openlattice-docker 0.0.3

package/tests/docker-provider.test.ts

@@ -0,0 +1,762 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { DockerProvider } from "../src/docker-provider";
+
+// ── Mock dockerode ──────────────────────────────────────────────────
+// vi.mock is hoisted, so all referenced variables must also be hoisted
+// via vi.hoisted() to avoid temporal dead zone issues.
+
+const mocks = vi.hoisted(() => {
+  const mockExecInspect = vi.fn().mockResolvedValue({
+    Running: false,
+    ExitCode: 0,
+  });
+
+  const mockExecStart = vi.fn().mockImplementation(() => {
+    const { PassThrough } = require("stream");
+    const stream = new PassThrough();
+    setTimeout(() => stream.end(), 10);
+    return Promise.resolve(stream);
+  });
+
+  const mockExec = vi.fn().mockResolvedValue({
+    start: mockExecStart,
+    inspect: mockExecInspect,
+  });
+
+  const mockRemove = vi.fn().mockResolvedValue(undefined);
+  const mockStart = vi.fn().mockResolvedValue(undefined);
+  const mockStop = vi.fn().mockResolvedValue(undefined);
+  const mockPause = vi.fn().mockResolvedValue(undefined);
+  const mockUnpause = vi.fn().mockResolvedValue(undefined);
+  const mockCommit = vi
+    .fn()
+    .mockResolvedValue({ Id: "sha256:snapshot_image_123" });
+  const mockStats = vi.fn().mockResolvedValue({
+    cpu_stats: {
+      cpu_usage: { total_usage: 100000, percpu_usage: [100000] },
+      system_cpu_usage: 1000000,
+      online_cpus: 1,
+    },
+    precpu_stats: {
+      cpu_usage: { total_usage: 50000 },
+      system_cpu_usage: 500000,
+    },
+    memory_stats: { usage: 256 * 1024 * 1024 },
+  });
+
+  const mockInspect = vi.fn().mockResolvedValue({
+    Id: "abc123def456",
+    State: {
+      Status: "running",
+      StartedAt: "2026-01-15T10:00:00.000Z",
+    },
+    NetworkSettings: {
+      Ports: {
+        "8080/tcp": [{ HostIp: "0.0.0.0", HostPort: "8080" }],
+      },
+    },
+  });
+
+  const mockLogs = vi.fn().mockImplementation(() => {
+    const { PassThrough } = require("stream");
+    return Promise.resolve(new PassThrough());
+  });
+
+  const mockContainer = {
+    id: "abc123def456",
+    start: mockStart,
+    stop: mockStop,
+    pause: mockPause,
+    unpause: mockUnpause,
+    remove: mockRemove,
+    inspect: mockInspect,
+    exec: mockExec,
+    commit: mockCommit,
+    stats: mockStats,
+    logs: mockLogs,
+  };
+
+  const mockCreateContainer = vi.fn().mockResolvedValue(mockContainer);
+
+  const mockDocker = {
+    createContainer: mockCreateContainer,
+    getContainer: vi.fn().mockReturnValue(mockContainer),
+    ping: vi.fn().mockResolvedValue("OK"),
+    info: vi.fn().mockResolvedValue({ Runtimes: {} }),
+    modem: { demuxStream: vi.fn() },
+  };
+
+  return {
+    mockExecInspect,
+    mockExecStart,
+    mockExec,
+    mockRemove,
+    mockStart,
+    mockStop,
+    mockPause,
+    mockUnpause,
+    mockCommit,
+    mockStats,
+    mockInspect,
+    mockLogs,
+    mockContainer,
+    mockCreateContainer,
+    mockDocker,
+  };
+});
+
+vi.mock("dockerode", () => ({
+  default: vi.fn(function () {
+    return mocks.mockDocker;
+  }),
+}));
+
+// ── Tests ───────────────────────────────────────────────────────────
+
+describe("DockerProvider", () => {
+  let provider: DockerProvider;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    // Restore default implementations after clearAllMocks
+    mocks.mockExecInspect.mockResolvedValue({ Running: false, ExitCode: 0 });
+    mocks.mockExecStart.mockImplementation(() => {
+      const { PassThrough } = require("stream");
+      const stream = new PassThrough();
+      setTimeout(() => stream.end(), 10);
+      return Promise.resolve(stream);
+    });
+    mocks.mockExec.mockResolvedValue({
+      start: mocks.mockExecStart,
+      inspect: mocks.mockExecInspect,
+    });
+    mocks.mockRemove.mockResolvedValue(undefined);
+    mocks.mockStart.mockResolvedValue(undefined);
+    mocks.mockStop.mockResolvedValue(undefined);
+    mocks.mockPause.mockResolvedValue(undefined);
+    mocks.mockUnpause.mockResolvedValue(undefined);
+    mocks.mockCommit.mockResolvedValue({ Id: "sha256:snapshot_image_123" });
+    mocks.mockStats.mockResolvedValue({
+      cpu_stats: {
+        cpu_usage: { total_usage: 100000, percpu_usage: [100000] },
+        system_cpu_usage: 1000000,
+        online_cpus: 1,
+      },
+      precpu_stats: {
+        cpu_usage: { total_usage: 50000 },
+        system_cpu_usage: 500000,
+      },
+      memory_stats: { usage: 256 * 1024 * 1024 },
+    });
+    mocks.mockInspect.mockResolvedValue({
+      Id: "abc123def456",
+      State: {
+        Status: "running",
+        StartedAt: "2026-01-15T10:00:00.000Z",
+      },
+      NetworkSettings: {
+        Ports: {
+          "8080/tcp": [{ HostIp: "0.0.0.0", HostPort: "8080" }],
+        },
+      },
+    });
+    mocks.mockLogs.mockImplementation(() => {
+      const { PassThrough } = require("stream");
+      return Promise.resolve(new PassThrough());
+    });
+    mocks.mockCreateContainer.mockResolvedValue(mocks.mockContainer);
+    mocks.mockDocker.getContainer.mockReturnValue(mocks.mockContainer);
+    mocks.mockDocker.ping.mockResolvedValue("OK");
+    mocks.mockDocker.info.mockResolvedValue({ Runtimes: {} });
+
+    provider = new DockerProvider({});
+  });
+
+  describe("constructor", () => {
+    it("sets name to 'docker'", () => {
+      expect(provider.name).toBe("docker");
+    });
+
+    it("declares expected capabilities", () => {
+      expect(provider.capabilities.restart).toBe(true);
+      expect(provider.capabilities.pause).toBe(true);
+      expect(provider.capabilities.snapshot).toBe(true);
+      expect(provider.capabilities.logs).toBe(true);
+      expect(provider.capabilities.tailscale).toBe(true);
+      expect(provider.capabilities.persistentStorage).toBe(true);
+      expect(provider.capabilities.architectures).toContain("x86_64");
+      expect(provider.capabilities.architectures).toContain("arm64");
+    });
+
+    it("defaults gpu to false without explicit config", () => {
+      expect(provider.capabilities.gpu).toBe(false);
+    });
+
+    it("respects gpuAvailable config", () => {
+      const gpuProvider = new DockerProvider({ gpuAvailable: true });
+      expect(gpuProvider.capabilities.gpu).toBe(true);
+    });
+  });
+
+  describe("provision", () => {
+    it("creates and starts a container", async () => {
+      const node = await provider.provision({
+        runtime: { image: "python:3.11" },
+      });
+
+      expect(mocks.mockCreateContainer).toHaveBeenCalledOnce();
+      expect(mocks.mockStart).toHaveBeenCalledOnce();
+      expect(mocks.mockInspect).toHaveBeenCalledOnce();
+      expect(node.externalId).toBe("abc123def456");
+    });
+
+    it("maps runtime image to Docker Image option", async () => {
+      await provider.provision({
+        runtime: { image: "node:20-alpine" },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.Image).toBe("node:20-alpine");
+    });
+
+    it("maps runtime command to Cmd", async () => {
+      await provider.provision({
+        runtime: { image: "alpine", command: ["sh", "-c", "echo hello"] },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.Cmd).toEqual(["sh", "-c", "echo hello"]);
+    });
+
+    it("maps runtime env to Env array", async () => {
+      await provider.provision({
+        runtime: { image: "alpine", env: { FOO: "bar", BAZ: "qux" } },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.Env).toEqual(["FOO=bar", "BAZ=qux"]);
+    });
+
+    it("maps CPU cores to NanoCpus", async () => {
+      await provider.provision({
+        runtime: { image: "alpine" },
+        cpu: { cores: 4 },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.HostConfig.NanoCpus).toBe(4e9);
+    });
+
+    it("maps memory GiB to bytes", async () => {
+      await provider.provision({
+        runtime: { image: "alpine" },
+        memory: { sizeGiB: 2 },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.HostConfig.Memory).toBe(2 * 1024 * 1024 * 1024);
+    });
+
+    it("maps GPU spec to DeviceRequests", async () => {
+      const gpuProvider = new DockerProvider({ gpuAvailable: true });
+      await gpuProvider.provision({
+        runtime: { image: "nvidia/cuda" },
+        gpu: { count: 2 },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.HostConfig.DeviceRequests).toEqual([
+        {
+          Driver: "nvidia",
+          Count: 2,
+          Capabilities: [["gpu"]],
+        },
+      ]);
+    });
+
+    it("maps port bindings", async () => {
+      await provider.provision({
+        runtime: { image: "alpine" },
+        network: { ports: [{ port: 3000, protocol: "tcp" }] },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.HostConfig.PortBindings).toEqual({
+        "3000/tcp": [{ HostPort: "3000" }],
+      });
+      expect(opts.ExposedPorts).toEqual({ "3000/tcp": {} });
+    });
+
+    it("applies openlattice.managed and node-id labels", async () => {
+      await provider.provision({
+        runtime: { image: "alpine" },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.Labels["openlattice.managed"]).toBe("true");
+      expect(opts.Labels["openlattice.node-id"]).toBeDefined();
+    });
+
+    it("applies spec labels and default labels", async () => {
+      const labelProvider = new DockerProvider({
+        defaultLabels: { env: "test" },
+      });
+      await labelProvider.provision({
+        runtime: { image: "alpine" },
+        labels: { team: "ml" },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.Labels.team).toBe("ml");
+      expect(opts.Labels.env).toBe("test");
+    });
+
+    it("uses spec.name directly as container name", async () => {
+      await provider.provision({
+        name: "my-service",
+        runtime: { image: "alpine" },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.name).toBe("my-service");
+    });
+
+    it("sets Hostname from spec.name", async () => {
+      await provider.provision({
+        name: "my-service",
+        runtime: { image: "alpine" },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.Hostname).toBe("my-service");
+    });
+
+    it("extracts endpoints from port bindings", async () => {
+      const node = await provider.provision({
+        runtime: { image: "alpine" },
+      });
+
+      expect(node.endpoints).toHaveLength(1);
+      expect(node.endpoints[0].type).toBe("tcp");
+      expect(node.endpoints[0].host).toBe("localhost");
+      expect(node.endpoints[0].port).toBe(8080);
+    });
+
+    it("includes network-internal endpoints on named networks", async () => {
+      const netProvider = new DockerProvider({ network: "swarmhub" });
+
+      mocks.mockInspect.mockResolvedValueOnce({
+        Id: "abc123def456",
+        Name: "/my-service",
+        State: {
+          Status: "running",
+          StartedAt: "2026-01-15T10:00:00.000Z",
+        },
+        NetworkSettings: {
+          Ports: {
+            "8080/tcp": [{ HostIp: "0.0.0.0", HostPort: "8080" }],
+          },
+          Networks: {
+            swarmhub: {
+              IPAddress: "172.20.0.5",
+              IPPrefixLen: 16,
+            },
+          },
+        },
+      });
+
+      const node = await netProvider.provision({
+        name: "my-service",
+        runtime: { image: "alpine" },
+        network: { ports: [{ port: 8080 }] },
+      });
+
+      const hostEndpoint = node.endpoints.find((e) => e.type === "tcp");
+      expect(hostEndpoint).toBeDefined();
+      expect(hostEndpoint!.host).toBe("localhost");
+      expect(hostEndpoint!.port).toBe(8080);
+
+      const internalEndpoint = node.endpoints.find(
+        (e) => e.type === "docker-internal"
+      );
+      expect(internalEndpoint).toBeDefined();
+      expect(internalEndpoint!.host).toBe("my-service");
+      expect(internalEndpoint!.port).toBe(8080);
+      expect(internalEndpoint!.url).toBe("http://my-service:8080");
+    });
+
+    it("does not add internal endpoints on bridge network", async () => {
+      const bridgeProvider = new DockerProvider({ network: "bridge" });
+
+      const node = await bridgeProvider.provision({
+        runtime: { image: "alpine" },
+      });
+
+      const internal = node.endpoints.filter(
+        (e) => e.type === "docker-internal"
+      );
+      expect(internal).toHaveLength(0);
+    });
+
+    it("defaults to sleep command when no command specified", async () => {
+      await provider.provision({
+        runtime: { image: "alpine" },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.Cmd).toEqual(["sh", "-c", "sleep infinity"]);
+    });
+
+    it("adds CAP_NET_ADMIN and /dev/net/tun when tailscale is true", async () => {
+      await provider.provision({
+        runtime: { image: "tailscale/alpine" },
+        network: { tailscale: true },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.HostConfig.CapAdd).toEqual(["NET_ADMIN"]);
+      expect(opts.HostConfig.Devices).toEqual([
+        {
+          PathOnHost: "/dev/net/tun",
+          PathInContainer: "/dev/net/tun",
+          CgroupPermissions: "rwm",
+        },
+      ]);
+    });
+
+    it("does not add tailscale caps when tailscale is false/undefined", async () => {
+      await provider.provision({
+        runtime: { image: "alpine" },
+        network: { ports: [{ port: 8080 }] },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.HostConfig.CapAdd).toBeUndefined();
+      expect(opts.HostConfig.Devices).toBeUndefined();
+    });
+
+    it("combines tailscale with port bindings", async () => {
+      await provider.provision({
+        runtime: { image: "tailscale/alpine" },
+        network: { tailscale: true, ports: [{ port: 3000 }] },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.HostConfig.CapAdd).toEqual(["NET_ADMIN"]);
+      expect(opts.HostConfig.Devices).toHaveLength(1);
+      expect(opts.HostConfig.PortBindings).toEqual({
+        "3000/tcp": [{ HostPort: "3000" }],
+      });
+    });
+
+    it("adds CAP_NET_ADMIN when tailscaleAuthKey is set without tailscale: true", async () => {
+      await provider.provision({
+        runtime: { image: "tailscale/alpine" },
+        network: { tailscaleAuthKey: "tskey-auth-abc123" },
+      });
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.HostConfig.CapAdd).toEqual(["NET_ADMIN"]);
+      expect(opts.HostConfig.Devices).toHaveLength(1);
+    });
+
+    it("calls tailscale up via exec when tailscaleAuthKey is set", async () => {
+      await provider.provision({
+        runtime: { image: "tailscale/alpine" },
+        network: { tailscaleAuthKey: "tskey-auth-abc123" },
+      });
+
+      // Should have exec'd at least twice during provision:
+      // 1. tailscaled daemon check
+      // 2. tailscale up --authkey
+      const execCalls = mocks.mockExec.mock.calls;
+      const cmds = execCalls.map((c: any) => c[0]?.Cmd ?? []);
+      const hasAuthKey = cmds.some(
+        (cmd: string[]) =>
+          cmd.includes("tailscale") && cmd.includes("tskey-auth-abc123")
+      );
+      expect(hasAuthKey).toBe(true);
+    });
+  });
+
+  describe("exec", () => {
+    it("creates and starts an exec instance", async () => {
+      const result = await provider.exec("abc123", ["echo", "hello"]);
+
+      expect(mocks.mockExec).toHaveBeenCalledOnce();
+      expect(mocks.mockExecStart).toHaveBeenCalledOnce();
+      expect(result.exitCode).toBe(0);
+    });
+
+    it("passes command to exec create", async () => {
+      await provider.exec("abc123", ["ls", "-la"]);
+
+      const execOpts = mocks.mockExec.mock.calls[0][0];
+      expect(execOpts.Cmd).toEqual(["ls", "-la"]);
+    });
+
+    it("passes cwd and env to exec create", async () => {
+      await provider.exec("abc123", ["npm", "test"], {
+        cwd: "/app",
+        env: { NODE_ENV: "test" },
+      });
+
+      const execOpts = mocks.mockExec.mock.calls[0][0];
+      expect(execOpts.WorkingDir).toBe("/app");
+      expect(execOpts.Env).toEqual(["NODE_ENV=test"]);
+    });
+
+    it("polls exec.inspect for completion", async () => {
+      // Simulate exec running then completing
+      mocks.mockExecInspect
+        .mockResolvedValueOnce({ Running: true, ExitCode: null })
+        .mockResolvedValueOnce({ Running: false, ExitCode: 0 });
+
+      const result = await provider.exec("abc123", ["echo", "hi"]);
+      expect(result.exitCode).toBe(0);
+      expect(mocks.mockExecInspect).toHaveBeenCalledTimes(2);
+    });
+
+    it("returns correct exit code from exec", async () => {
+      mocks.mockExecInspect.mockResolvedValueOnce({
+        Running: false,
+        ExitCode: 42,
+      });
+
+      const result = await provider.exec("abc123", ["false"]);
+      expect(result.exitCode).toBe(42);
+    });
+  });
+
+  describe("inspect", () => {
+    it("maps running Docker state to running", async () => {
+      mocks.mockInspect.mockResolvedValueOnce({
+        State: { Status: "running", StartedAt: "2026-01-01T00:00:00Z" },
+        NetworkSettings: { Ports: {} },
+      });
+
+      const status = await provider.inspect("abc123");
+      expect(status.status).toBe("running");
+    });
+
+    it("maps paused Docker state to paused", async () => {
+      mocks.mockInspect.mockResolvedValueOnce({
+        State: { Status: "paused", StartedAt: "2026-01-01T00:00:00Z" },
+        NetworkSettings: { Ports: {} },
+      });
+
+      const status = await provider.inspect("abc123");
+      expect(status.status).toBe("paused");
+    });
+
+    it("maps exited Docker state to stopped", async () => {
+      mocks.mockInspect.mockResolvedValueOnce({
+        State: { Status: "exited", StartedAt: "2026-01-01T00:00:00Z" },
+        NetworkSettings: { Ports: {} },
+      });
+
+      const status = await provider.inspect("abc123");
+      expect(status.status).toBe("stopped");
+    });
+
+    it("maps dead Docker state to stopped", async () => {
+      mocks.mockInspect.mockResolvedValueOnce({
+        State: { Status: "dead" },
+        NetworkSettings: { Ports: {} },
+      });
+
+      const status = await provider.inspect("abc123");
+      expect(status.status).toBe("stopped");
+    });
+
+    it("returns terminated for 404 (container not found)", async () => {
+      mocks.mockInspect.mockRejectedValueOnce(
+        Object.assign(new Error("not found"), { statusCode: 404 })
+      );
+
+      const status = await provider.inspect("gone");
+      expect(status.status).toBe("terminated");
+    });
+
+    it("includes resource usage from stats", async () => {
+      const status = await provider.inspect("abc123");
+      expect(status.resources).toBeDefined();
+      expect(status.resources!.cpuPercent).toBeTypeOf("number");
+      expect(status.resources!.memoryUsedMiB).toBeTypeOf("number");
+    });
+
+    it("parses startedAt date", async () => {
+      const status = await provider.inspect("abc123");
+      expect(status.startedAt).toBeInstanceOf(Date);
+    });
+  });
+
+  describe("destroy", () => {
+    it("force-removes the container with volumes", async () => {
+      await provider.destroy("abc123");
+      expect(mocks.mockRemove).toHaveBeenCalledWith(
+        expect.objectContaining({ force: true, v: true })
+      );
+    });
+
+    it("is idempotent for 404 (already removed)", async () => {
+      mocks.mockRemove.mockRejectedValueOnce(
+        Object.assign(new Error("not found"), { statusCode: 404 })
+      );
+
+      await expect(provider.destroy("abc123")).resolves.toBeUndefined();
+    });
+
+    it("throws on non-404 errors", async () => {
+      mocks.mockRemove.mockRejectedValueOnce(new Error("permission denied"));
+
+      await expect(provider.destroy("abc123")).rejects.toThrow(
+        "[docker] destroy failed"
+      );
+    });
+  });
+
+  describe("stop / start", () => {
+    it("stops the container with 10s grace period", async () => {
+      await provider.stop("abc123");
+      expect(mocks.mockStop).toHaveBeenCalledWith({ t: 10 });
+    });
+
+    it("stop is idempotent for 304 (already stopped)", async () => {
+      mocks.mockStop.mockRejectedValueOnce(
+        Object.assign(new Error("not modified"), { statusCode: 304 })
+      );
+
+      await expect(provider.stop("abc123")).resolves.toBeUndefined();
+    });
+
+    it("starts the container", async () => {
+      await provider.start("abc123");
+      expect(mocks.mockStart).toHaveBeenCalledOnce();
+    });
+
+    it("start is idempotent for 304 (already running)", async () => {
+      mocks.mockStart.mockRejectedValueOnce(
+        Object.assign(new Error("not modified"), { statusCode: 304 })
+      );
+
+      await expect(provider.start("abc123")).resolves.toBeUndefined();
+    });
+  });
+
+  describe("pause / resume", () => {
+    it("pauses the container", async () => {
+      await provider.pause("abc123");
+      expect(mocks.mockPause).toHaveBeenCalledOnce();
+    });
+
+    it("resumes (unpauses) the container", async () => {
+      await provider.resume("abc123");
+      expect(mocks.mockUnpause).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe("snapshot / restore", () => {
+    it("commits the container as an image", async () => {
+      const ref = await provider.snapshot("abc123");
+
+      expect(mocks.mockCommit).toHaveBeenCalledWith(
+        expect.objectContaining({ repo: "openlattice-snapshot" })
+      );
+      expect(ref.provider).toBe("docker");
+      expect(ref.externalId).toBe("sha256:snapshot_image_123");
+      expect(ref.type).toBe("filesystem");
+      expect(ref.createdAt).toBeInstanceOf(Date);
+    });
+
+    it("restores by provisioning from snapshot image", async () => {
+      const ref = {
+        provider: "docker",
+        externalId: "sha256:snapshot_image_123",
+        createdAt: new Date(),
+        type: "filesystem" as const,
+      };
+
+      const node = await provider.restore(ref);
+
+      const opts = mocks.mockCreateContainer.mock.calls[0][0];
+      expect(opts.Image).toBe("sha256:snapshot_image_123");
+      expect(node.externalId).toBeTruthy();
+    });
+  });
+
+  describe("healthCheck", () => {
+    it("returns healthy when Docker daemon is reachable", async () => {
+      const health = await provider.healthCheck();
+
+      expect(health.healthy).toBe(true);
+      expect(health.latencyMs).toBeTypeOf("number");
+      expect(mocks.mockDocker.ping).toHaveBeenCalledOnce();
+    });
+
+    it("returns unhealthy when Docker daemon is unreachable", async () => {
+      mocks.mockDocker.ping.mockRejectedValueOnce(
+        new Error("connection refused")
+      );
+
+      const health = await provider.healthCheck();
+
+      expect(health.healthy).toBe(false);
+      expect(health.message).toContain("connection refused");
+    });
+  });
+
+  describe("getExtension", () => {
+    it("returns network extension", () => {
+      const ext = provider.getExtension("abc123", "network");
+      expect(ext).toBeDefined();
+      expect(ext).toHaveProperty("getUrl");
+    });
+
+    it("returns files extension", () => {
+      const ext = provider.getExtension("abc123", "files");
+      expect(ext).toBeDefined();
+      expect(ext).toHaveProperty("read");
+      expect(ext).toHaveProperty("write");
+      expect(ext).toHaveProperty("list");
+      expect(ext).toHaveProperty("remove");
+      expect(ext).toHaveProperty("mkdir");
+    });
+
+    it("returns metrics extension", () => {
+      const ext = provider.getExtension("abc123", "metrics");
+      expect(ext).toBeDefined();
+      expect(ext).toHaveProperty("getResourceUsage");
+      expect(ext).toHaveProperty("streamMetrics");
+    });
+  });
+
+  describe("detectGpu", () => {
+    it("detects nvidia runtime", async () => {
+      mocks.mockDocker.info.mockResolvedValueOnce({
+        Runtimes: { nvidia: {}, runc: {} },
+      });
+
+      const hasGpu = await provider.detectGpu();
+      expect(hasGpu).toBe(true);
+      expect(provider.capabilities.gpu).toBe(true);
+    });
+
+    it("returns false when no nvidia runtime", async () => {
+      mocks.mockDocker.info.mockResolvedValueOnce({
+        Runtimes: { runc: {} },
+      });
+
+      const hasGpu = await provider.detectGpu();
+      expect(hasGpu).toBe(false);
+      expect(provider.capabilities.gpu).toBe(false);
+    });
+
+    it("returns false on error", async () => {
+      mocks.mockDocker.info.mockRejectedValueOnce(new Error("unreachable"));
+
+      const hasGpu = await provider.detectGpu();
+      expect(hasGpu).toBe(false);
+    });
+  });
+});