openship 0.4.7 → 0.5.0

package/dist/{chunk-SJIFLLX4.js → chunk-CUJXGK7R.js}

@@ -9,7 +9,7 @@ import {
   resolveDockerfileCandidates,
   resolveServiceDockerfile,
   staticBuilderOutputPath
-} from "./chunk-V6AN6XLZ.js";
+} from "./chunk-V7BZMGOT.js";
 import {
   BuildLogger,
   assembleGitClone,
@@ -18,20 +18,24 @@ import {
   shellGitSshWriter,
   sq,
   transferLocalDirectory
-} from "./chunk-4Z5QO7N6.js";
+} from "./chunk-I6PSTQIR.js";
 import {
   connectSshClient,
   execSshCommand,
   openSshExecChannel,
   openSshUnixSocket
-} from "./chunk-OXWDY22G.js";
+} from "./chunk-ZCOQJCZO.js";
 import {
   isRuntimeNotFoundError
 } from "./chunk-RPHRPFEH.js";
 import {
+  formatCpuCores,
+  formatMemoryMb,
+  hasCpuLimit,
+  hasMemoryLimit,
   safeErrorMessage,
   withTimeout
-} from "./chunk-6APULWSU.js";
+} from "./chunk-UMQP7SYT.js";
 
 // ../../packages/adapters/src/runtime/docker.ts
 import Dockerode from "dockerode";
@@ -201,6 +205,59 @@ function daemonConnectionFrom(docker) {
   };
 }
 
+// ../../packages/adapters/src/runtime/compose-cmd.ts
+function resolveComposeCmd(config) {
+  if (config.commandArgv != null) return config.commandArgv;
+  return config.command ? ["sh", "-c", config.command] : void 0;
+}
+
+// ../../packages/adapters/src/runtime/resource-limits.ts
+function dockerResourceLimits(resources) {
+  const limits = {};
+  if (hasMemoryLimit(resources)) {
+    limits.Memory = Math.round(resources.memoryMb * 1024 * 1024);
+  }
+  if (hasCpuLimit(resources)) {
+    limits.NanoCpus = Math.max(1e6, Math.round(resources.cpuCores * 1e9));
+  }
+  return limits;
+}
+var CPU_PERIOD_US = 1e5;
+function dockerBuildResourceLimits(resources) {
+  const limits = {};
+  if (hasMemoryLimit(resources)) {
+    limits.memory = Math.round(resources.memoryMb * 1024 * 1024);
+  }
+  if (hasCpuLimit(resources)) {
+    limits.cpuperiod = CPU_PERIOD_US;
+    limits.cpuquota = Math.max(1e3, Math.round(resources.cpuCores * CPU_PERIOD_US));
+  }
+  return limits;
+}
+function inspectResourceLimits(hostConfig) {
+  if (!hostConfig) return void 0;
+  const memoryMb = typeof hostConfig.Memory === "number" && hostConfig.Memory > 0 ? Math.round(hostConfig.Memory / (1024 * 1024)) : void 0;
+  let cpuCores;
+  if (typeof hostConfig.NanoCpus === "number" && hostConfig.NanoCpus > 0) {
+    cpuCores = hostConfig.NanoCpus / 1e9;
+  } else if (typeof hostConfig.CpuQuota === "number" && hostConfig.CpuQuota > 0 && typeof hostConfig.CpuPeriod === "number" && hostConfig.CpuPeriod > 0) {
+    cpuCores = hostConfig.CpuQuota / hostConfig.CpuPeriod;
+  }
+  if (cpuCores !== void 0) cpuCores = Math.round(cpuCores * 100) / 100;
+  if (memoryMb === void 0 && cpuCores === void 0) return void 0;
+  return {
+    ...cpuCores !== void 0 && { cpuCores },
+    ...memoryMb !== void 0 && { memoryMb }
+  };
+}
+function describeResourceLimits(resources) {
+  const parts = [
+    hasCpuLimit(resources) ? formatCpuCores(resources.cpuCores) : null,
+    hasMemoryLimit(resources) ? formatMemoryMb(resources.memoryMb) : null
+  ].filter(Boolean);
+  return parts.length ? parts.join(" \xB7 ") : "no limits (machine capacity)";
+}
+
 // ../../packages/adapters/src/runtime/docker-ssh-agent.ts
 import net2 from "net";
 var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
@@ -551,13 +608,29 @@ function createDockerSshBridge(opts) {
 }
 
 // ../../packages/adapters/src/runtime/docker-transport.ts
+var DEFAULT_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
+function resolveLocalDockerSocketPath(opts, env = process.env) {
+  const explicit = opts?.dockerSocketPath?.trim();
+  if (explicit) return explicit;
+  const host = env.DOCKER_HOST?.trim();
+  if (host) {
+    if (host.startsWith("unix://")) {
+      const path = host.slice("unix://".length).trim();
+      if (path.startsWith("/")) return path;
+    } else if (host.startsWith("/")) {
+      return host;
+    }
+  }
+  return DEFAULT_DOCKER_SOCKET_PATH;
+}
 function resolveDockerTransport(opts) {
   if (!opts || !opts.transport || opts.transport === "socket") {
+    const socketPath = resolveLocalDockerSocketPath(opts);
     return {
       kind: "socket",
-      description: "local Docker daemon via socket",
-      unreachableHint: "Check that the local Docker daemon is running.",
-      establish: async () => ({ socketPath: "/var/run/docker.sock" }),
+      description: `local Docker daemon via socket (${socketPath})`,
+      unreachableHint: socketPath === DEFAULT_DOCKER_SOCKET_PATH ? "Check that the local Docker daemon is running. If it isn't Docker Desktop (Colima, Rancher, Podman, rootless), set DOCKER_HOST to its socket." : `Check that the local Docker daemon is running and listening on ${socketPath} (from DOCKER_HOST / dockerSocketPath).`,
+      establish: async () => ({ socketPath }),
       close: async () => {
       },
       preflight: async () => {
@@ -622,6 +695,9 @@ function resolveDockerTransport(opts) {
 
 // ../../packages/adapters/src/runtime/docker.ts
 var isDockerNotFoundError = isRuntimeNotFoundError;
+function ownsBuiltImage(imageRef) {
+  return imageRef.startsWith("openship/");
+}
 function clampShellWindow(value, fallback, min, max) {
   const n = Number.isFinite(value) ? Number(value) : fallback;
   if (n < min) return min;
@@ -848,7 +924,8 @@ var DockerRuntime = class _DockerRuntime {
     "serviceShell",
     "projectContainerSweep",
     "deploymentContainerQuery",
-    "hostContainerQuery"
+    "hostContainerQuery",
+    "stabilityProbe"
   ]);
   /** Docker honors every extended compose key we currently support. */
   unsupportedComposeKeys = /* @__PURE__ */ new Set();
@@ -1265,6 +1342,10 @@ var DockerRuntime = class _DockerRuntime {
             ...config.envVars,
             NODE_ENV: "production"
           },
+          // Omitted entirely unless the project set a build cap — a self-hosted
+          // build should be free to use the machine (a production build often
+          // needs several GB). Opt-in only; see dockerBuildResourceLimits.
+          ...dockerBuildResourceLimits(config.resources),
           forcerm: true
         }
       );
@@ -1483,12 +1564,16 @@ var DockerRuntime = class _DockerRuntime {
   async moveStaticBuildToHost(tag, config, hostOutDir, log) {
     const docRoot = staticBuilderOutputPath(config);
     const sshExecutor = this.transport.kind === "ssh" ? this.connectionOptions?.executor : null;
-    log.log("Moving built files out of the build container...\n");
+    log.log(`Moving built files out of the build container (${docRoot})...
+`);
     try {
       if (sshExecutor) {
         await this.extractDocRootOverSsh(sshExecutor, tag, docRoot, hostOutDir);
       } else {
-        await this.extractDocRootViaDaemon(tag, docRoot, hostOutDir);
+        const copiedInPlace = this.transport.kind === "socket" && await this.extractDocRootViaBindMount(tag, docRoot, hostOutDir);
+        if (!copiedInPlace) {
+          await this.extractDocRootViaDaemon(tag, docRoot, hostOutDir);
+        }
       }
       log.log(`Static files ready at ${hostOutDir}
 `);
@@ -1510,8 +1595,9 @@ var DockerRuntime = class _DockerRuntime {
    * a second web server was never going to run.
    * Returns the host dir as `imageRef`, matching BareRuntime.build's host-dir
    * contract so the existing file-backed serve path (deployStatic /
-   * resolveStaticRoot) consumes it unchanged. Never leaves a long-lived
-   * container: the extraction container is created (not started) and removed.
+   * resolveStaticRoot) consumes it unchanged. Never leaves a long-lived container:
+   * the extraction container runs one `cp` (or isn't started at all, when the tar is
+   * streamed instead) and is removed either way.
    */
   async buildStaticToHost(config, hostOutDir, logger) {
     const log = logger ?? new BuildLogger();
@@ -1544,18 +1630,31 @@ var DockerRuntime = class _DockerRuntime {
     }
   }
   /**
-   * THE CONTRACT both extractors satisfy: after either one returns, `hostOutDir`
-   * holds the doc-root's CONTENTS directly — `index.html` at the top, no wrapping
-   * `html/` directory. OpenResty's `root` points straight at it, so a stray extra
-   * level is a silent 404 for the whole site.
+   * THE CONTRACT all three extractors satisfy: once one returns, `hostOutDir` holds
+   * the doc-root's CONTENTS directly — `index.html` at the top, no wrapping
+   * directory. OpenResty's `root` points straight at it, so one stray level is a
+   * silent 404 for the whole site.
+   *
+   * They reach that shape differently, which is why the rule is stated here once
+   * instead of in each branch:
+   *   - `docker cp <cid>:<root>/.` and `cp -a <root>/. <out>/` — the trailing `/.`
+   *     means "contents of", so there is nothing to strip.
+   *   - `getArchive({path: <root>})` — the tar is rooted at the doc-root's own
+   *     basename (`dist/`, `build/`, …), so exactly one leading component is
+   *     stripped.
    *
-   * The two paths reach that same shape differently, which is why the rule is
-   * stated here once instead of in each branch:
-   *   - `docker cp <cid>:<root>/.` — the trailing `/.` means "contents of", so
-   *     there is nothing to strip.
-   *   - `getArchive({path: <root>})` — the tar IS rooted at `html/`, so exactly
-   *     one leading component must be stripped.
+   * The other half of the contract is that hostOutDir is non-EMPTY, which is what
+   * this enforces. It has to be checked per-path (three different filesystems) but
+   * the rule and its wording live here, because the failure it prevents is the
+   * expensive one: every extractor can succeed having copied nothing, which deploys
+   * green and then 404s the entire site.
    */
+  assertDocRootFilled(isEmpty, docRoot) {
+    if (!isEmpty) return;
+    throw new Error(
+      `static extract produced no files from ${docRoot} in the build container \u2014 check the project's output directory setting.`
+    );
+  }
   /** Remote host: disk-to-disk via the host's own docker CLI — never stream a
    *  large tar over the SSH dockerode bridge (same rationale as saveImage/pullImage). */
   async extractDocRootOverSsh(sshExecutor, tag, docRoot, hostOutDir) {
@@ -1563,34 +1662,126 @@ var DockerRuntime = class _DockerRuntime {
     try {
       await sshExecutor.exec(`mkdir -p ${sq(hostOutDir)}`);
       await sshExecutor.exec(`docker cp ${sq(`${cid}:${docRoot}/.`)} ${sq(hostOutDir)}`);
+      const listing = (await sshExecutor.exec(`ls -A ${sq(hostOutDir)} | head -1`).catch(() => "")).trim();
+      this.assertDocRootFilled(!listing, docRoot);
     } finally {
       await sshExecutor.exec(`docker rm ${sq(cid)}`).catch(() => {
       });
     }
   }
-  /** Local socket / remote TCP: pull the tar through dockerode (portable to a TCP
-   *  daemon where a local `docker` CLI wouldn't apply) and extract onto THIS
-   *  process's filesystem — in docker-edge mode that's /opt/openship/static,
-   *  bind-mounted into both the api and the edge at the same path. */
+  /**
+   * LOCAL DAEMON: let the daemon do the copy on its own disk. The builder image is
+   * run once with `hostOutDir` bind-mounted, and it `cp -a`s the doc-root across.
+   * No archive crosses this process at all.
+   *
+   * This exists because streaming the doc-root out via `getArchive` is undebuggable
+   * when it goes wrong. Once the daemon has sent 200 + headers for an archive it has
+   * NO way to report a mid-archive failure — an unreadable file, a socket/fifo, a
+   * path it can't stat — so it just closes the connection. The client sees a
+   * truncated body and the only symptom anywhere is `tar: Unexpected EOF in
+   * archive`, with the actual cause visible solely in the daemon's own log. That is
+   * the failure this method removes: `cp` runs in the container, so a real error
+   * arrives as real stderr and a real exit code.
+   *
+   * Requires that the daemon's filesystem IS this process's filesystem, which is
+   * true for DooD (`/opt/openship/static` is a host bind mount at the same path
+   * inside and out — see docker/docker-compose.yml) and false for a VM-backed
+   * daemon (Docker Desktop, Colima), where `hostOutDir` resolves inside the VM and
+   * the copy would land somewhere this process can't see.
+   *
+   * So it PROVES the assumption instead of trusting the transport: a sentinel file
+   * is written here and the container refuses to copy unless it can see it. A
+   * daemon that can't reach our disk exits 97 and the caller streams instead. That
+   * check is folded into the same container run — no extra round trip — because
+   * getting it wrong means an empty doc-root, i.e. a site that deploys green and
+   * serves 404s.
+   *
+   * Returns false when the bind isn't shared; throws on a real copy failure.
+   */
+  async extractDocRootViaBindMount(tag, docRoot, hostOutDir) {
+    const { mkdir, readdir, writeFile, rm } = await import("fs/promises");
+    const { join } = await import("path");
+    const { randomBytes } = await import("crypto");
+    await mkdir(hostOutDir, { recursive: true });
+    const OUT = "/__openship_out";
+    const probe = `.openship-extract-probe-${randomBytes(6).toString("hex")}`;
+    await writeFile(join(hostOutDir, probe), "probe");
+    const container = await this.docker.createContainer({
+      Image: tag,
+      // Override the ENTRYPOINT: builder base images (node, bun) ship a
+      // docker-entrypoint.sh that would swallow this Cmd.
+      Entrypoint: ["/bin/sh", "-c"],
+      Cmd: [
+        `set -e; test -f ${sq(`${OUT}/${probe}`)} || exit 97; cp -a ${sq(docRoot)}/. ${OUT}/; rm -f ${sq(`${OUT}/${probe}`)}`
+      ],
+      // Root, explicitly. A builder image that sets `USER node`/`USER bun` would
+      // otherwise run this copy unprivileged and fail writing into a root-owned
+      // output dir — the two paths this replaces both run with daemon privileges,
+      // so anything less would be a NEW failure this change introduced.
+      User: "0:0",
+      HostConfig: {
+        // `:z` matches how compose mounts this dir — required on SELinux hosts for
+        // the container to write, and ignored where SELinux is off.
+        Binds: [`${hostOutDir}:${OUT}:z`]
+      }
+    });
+    try {
+      try {
+        await container.start();
+      } catch {
+        return false;
+      }
+      const status = await container.wait();
+      if (status.StatusCode === 97) return false;
+      if (status.StatusCode !== 0) {
+        const logs = await container.logs({ stdout: true, stderr: true, tail: 40 }).then((b) => Buffer.from(b).toString("utf8")).then((s) => s.replace(/[\x00-\x08\x0b-\x1f\x7f]/g, " ").trim()).catch(() => "");
+        throw new Error(
+          `static extract failed copying ${docRoot} out of the build container (exit ${status.StatusCode})${logs ? `: ${logs.slice(-500)}` : ""}`
+        );
+      }
+      const entries = (await readdir(hostOutDir).catch(() => [])).filter((e) => e !== probe);
+      this.assertDocRootFilled(entries.length === 0, docRoot);
+      return true;
+    } finally {
+      await container.remove({ force: true }).catch(() => {
+      });
+      await rm(join(hostOutDir, probe), { force: true }).catch(() => {
+      });
+    }
+  }
+  /** Remote TCP daemon: no shared filesystem and no local `docker` CLI, so the tar
+   *  has to come through dockerode and be extracted onto THIS process's disk. */
   async extractDocRootViaDaemon(tag, docRoot, hostOutDir) {
-    const { mkdir } = await import("fs/promises");
+    const { mkdir, readdir } = await import("fs/promises");
     const { spawn } = await import("child_process");
+    const { pipeline } = await import("stream/promises");
     await mkdir(hostOutDir, { recursive: true });
     const container = await this.docker.createContainer({ Image: tag });
     try {
       const tarStream = await container.getArchive({ path: docRoot });
-      await new Promise((resolve, reject) => {
-        const extract = spawn("tar", ["-x", "--strip-components=1", "-C", hostOutDir]);
-        let errBuf = "";
-        extract.stderr.on("data", (d) => errBuf += d.toString());
-        extract.on("error", reject);
-        tarStream.on("error", reject);
-        tarStream.pipe(extract.stdin);
-        extract.on(
-          "close",
-          (code) => code === 0 ? resolve() : reject(new Error(`static extract failed (tar ${code}): ${errBuf.trim().slice(-500)}`))
-        );
+      const extract = spawn("tar", ["-x", "--strip-components=1", "-C", hostOutDir]);
+      let errBuf = "";
+      extract.stderr.on("data", (d) => errBuf += d.toString());
+      const exited = new Promise((resolve) => {
+        extract.on("close", (code2) => resolve(code2 ?? 0));
+        extract.on("error", () => resolve(-1));
       });
+      let streamError;
+      await pipeline(tarStream, extract.stdin).catch((err) => {
+        streamError = err;
+      });
+      const code = await exited;
+      const tarErr = errBuf.trim();
+      if (streamError && !(code !== 0 && tarErr)) {
+        throw new Error(
+          `static extract failed reading ${docRoot} from the build container: ${safeErrorMessage(streamError)}${tarErr ? ` (tar: ${tarErr.slice(-200)})` : ""}`
+        );
+      }
+      if (code !== 0) {
+        throw new Error(`static extract failed (tar ${code}): ${tarErr.slice(-500)}`);
+      }
+      const entries = await readdir(hostOutDir).catch(() => []);
+      this.assertDocRootFilled(entries.length === 0, docRoot);
     } finally {
       await container.remove({ force: true }).catch(() => {
       });
@@ -1717,6 +1908,7 @@ var DockerRuntime = class _DockerRuntime {
                   sessionId: spec.config.sessionId
                 }),
                 buildargs: { ...spec.config.envVars, NODE_ENV: "production" },
+                ...dockerBuildResourceLimits(spec.config.resources),
                 forcerm: true
               }
             );
@@ -1805,9 +1997,29 @@ var DockerRuntime = class _DockerRuntime {
     ];
     const cmd = config.startCommand ? ["sh", "-c", config.startCommand] : void 0;
     const restartPolicy = resolveRestartPolicy(config.restartPolicy);
+    const scopedBinds = scopeVolumeBinds(
+      config.slug || config.runtimeName || config.projectId,
+      config.volumes ?? [],
+      true
+    );
+    const binds = scopedBinds.length > 0 ? scopedBinds : void 0;
     log({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       message: `Creating container ${containerName} from ${imageRef}...
+`,
+      level: "info"
+    });
+    if (binds) {
+      log({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: `Persistent storage: ${binds.join(", ")}
+`,
+        level: "info"
+      });
+    }
+    log({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message: `Resource limits: ${describeResourceLimits(config.resources)}
 `,
       level: "info"
     });
@@ -1823,8 +2035,10 @@ var DockerRuntime = class _DockerRuntime {
       ExposedPorts: { [`${config.port}/tcp`]: {} },
       HostConfig: {
         RestartPolicy: restartPolicy,
-        Memory: config.resources.memoryMb * 1024 * 1024,
-        CpuShares: Math.round(config.resources.cpuCores * 1024),
+        Binds: binds,
+        // Omitted entirely when the project has no cap (self-hosted default) —
+        // see dockerResourceLimits. Never substitute a tier here.
+        ...dockerResourceLimits(config.resources),
         // Publish on the LOOPBACK interface only — the edge (host process, or a
         // host-net OpenResty container) reaches it at 127.0.0.1:<hostPort>, and
         // it never faces the network. Binding 0.0.0.0 here would expose every
@@ -1969,44 +2183,24 @@ var DockerRuntime = class _DockerRuntime {
       serviceName: c.Labels?.["openship.service"]
     }));
   }
-  // ── Rollback primitives ──────────────────────────────────────────────
+  // ── Rollback primitives (retention half only) ────────────────────────
   //
-  // Docker semantics:
-  //   makeActive — prefer `start` of the retained container (fast,
-  //     preserves PID/state). If the container was GC'd but the image
-  //     is still tagged, `run` from imageRef to provision a fresh
-  //     container. Stop the previous active as part of the swap.
-  //   archive   — `docker stop`. Image stays tagged. Container kept
-  //     for fast restart on later makeActive.
-  //   purge     — `docker rm` (force) + `docker rmi`. Past this point
-  //     rollback to this deployment is impossible.
-  async makeActive(input) {
-    if (input.from?.containerId) {
-      try {
-        await this.stop(input.from.containerId);
-      } catch {
-      }
-    }
-    if (input.to.containerId) {
-      try {
-        await this.start(input.to.containerId);
-        return { containerId: input.to.containerId };
-      } catch {
-      }
-    }
-    if (!input.to.imageRef) {
-      throw new Error(
-        `Cannot make deployment ${input.to.id} active: container is gone and no imageRef is stored. Artifact has been purged.`
-      );
-    }
-    const container = await this.docker.createContainer({
-      Image: input.to.imageRef,
-      name: `dep-${input.to.id}`,
-      HostConfig: { RestartPolicy: { Name: "unless-stopped" } }
-    });
-    await container.start();
-    return { containerId: container.id };
-  }
+  // Docker deliberately does NOT implement `makeActive` — see the
+  // "unitRestore" capability. A redeploy REMOVES the previous container
+  // (loopback-port routing can't overlap two containers on one host
+  // port), so there is no unit left to restart; the durable artifact is
+  // the IMAGE. Restore therefore re-materializes the container through
+  // the normal deploy step from the target's frozen snapshot + retained
+  // image (modules/deployments/rollback/restore-plan.ts), which is the
+  // only way env, published port, volumes, labels, network and routing
+  // all come back correctly.
+  //
+  //   archive — `docker stop` (usually a no-op: the container is gone).
+  //             The image stays tagged, retained by the rollback-window
+  //             keep-set in modules/deployments/image-gc.
+  //   purge   — `docker rm` (force) + `docker rmi`. Past this point an
+  //             instant restore of this deployment is impossible and
+  //             rollback degrades to a rebuild from its commit.
   async archive(deployment) {
     if (!deployment.containerId) return;
     try {
@@ -2021,7 +2215,7 @@ var DockerRuntime = class _DockerRuntime {
       } catch {
       }
     }
-    if (deployment.imageRef) {
+    if (deployment.imageRef && ownsBuiltImage(deployment.imageRef)) {
       try {
         await this.removeImage(deployment.imageRef);
       } catch {
@@ -2121,6 +2315,7 @@ var DockerRuntime = class _DockerRuntime {
         retries: hc.Retries,
         startPeriod: hc.StartPeriod
       } : void 0,
+      resources: inspectResourceLimits(data.HostConfig),
       composeProject: labels["com.docker.compose.project"] || void 0,
       composeService: labels["com.docker.compose.service"] || void 0,
       composeConfigFiles: configFiles ? configFiles.split(",").map((s) => s.trim()).filter(Boolean) : void 0,
@@ -2334,6 +2529,45 @@ var DockerRuntime = class _DockerRuntime {
       uptimeSeconds: uptimeSeconds && uptimeSeconds > 0 ? uptimeSeconds : void 0
     };
   }
+  /**
+   * One stabilization reading for the post-deploy watch. Unlike
+   * `getContainerInfo` this keeps `restarting` distinct and carries
+   * `RestartCount` / `ExitCode` / health — the only fields that separate a
+   * container that is UP from one that is bouncing. A vanished container is a
+   * `missing` sample (not a throw): that is a verdict, not a transport error.
+   */
+  async sampleStability(containerId) {
+    let data;
+    try {
+      data = await this.docker.getContainer(containerId).inspect();
+    } catch (err) {
+      if (isDockerNotFoundError(err)) {
+        return {
+          state: "missing",
+          exitCode: null,
+          restartCount: 0,
+          health: null,
+          errorLine: null,
+          oomKilled: false,
+          restartPolicy: null
+        };
+      }
+      throw err;
+    }
+    const rawState = (data.State?.Status ?? "").toLowerCase().trim();
+    const state = ["created", "running", "restarting", "paused", "exited", "dead", "removing"].includes(rawState) ? rawState : "unknown";
+    const rawHealth = (data.State?.Health?.Status ?? "").toLowerCase().trim();
+    const health = rawHealth === "healthy" || rawHealth === "unhealthy" || rawHealth === "starting" ? rawHealth : null;
+    return {
+      state,
+      exitCode: typeof data.State?.ExitCode === "number" ? data.State.ExitCode : null,
+      restartCount: typeof data.RestartCount === "number" ? data.RestartCount : 0,
+      health,
+      errorLine: data.State?.Error?.trim() ? data.State.Error.trim() : null,
+      oomKilled: data.State?.OOMKilled === true,
+      restartPolicy: data.HostConfig?.RestartPolicy?.Name ?? null
+    };
+  }
   async getRuntimeLogs(containerId, tail) {
     const container = this.docker.getContainer(containerId);
     const buffer = await container.logs({
@@ -2807,7 +3041,7 @@ var DockerRuntime = class _DockerRuntime {
       ...config.publicPort && config.environment.PORT === void 0 ? [`PORT=${config.publicPort}`] : [],
       ...Object.entries(config.environment).map(([k, v]) => `${k}=${v}`)
     ];
-    const cmd = config.command ? ["sh", "-c", config.command] : void 0;
+    const cmd = resolveComposeCmd(config);
     const { exposedPorts, portBindings } = parsePortBindings(config.ports);
     if (!config.namespaceVolumes) {
       await this.assertNoForeignNamedVolumeCollision(config);
@@ -2819,6 +3053,12 @@ var DockerRuntime = class _DockerRuntime {
     log({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       message: `Creating service container ${containerName} from ${config.image}...
+`,
+      level: "info"
+    });
+    log({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      message: `Resource limits: ${describeResourceLimits(config.resources)}
 `,
       level: "info"
     });
@@ -2858,12 +3098,7 @@ var DockerRuntime = class _DockerRuntime {
       ExposedPorts: exposedPorts,
       HostConfig: {
         RestartPolicy: restartPolicy,
-        ...config.resources?.memoryMb && {
-          Memory: config.resources.memoryMb * 1024 * 1024
-        },
-        ...config.resources?.cpuCores && {
-          CpuShares: Math.round(config.resources.cpuCores * 1024)
-        },
+        ...dockerResourceLimits(config.resources),
         PortBindings: portBindings,
         Binds: binds,
         NetworkMode: group.id
@@ -2927,5 +3162,6 @@ var DockerRuntime = class _DockerRuntime {
 export {
   scopedVolumeName,
   isHostPathSource,
+  ownsBuiltImage,
   DockerRuntime
 };

package/dist/{chunk-VFINNTUL.js → chunk-EAAGSQXN.js}

@@ -4,7 +4,7 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   safeErrorMessage
-} from "./chunk-6APULWSU.js";
+} from "./chunk-UMQP7SYT.js";
 
 // ../../packages/adapters/src/infra/openresty-lua.ts
 import { createHash } from "crypto";
@@ -85,16 +85,26 @@ async function detectOpenRestyPaths(executor) {
     pidPath
   };
 }
-function buildReloadCommand(paths) {
+function buildReloadCommand(paths, opts = {}) {
+  if (opts.containerEdge) {
+    return `${paths.bin} -t 2>&1 || exit 1
+${paths.bin} -s reload 2>&1 || exit 1`;
+  }
   return `${paths.bin} -t 2>&1 || exit 1
 
-if ${paths.bin} -s reload 2>/dev/null; then
-  exit 0
+reload_err=$(${paths.bin} -s reload 2>&1) && exit 0
+
+if [ "$(cat /proc/1/comm 2>/dev/null)" = "openresty" ] || [ "$(cat /proc/1/comm 2>/dev/null)" = "nginx" ]; then
+  echo "openresty reload failed and openresty is PID 1 (containerized edge) \u2014 not killing it; the container supervisor owns restarts." >&2
+  echo "$reload_err" >&2
+  exit 1
+fi
+
+if [ -f ${paths.pidPath} ] && kill -0 "$(cat ${paths.pidPath} 2>/dev/null)" 2>/dev/null; then
+  echo "openresty (pid $(cat ${paths.pidPath})) is running but refused -s reload" >&2
+  exit 1
 fi
 
-pkill -f '[o]penresty' >/dev/null 2>&1 || true
-pkill -f '[n]ginx' >/dev/null 2>&1 || true
-sleep 1
 rm -f ${paths.pidPath}
 ${paths.bin}`;
 }
@@ -138,13 +148,18 @@ http {
     default_type  application/octet-stream;
     sendfile      on;
     keepalive_timeout 65;
+    # See apps/edge/nginx.conf: the 64-byte default fails \`nginx -t\` outright
+    # ("could not build server_names_hash") for any server_name past ~63 chars,
+    # which refuses the reload and wedges every route on the box, not just the
+    # long one. Keep this in step with the containerized edge's value.
+    server_names_hash_bucket_size 128;
     include ${sitesDir}/*.conf;
 }
 `;
 }
 var GEOIP_DIR = "/usr/share/GeoIP";
 var GEOIP_DB_PATH = `${GEOIP_DIR}/GeoLite2-Country.mmdb`;
-var GEOIP_DB_URL = "https://github.com/P3TERX/GeoLite.mmdb/releases/download/2026.04.07/GeoLite2-Country.mmdb";
+var GEOIP_DB_URL = "https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-Country.mmdb";
 var LUA_SRC_DIR = process.env.OPENSHIP_LUA_DIR?.trim() || join(dirname(fileURLToPath(import.meta.url)), "lua");
 var VHOST_REFERENCED_LUA = ["rules_guard.lua", "rules_lib.lua", "site_logger.lua"];
 function luaSourceAvailable() {

package/dist/{chunk-4Z5QO7N6.js → chunk-I6PSTQIR.js}

@@ -5,12 +5,12 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-OXWDY22G.js";
+} from "./chunk-ZCOQJCZO.js";
 import {
   TRANSFER_EXCLUDES,
   packageManagerEnsureCommand,
   safeErrorMessage
-} from "./chunk-6APULWSU.js";
+} from "./chunk-UMQP7SYT.js";
 
 // ../../packages/adapters/src/runtime/git-clone.ts
 function sq(value) {