containerId: string): Promise<string | undefined>;
 }
 /** The real docker-runner wiring. Exported so a host can override one op
  *  (typically `pull`, onto its own docker adapter) and keep the rest. */
@@ -71,6 +99,9 @@ export interface ProductServiceOptions {
      *  registration time. Omit on hosts that don't store product templates
      *  (defaultProductTemplates is then silently skipped). */
     importProductTemplateBytes?: ImportProductTemplateBytesFn;
+    /** Optional: called once per `manifest.defaultProductTemplates` entry by
+     *  `reload`. Omit on hosts that don't store product templates. */
+    refreshProductTemplateBytes?: RefreshProductTemplateBytesFn;
     /** Optional: copy a byol licence somewhere the host owns, so the path
      *  recorded in the registry outlives whatever the operator passed in.
      *  Omit on hosts that don't stage (the operator's path is then recorded). */
@@ -81,6 +112,11 @@ export interface ProductServiceOptions {
     /** Container lifecycle ops used by add/remove/restart/stopAll/restoreAll.
      *  Injectable for tests; defaults to the real docker-runner functions. */
     containerOps?: ProductContainerOps;
+    /** How this daemon reaches a product container: the loopback host port
+     *  (a host daemon) or the container's own address (a daemon that is itself
+     *  in a container). Default: detected from the daemon's cgroup, overridable
+     *  with NORSK_CTL_PRODUCT_REACH. */
+    reach?: ProductReach;
 }
 export declare class ProductService {
     /**
@@ -101,10 +137,15 @@ export declare class ProductService {
     private readonly store;
     private readonly allocatePort;
     private readonly importProductTemplateBytes?;
+    private readonly refreshProductTemplateBytes?;
     private readonly stageLicense?;
     private readonly isDevUrlAlive;
     private readonly containerOps;
+    private readonly reach;
     constructor(opts: ProductServiceOptions);
+    /** The address to record for a freshly started container: its own, when
+     *  this daemon cannot dial the host loopback; otherwise nothing. */
+    private reachHostFor;
     list(): ProductRegistration[];
     /** Docker's default `--pull=missing` keeps whatever a moving tag resolved to
      *  last time, so a rebuilt `:latest`/`:dev` never reached a new registration.
@@ -119,7 +160,15 @@ export declare class ProductService {
     private addSerialised;
     remove(name: string): Promise<void>;
     private removeSerialised;
-    reload(name: string): Promise<ProductRegistration>;
+    /** Bring a registration up to date with what its image now serves. For a
+     *  container product: pull the tag (digests cannot move), re-run the
+     *  control plane on its recorded port, re-read the manifest, then hand every
+     *  manifest-declared default template to the host to re-render. Dev products
+     *  are externally owned, so only the manifest is re-read. This is the verb
+     *  the per-product "remove template, remove product, add again" scripts
+     *  stood in for. Like restart, the new container id is persisted before the
+     *  readiness wait so a timed-out reload leaves a tracked container. */
+    reload(name: string): Promise<ReloadProductResult>;
     private reloadSerialised;
     /** Stop every running container-kind product and clear its tracked
      *  containerId (model B: the daemon owns container lifecycle, so it reaps

package/product-service.js

@@ -1,11 +1,12 @@
 import { readFile } from "node:fs/promises";
 import { logger, Mutex } from "@norskvideo/ctl-foundation";
 import { validateDevUrl } from "./dev-url.js";
-import { dockerPull, dockerRename, dockerRm, dockerRun, isDigestRef, productContainerName } from "./docker-runner.js";
+import { dockerAddress, dockerPull, dockerRename, dockerRm, dockerRun, isDigestRef, productContainerName, } from "./docker-runner.js";
 import { resolveLicenseFile } from "./license-registration.js";
 import { checkProductEntitlement, notV2EnvelopeMessage, parseLicenseContents } from "./license-v2.js";
-import { fetchManifest, isDevUrlAlive, probeConfigScreen, specBaseUrl, waitForReady } from "./manifest-fetch.js";
+import { fetchManifest, isDevUrlAlive, probeConfigScreen, productBaseUrl, specBaseUrl, waitForReady, } from "./manifest-fetch.js";
 import { ProductError } from "./product-error.js";
+import { detectProductReach } from "./product-reach.js";
 /** GET a product-template tar from a product. `url` is whatever the manifest
  *  declared; we treat it as a path on the product's HTTP surface and
  *  resolve against the product's base URL. Returns the raw tar bytes,
@@ -32,6 +33,7 @@ export const defaultProductContainerOps = {
     remove: dockerRm,
     rename: dockerRename,
     waitForReady,
+    address: dockerAddress,
 };
 export class ProductService {
     /**
@@ -52,16 +54,27 @@ export class ProductService {
     store;
     allocatePort;
     importProductTemplateBytes;
+    refreshProductTemplateBytes;
     stageLicense;
     isDevUrlAlive;
     containerOps;
+    reach;
     constructor(opts) {
         this.store = opts.store;
         this.allocatePort = opts.allocatePort;
         this.importProductTemplateBytes = opts.importProductTemplateBytes;
+        this.refreshProductTemplateBytes = opts.refreshProductTemplateBytes;
         this.stageLicense = opts.stageLicense;
         this.isDevUrlAlive = opts.isDevUrlAlive ?? isDevUrlAlive;
         this.containerOps = opts.containerOps ?? defaultProductContainerOps;
+        this.reach = opts.reach ?? detectProductReach({});
+    }
+    /** The address to record for a freshly started container: its own, when
+     *  this daemon cannot dial the host loopback; otherwise nothing. */
+    async reachHostFor(containerId) {
+        if (this.reach !== "container-address" || !this.containerOps.address)
+            return undefined;
+        return this.containerOps.address(containerId);
     }
     list() {
         return this.store.read();
@@ -88,7 +101,7 @@ export class ProductService {
     async isRunning(reg) {
         if (reg.spec.kind === "container")
             return reg.containerId !== undefined;
-        return this.isDevUrlAlive(specBaseUrl(reg.spec));
+        return this.isDevUrlAlive(productBaseUrl(reg));
     }
     async add(spec, opts = {}) {
         return this.mutations.run(() => this.addSerialised(spec, opts));
@@ -98,6 +111,7 @@ export class ProductService {
         let baseUrl;
         let port;
         let containerId;
+        let reachHost;
         if (spec.kind === "dev") {
             validateDevUrl(spec.url);
             baseUrl = specBaseUrl(spec);
@@ -115,7 +129,8 @@ export class ProductService {
             await this.refreshImage(spec.image);
             logger.info(`Starting product container: ${spec.image} on host port ${port}`);
             containerId = await this.containerOps.run(spec.image, port);
-            baseUrl = specBaseUrl(spec, port);
+            reachHost = await this.reachHostFor(containerId);
+            baseUrl = specBaseUrl(spec, port, reachHost);
         }
         try {
             await this.containerOps.waitForReady(baseUrl);
@@ -219,6 +234,7 @@ export class ProductService {
             manifest,
             ...(port !== undefined ? { port } : {}),
             ...(containerId !== undefined ? { containerId } : {}),
+            ...(reachHost !== undefined ? { reachHost } : {}),
             ...(opts.license !== undefined
                 ? {
                     license: opts.license.mode === "byol" && licenseFile !== undefined
@@ -272,23 +288,78 @@ export class ProductService {
         await this.store.update((products) => products.filter((p) => p.name !== name));
         logger.info(`Product '${name}' removed`);
     }
+    /** Bring a registration up to date with what its image now serves. For a
+     *  container product: pull the tag (digests cannot move), re-run the
+     *  control plane on its recorded port, re-read the manifest, then hand every
+     *  manifest-declared default template to the host to re-render. Dev products
+     *  are externally owned, so only the manifest is re-read. This is the verb
+     *  the per-product "remove template, remove product, add again" scripts
+     *  stood in for. Like restart, the new container id is persisted before the
+     *  readiness wait so a timed-out reload leaves a tracked container. */
     async reload(name) {
         return this.mutations.run(() => this.reloadSerialised(name));
     }
     async reloadSerialised(name) {
-        const existing = this.store.read();
-        const target = existing.find((p) => p.name === name);
+        const target = this.store.read().find((p) => p.name === name);
         if (!target)
             throw new ProductError("NOT_FOUND", `product '${name}' not registered`);
-        const baseUrl = specBaseUrl(target.spec, target.port);
+        let containerRestarted = false;
+        if (target.spec.kind === "container") {
+            if (target.port === undefined) {
+                throw new ProductError("NOT_RESTARTABLE", `product '${name}' has no recorded port — cannot reload`);
+            }
+            await this.refreshImage(target.spec.image);
+            if (target.containerId) {
+                try {
+                    await this.containerOps.remove(target.containerId);
+                }
+                catch {
+                    // Already gone (crashed / --rm reaped) — nothing to stop.
+                }
+            }
+            const containerId = await this.containerOps.run(target.spec.image, target.port);
+            const reachHost = await this.reachHostFor(containerId);
+            await this.store.update((products) => products.map((p) => (p.name === name ? withContainerId(p, containerId, reachHost) : p)));
+            await this.containerOps.waitForReady(specBaseUrl(target.spec, target.port, reachHost));
+            await this.containerOps.rename(containerId, productContainerName(name));
+            containerRestarted = true;
+        }
+        const current = this.store.read().find((p) => p.name === name) ?? target;
+        const baseUrl = productBaseUrl(current);
         const manifest = await fetchManifest(baseUrl);
         if (manifest.name !== target.name) {
             throw new ProductError("NAME_CONFLICT", `manifest now reports name '${manifest.name}', was '${target.name}' — use remove + add`);
         }
-        const next = { ...target, manifest };
-        await this.store.update((products) => products.map((p) => (p.name === name ? next : p)));
-        logger.info(`Product '${name}' manifest reloaded`);
-        return next;
+        const updated = await this.store.update((products) => products.map((p) => (p.name === name ? { ...p, manifest } : p)));
+        const registration = updated.find((p) => p.name === name);
+        logger.info(`Product '${name}' reloaded${containerRestarted ? " (container re-run)" : ""}`);
+        // Same downgrade as add's default-template import: the product itself is
+        // healthy, so a template the host refuses (in use, foreign) or a fetch
+        // that fails is a warning the operator acts on, not a failed reload.
+        const warnings = [];
+        const productTemplates = { refreshed: [], skipped: [] };
+        if (this.refreshProductTemplateBytes) {
+            for (const entry of manifest.defaultProductTemplates) {
+                try {
+                    const bytes = await fetchProductTemplateBytes(baseUrl, entry.url);
+                    await this.refreshProductTemplateBytes({
+                        name: entry.name,
+                        bytes,
+                        source: { kind: "product-default", productName: manifest.name, url: entry.url },
+                    });
+                    productTemplates.refreshed.push(entry.name);
+                    logger.info(`Product '${name}': refreshed default product template '${entry.name}' from ${entry.url}`);
+                }
+                catch (e) {
+                    const reason = e instanceof Error ? e.message : String(e);
+                    productTemplates.skipped.push({ name: entry.name, reason });
+                    warnings.push(`default product template '${entry.name}' not refreshed: ${reason}`);
+                }
+            }
+        }
+        for (const w of warnings)
+            logger.warn(`[product:${name}] ${w}`);
+        return { registration, warnings, containerRestarted, productTemplates };
     }
     /** Stop every running container-kind product and clear its tracked
      *  containerId (model B: the daemon owns container lifecycle, so it reaps
@@ -338,9 +409,10 @@ export class ProductService {
             }
             try {
                 const containerId = await this.containerOps.run(reg.spec.image, reg.port);
-                await this.containerOps.waitForReady(specBaseUrl(reg.spec, reg.port));
+                const reachHost = await this.reachHostFor(containerId);
+                await this.containerOps.waitForReady(specBaseUrl(reg.spec, reg.port, reachHost));
                 await this.containerOps.rename(containerId, productContainerName(reg.name));
-                restored.set(reg.name, containerId);
+                restored.set(reg.name, { containerId, reachHost });
                 logger.info(`Product '${reg.name}' container restored on host port ${reg.port}`);
             }
             catch (e) {
@@ -348,7 +420,12 @@ export class ProductService {
                 logger.warn(`Product '${reg.name}': failed to restore — ${e instanceof Error ? e.message : String(e)}`);
             }
         }));
-        await this.store.update((products) => products.map((p) => (restored.has(p.name) ? withContainerId(p, restored.get(p.name)) : p)));
+        await this.store.update((products) => products.map((p) => {
+            if (!restored.has(p.name))
+                return p;
+            const r = restored.get(p.name);
+            return withContainerId(p, r?.containerId, r?.reachHost);
+        }));
     }
     /** Stop (if still present) and relaunch a single container-kind product,
      *  recording the fresh containerId. Used by the health monitor to recover a
@@ -379,15 +456,20 @@ export class ProductService {
             }
         }
         const containerId = await this.containerOps.run(target.spec.image, target.port);
-        await this.store.update((products) => products.map((p) => (p.name === name ? withContainerId(p, containerId) : p)));
-        await this.containerOps.waitForReady(specBaseUrl(target.spec, target.port));
+        const reachHost = await this.reachHostFor(containerId);
+        await this.store.update((products) => products.map((p) => (p.name === name ? withContainerId(p, containerId, reachHost) : p)));
+        await this.containerOps.waitForReady(specBaseUrl(target.spec, target.port, reachHost));
         await this.containerOps.rename(containerId, productContainerName(name));
         logger.info(`Product '${name}' container restarted on host port ${target.port}`);
     }
 }
-/** Return a copy of `reg` with containerId set (or removed when undefined),
- *  preserving the "omit the key entirely" shape the store round-trips. */
-function withContainerId(reg, containerId) {
-    const { containerId: _drop, ...rest } = reg;
-    return containerId === undefined ? rest : { ...rest, containerId };
+/** Return a copy of `reg` with containerId (and the address it was reached at)
+ *  set, or both removed when undefined, preserving the "omit the key entirely"
+ *  shape the store round-trips. A stale reachHost would point the health
+ *  monitor at a container that no longer exists, so it travels with the id. */
+function withContainerId(reg, containerId, reachHost) {
+    const { containerId: _drop, reachHost: _dropHost, ...rest } = reg;
+    if (containerId === undefined)
+        return rest;
+    return { ...rest, containerId, ...(reachHost !== undefined ? { reachHost } : {}) };
 }

package/product-types.d.ts

@@ -25,6 +25,10 @@ export interface ProductRegistration {
     port?: number;
     /** Docker container ID (container mode only). */
     containerId?: string;
+    /** The container's own address, recorded when the daemon runs in a
+     *  container and cannot dial the loopback-published host port (see
+     *  product-reach.ts). Absent on a host daemon: 127.0.0.1:<port> is right. */
+    reachHost?: string;
     /** Absent on registrations that predate per-product licenses — launches
      *  fall back to the host's global license setting. */
     license?: ProductLicense;

package/proxy-middleware.js

@@ -1,8 +1,9 @@
 import { logger } from "@norskvideo/ctl-foundation";
 import { buildForwardHeaders, forwardUpstreamResponse, readRequestBody } from "./http-proxy.js";
+import { productBaseUrl } from "./manifest-fetch.js";
 function targetBaseUrl(reg) {
     if (reg.spec.kind === "container") {
-        return reg.port !== undefined ? `http://127.0.0.1:${reg.port}` : null;
+        return reg.port !== undefined ? productBaseUrl(reg) : null;
     }
     return reg.spec.url.replace(/\/$/, "");
 }