openship 0.6.1 → 0.6.6

package/dist/{chunk-3FYIXVX5.js → chunk-77QDF6UD.js}

@@ -9,33 +9,43 @@ import {
   resolveDockerfileCandidates,
   resolveServiceDockerfile,
   staticBuilderOutputPath
-} from "./chunk-EMXI4UCU.js";
+} from "./chunk-LUKYPVJ4.js";
 import {
+  BuildCancelledError,
   BuildLogger,
   assembleGitClone,
+  killProcessesUnderDir,
   materializeGitSsh,
   parseLogLevel,
   shellGitSshWriter,
   sq,
   transferLocalDirectory
-} from "./chunk-VDDMADOF.js";
+} from "./chunk-LH2PLRQO.js";
 import {
+  DOCKER_DIAL_STDIO_COMMAND,
+  attachDialStdioDiagnostics,
   connectSshClient,
+  dialStdioDiagnostics,
   execSshCommand,
-  openSshExecChannel,
+  openDockerDialStdioChannel,
   openSshUnixSocket
-} from "./chunk-6ODUBKUB.js";
+} from "./chunk-PCPVTH6M.js";
 import {
-  isRuntimeNotFoundError
-} from "./chunk-ZCFVHA25.js";
+  dirOf,
+  ensureOwnedDir
+} from "./chunk-UVNMQM7W.js";
 import {
   formatCpuCores,
   formatMemoryMb,
   hasCpuLimit,
   hasMemoryLimit,
+  isRuntimeNotFoundError,
+  ownsNetworkEndpoint,
+  registryConfigKeys,
+  registryForImage,
   safeErrorMessage,
   withTimeout
-} from "./chunk-OTLSJYAC.js";
+} from "./chunk-UJ6JZM65.js";
 import {
   __commonJS,
   __require,
@@ -305,7 +315,7 @@ var require_buffer_list = __commonJS({
         }
       }, {
         key: "join",
-        value: function join2(s) {
+        value: function join3(s) {
           if (this.length === 0) return "";
           var p = this.head;
           var ret = "" + p.data;
@@ -4600,6 +4610,82 @@ import Dockerode from "dockerode";
 import { createGzip } from "zlib";
 import { PassThrough, Writable } from "stream";
 
+// ../../packages/adapters/src/runtime/docker-auth.ts
+import { readFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+function firstPresent(values, keys) {
+  if (!values) return void 0;
+  for (const key of keys) {
+    if (Object.hasOwn(values, key)) return { key, value: values[key] };
+  }
+  return void 0;
+}
+function dockerConfigJsonFor(auth) {
+  const a = auth;
+  const registry = a.serveraddress?.trim();
+  if (!registry) return null;
+  if (a.identitytoken) {
+    return JSON.stringify({ auths: { [registry]: { identitytoken: a.identitytoken } } });
+  }
+  if (!a.username || !a.password) return null;
+  const encoded = Buffer.from(`${a.username}:${a.password}`).toString("base64");
+  return JSON.stringify({ auths: { [registry]: { auth: encoded } } });
+}
+function toAuthConfig(entry, serveraddress) {
+  if (entry.identitytoken) {
+    return { identitytoken: entry.identitytoken, serveraddress };
+  }
+  if (entry.username && entry.password) {
+    return { username: entry.username, password: entry.password, serveraddress };
+  }
+  if (!entry.auth) return void 0;
+  let decoded;
+  try {
+    decoded = Buffer.from(entry.auth, "base64").toString("utf8");
+  } catch {
+    return void 0;
+  }
+  const separator = decoded.indexOf(":");
+  if (separator < 1) return void 0;
+  return {
+    username: decoded.slice(0, separator),
+    password: decoded.slice(separator + 1),
+    serveraddress
+  };
+}
+var DockerCredentialHelperError = class extends Error {
+  constructor(registry) {
+    super(
+      `Openship can't read the credentials for ${registry}: they are stored in a Docker credential helper, which is not available inside the Openship container. Add the credentials inline to the Docker config (docker logout ${registry}, remove the credential helper for it, then docker login ${registry}), or use a public image.`
+    );
+    this.name = "DockerCredentialHelperError";
+  }
+};
+async function resolveDockerAuth(ref) {
+  const registry = registryForImage(ref);
+  const configPath = join(
+    process.env.DOCKER_CONFIG || join(homedir(), ".docker"),
+    "config.json"
+  );
+  let config;
+  try {
+    config = JSON.parse(await readFile(configPath, "utf8"));
+  } catch {
+    return void 0;
+  }
+  if (!config || typeof config !== "object") return void 0;
+  const keys = registryConfigKeys(registry);
+  const inline = firstPresent(config.auths, keys);
+  const usable = inline ? toAuthConfig(inline.value, inline.key) : void 0;
+  if (usable) return usable;
+  const helperForRegistry = firstPresent(config.credHelpers, keys);
+  if (helperForRegistry || config.credsStore && inline) {
+    throw new DockerCredentialHelperError(registry);
+  }
+  return void 0;
+}
+
 // ../../packages/adapters/src/runtime/source-tarball.ts
 function githubTarballUrl(repoUrl, ref) {
   if (!repoUrl || !ref) return null;
@@ -4784,6 +4870,9 @@ function resolveComposeCmd(config) {
   if (config.commandArgv != null) return config.commandArgv;
   return config.command ? ["sh", "-c", config.command] : void 0;
 }
+function resolveComposeEntrypoint(advanced) {
+  return advanced?.entrypoint ?? void 0;
+}
 
 // ../../packages/adapters/src/runtime/resource-limits.ts
 function dockerResourceLimits(resources) {
@@ -4835,16 +4924,16 @@ function describeResourceLimits(resources) {
 // ../../packages/adapters/src/runtime/docker-transport.ts
 import { createHash } from "crypto";
 import { readFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 
 // ../../packages/adapters/src/runtime/docker-ssh-agent.ts
 import net2 from "net";
 var DEFAULT_REMOTE_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
 var resolvedDockerSocketPathCache = /* @__PURE__ */ new WeakMap();
-var DOCKER_DIAL_STDIO_COMMAND = "docker system dial-stdio";
 var STREAMLOCAL_PROBE_TIMEOUT_MS = 8e3;
 var STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS = 3e3;
+var DIAL_STDIO_ANSWER_TIMEOUT_MS = 3e3;
 var VERIFY_BUFFER_CAP_BYTES = 8 * 1024 * 1024;
 function toSshConfig(opts) {
   return {
@@ -4895,12 +4984,8 @@ async function discoverRemoteDockerSocketPathsWithClient(client) {
   return normalizeSocketPathLines(lines);
 }
 async function discoverRemoteDockerSocketPathsWithExecutor(executor) {
-  try {
-    const output = await executor.exec(DOCKER_SOCKET_DISCOVERY_SCRIPT, { timeout: 1e4 });
-    return normalizeSocketPathLines(output.split(/\r?\n/));
-  } catch {
-    return [];
-  }
+  const output = await executor.exec(DOCKER_SOCKET_DISCOVERY_SCRIPT, { timeout: 1e4 });
+  return normalizeSocketPathLines(output.split(/\r?\n/));
 }
 async function discoverRemoteDockerSocketPaths(opts) {
   if (opts.executor) {
@@ -4923,7 +5008,13 @@ async function resolveRemoteDockerSocketPath(opts) {
   if (cachedPath) {
     return cachedPath;
   }
-  const pendingPath = discoverRemoteDockerSocketPaths(opts).then((paths) => paths[0] ?? DEFAULT_REMOTE_DOCKER_SOCKET_PATH).catch(() => DEFAULT_REMOTE_DOCKER_SOCKET_PATH);
+  const pendingPath = discoverRemoteDockerSocketPaths(opts).then(
+    (paths) => paths[0] ?? DEFAULT_REMOTE_DOCKER_SOCKET_PATH,
+    () => {
+      resolvedDockerSocketPathCache.delete(opts);
+      return DEFAULT_REMOTE_DOCKER_SOCKET_PATH;
+    }
+  );
   resolvedDockerSocketPathCache.set(opts, pendingPath);
   return pendingPath;
 }
@@ -4943,35 +5034,98 @@ async function openStreamlocalUpstream(opts) {
     throw error;
   }
 }
-function pipeThrough(client, upstream) {
+function respondBadGateway(client, reason) {
+  if (client.destroyed || client.writableEnded) {
+    client.destroy();
+    return;
+  }
+  const body = JSON.stringify({ message: reason });
+  try {
+    client.end(
+      `HTTP/1.1 502 Bad Gateway\r
+Content-Type: application/json\r
+Content-Length: ${Buffer.byteLength(body)}\r
+Connection: close\r
+\r
+` + body
+    );
+  } catch {
+    client.destroy();
+  }
+}
+function pipeThrough(client, upstream, handoff) {
+  let answered = handoff.answered;
   const teardown = () => {
     client.destroy();
     upstream.destroy();
   };
   client.on("error", teardown);
-  upstream.on("error", teardown);
+  upstream.on("error", () => {
+    if (!answered) respondBadGateway(client, handoff.unansweredReason());
+    upstream.destroy();
+  });
   client.once("close", () => upstream.destroy());
-  upstream.once("close", () => client.destroy());
+  upstream.once("close", () => {
+    if (!answered) {
+      respondBadGateway(client, handoff.unansweredReason());
+      return;
+    }
+    if (!client.destroyed) client.end();
+  });
+  upstream.on("data", () => {
+    answered = true;
+  });
   client.pipe(upstream);
-  upstream.pipe(client);
+  upstream.pipe(client, { end: false });
+  upstream.once("end", () => {
+    if (answered && !client.writableEnded) client.end();
+  });
 }
 function awaitFirstByte(upstream, ms) {
   return new Promise((resolve) => {
-    const finish = (chunk) => {
+    const finish = (outcome) => {
       clearTimeout(timer);
       upstream.removeListener("data", onData);
       upstream.removeListener("error", onFail);
       upstream.removeListener("close", onFail);
-      resolve(chunk);
+      resolve(outcome);
     };
-    const onData = (chunk) => finish(chunk);
-    const onFail = () => finish(null);
-    const timer = setTimeout(() => finish(null), ms);
+    const onData = (chunk) => finish({ kind: "data", chunk });
+    const onFail = () => finish({ kind: "closed" });
+    const timer = setTimeout(() => finish({ kind: "silent" }), ms);
     upstream.on("data", onData);
     upstream.once("error", onFail);
     upstream.once("close", onFail);
   });
 }
+function looksLikeHttpResponse(chunk) {
+  const marker = "HTTP/";
+  const head = chunk.subarray(0, marker.length).toString("latin1");
+  return marker.startsWith(head) || head.startsWith(marker);
+}
+var BRIDGE_FAILURE_HINT = "Check that Docker is installed and running on the server (`docker info`) and that the SSH user can reach its socket.";
+function sentence(text) {
+  const trimmed = text.trim();
+  return /[.!?]$/.test(trimmed) ? trimmed : `${trimmed}.`;
+}
+function bridgeFailureReason(opts, cause) {
+  const host = opts.host?.trim() || "the remote host";
+  return `Could not reach the Docker daemon on ${host} over SSH: ${sentence(cause)} ${BRIDGE_FAILURE_HINT}`;
+}
+function upstreamClosedReason(opts, upstream, transport) {
+  return bridgeFailureReason(
+    opts,
+    dialStdioDiagnostics(upstream) || `the ${transport} channel closed before answering the request`
+  );
+}
+var REPLAY_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function requestIsReplaySafe(chunks) {
+  const head = chunks.find((c) => c.length > 0);
+  if (!head) return true;
+  const space = head.indexOf(32);
+  if (space <= 0) return false;
+  return REPLAY_SAFE_METHODS.has(head.subarray(0, space).toString("latin1"));
+}
 function captureClient(client) {
   const chunks = [];
   let bytes = 0;
@@ -5006,9 +5160,15 @@ function captureClient(client) {
     get overflowed() {
       return overflowed;
     },
+    /** Whether this request may be handed to a second upstream — see
+     *  `requestIsReplaySafe`. Read at the moment of the decision, not at capture time. */
+    get replaySafe() {
+      return requestIsReplaySafe(chunks);
+    },
     /** Replay everything buffered so far onto `upstream` and forward the rest
-     *  live. Safe to call again on a different upstream (the fallback): the full
-     *  buffer is retained until `commit`, so the replay is complete each time. */
+     *  live. Calling it again on a different upstream (the fallback) replays the
+     *  whole buffer — complete, because nothing is dropped until `commit`, but a
+     *  second dispatch to the daemon: gate that on `replaySafe`. */
     feed(upstream) {
       for (const chunk of chunks) upstream.write(chunk);
       live = upstream;
@@ -5019,25 +5179,30 @@ function captureClient(client) {
       live = null;
     },
     /** Terminal: detach and hand the socket to the (already-fed) `upstream` via a
-     *  bidi pipe, or destroy it if the client already went away. */
-    commit(upstream) {
+     *  bidi pipe, or destroy it if the client already went away. `handoff` tells the
+     *  pipe whether a response byte has already been forwarded, and what to say if
+     *  the upstream closes without ever producing one. */
+    commit(upstream, handoff) {
       detach();
       chunks.length = 0;
       if (closed) {
         upstream.destroy();
         return;
       }
-      pipeThrough(client, upstream);
+      pipeThrough(client, upstream, handoff);
     },
-    /** Terminal: no usable upstream. Destroy WITHOUT an error argument — a
-     *  server-side accepted socket can't transmit a JS Error to the peer anyway
-     *  (dockerode only ever sees the reset), and destroy(err) emits a local
-     *  'error' event that, now that detach() removed this socket's error
-     *  listener, would be unhandled and crash the process. The cause is already
-     *  logged by bridgeClient's catch before this runs. */
-    fail() {
+    /** Terminal: no usable upstream. Answer the request with `reason` (a real HTTP
+     *  502 — see `respondBadGateway`) instead of destroying the socket, which is
+     *  what turned every one of these into `socket hang up`.
+     *
+     *  Written BEFORE detach so the socket still has an error listener during the
+     *  write, and never with `destroy(err)`: a server-side socket cannot transmit a
+     *  JS Error to its peer, and destroy(err) emits a local 'error' event that —
+     *  once detach() has removed this socket's listener — would be unhandled and
+     *  take down the process over one dead Docker request. */
+    fail(reason) {
+      respondBadGateway(client, reason);
       detach();
-      client.destroy();
     }
   };
 }
@@ -5049,12 +5214,7 @@ function createDockerSshBridge(opts) {
   let pooledUnreliable = false;
   const openDialStdioUpstream = async (forceEphemeral = false) => {
     if (!forceEphemeral && opts.executor?.openDockerDialStdio) {
-      const stream = await opts.executor.openDockerDialStdio();
-      stream.once(
-        "error",
-        (e) => console.warn(`[docker-ssh] dial-stdio channel error: ${safeErrorMessage(e)}`)
-      );
-      return stream;
+      return attachDialStdioDiagnostics(await opts.executor.openDockerDialStdio());
     }
     if (!dialClient) {
       const client = await connectSshClient(toSshConfig(opts));
@@ -5063,7 +5223,34 @@ function createDockerSshBridge(opts) {
       });
       dialClient = client;
     }
-    return openSshExecChannel(dialClient, DOCKER_DIAL_STDIO_COMMAND);
+    return openDockerDialStdioChannel(dialClient);
+  };
+  const serveDialStdio = async (capture, client, upstream) => {
+    capture.feed(upstream);
+    const first = capture.overflowed ? { kind: "silent" } : await awaitFirstByte(upstream, DIAL_STDIO_ANSWER_TIMEOUT_MS);
+    if (first.kind === "closed") {
+      capture.stop();
+      upstream.destroy();
+      capture.fail(upstreamClosedReason(opts, upstream, DOCKER_DIAL_STDIO_COMMAND));
+      return;
+    }
+    if (first.kind === "data" && !looksLikeHttpResponse(first.chunk)) {
+      capture.stop();
+      upstream.destroy();
+      const banner = first.chunk.toString("utf8").trim().replace(/\s+/g, " ").slice(0, 300);
+      capture.fail(
+        bridgeFailureReason(
+          opts,
+          `the SSH session answered ${JSON.stringify(banner)} instead of a Docker API response \u2014 something on the remote account (an sshd forced command, or a login banner) is intercepting \`${DOCKER_DIAL_STDIO_COMMAND}\``
+        )
+      );
+      return;
+    }
+    if (first.kind === "data") client.write(first.chunk);
+    capture.commit(upstream, {
+      answered: first.kind === "data",
+      unansweredReason: () => upstreamClosedReason(opts, upstream, DOCKER_DIAL_STDIO_COMMAND)
+    });
   };
   const decideMode = async () => {
     let probe = null;
@@ -5111,24 +5298,20 @@ function createDockerSshBridge(opts) {
     modeDecision ??= decideMode().then((mode) => upstreamMode = mode);
     return modeDecision;
   };
-  const downgradeToDialStdio = async (capture, reason) => {
+  const downgradeToDialStdio = async (capture, client, reason) => {
     console.warn(
       `[docker-ssh] streamlocal unusable (${opts.host ?? "?"}): ${reason} \u2014 downgrading this bridge to dial-stdio (fresh connection) and replaying the buffered request.`
     );
     upstreamMode = "dialstdio";
     pooledUnreliable = true;
-    const upstream = await openDialStdioUpstream(true);
-    capture.feed(upstream);
-    capture.commit(upstream);
+    await serveDialStdio(capture, client, await openDialStdioUpstream(true));
   };
   const bridgeClient = async (client) => {
     const capture = captureClient(client);
     try {
       const mode = await ensureMode();
       if (mode === "dialstdio") {
-        const upstream = await openDialStdioUpstream(pooledUnreliable);
-        capture.feed(upstream);
-        capture.commit(upstream);
+        await serveDialStdio(capture, client, await openDialStdioUpstream(pooledUnreliable));
         return;
       }
       let channel;
@@ -5139,22 +5322,36 @@ function createDockerSshBridge(opts) {
           `channel open timed out after ${STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS / 1e3}s`
         );
       } catch (err) {
-        await downgradeToDialStdio(capture, safeErrorMessage(err));
+        await downgradeToDialStdio(capture, client, safeErrorMessage(err));
         return;
       }
       capture.feed(channel);
-      const firstByte = capture.overflowed ? null : await awaitFirstByte(channel, STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS);
-      if (capture.overflowed || firstByte) {
-        if (firstByte) client.write(firstByte);
-        capture.commit(channel);
+      const firstByte = capture.overflowed ? { kind: "silent" } : await awaitFirstByte(channel, STREAMLOCAL_DATA_VERIFY_TIMEOUT_MS);
+      if (capture.overflowed || firstByte.kind === "data") {
+        if (firstByte.kind === "data") client.write(firstByte.chunk);
+        capture.commit(channel, {
+          answered: firstByte.kind === "data",
+          unansweredReason: () => upstreamClosedReason(opts, channel, "streamlocal")
+        });
+        return;
+      }
+      if (firstByte.kind === "silent" && !capture.replaySafe) {
+        capture.commit(channel, {
+          answered: false,
+          unansweredReason: () => upstreamClosedReason(opts, channel, "streamlocal")
+        });
         return;
       }
       capture.stop();
       channel.destroy();
-      await downgradeToDialStdio(capture, "channel opened but no data flowed");
+      await downgradeToDialStdio(
+        capture,
+        client,
+        firstByte.kind === "closed" ? "channel closed before answering" : "channel opened but no data flowed"
+      );
     } catch (err) {
       console.warn(`[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err)}`);
-      capture.fail();
+      capture.fail(bridgeFailureReason(opts, safeErrorMessage(err)));
     }
   };
   const server = net2.createServer((client) => {
@@ -5201,7 +5398,7 @@ function createDockerSshBridge(opts) {
 var DEFAULT_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
 var contextSocketCache = /* @__PURE__ */ new Map();
 function resolveDockerContextSocket(env) {
-  const configDir = env.DOCKER_CONFIG?.trim() || join(homedir(), ".docker");
+  const configDir = env.DOCKER_CONFIG?.trim() || join2(homedir2(), ".docker");
   let name = env.DOCKER_CONTEXT?.trim();
   const cacheKey = `${configDir}\0${name ?? ""}`;
   const cached = contextSocketCache.get(cacheKey);
@@ -5209,13 +5406,13 @@ function resolveDockerContextSocket(env) {
   let socket = null;
   try {
     if (!name) {
-      const config = JSON.parse(readFileSync(join(configDir, "config.json"), "utf8"));
+      const config = JSON.parse(readFileSync(join2(configDir, "config.json"), "utf8"));
       name = typeof config.currentContext === "string" ? config.currentContext.trim() : "";
     }
     if (name && name !== "default") {
       const digest = createHash("sha256").update(name).digest("hex");
       const meta = JSON.parse(
-        readFileSync(join(configDir, "contexts", "meta", digest, "meta.json"), "utf8")
+        readFileSync(join2(configDir, "contexts", "meta", digest, "meta.json"), "utf8")
       );
       const host = meta.Endpoints?.docker?.Host;
       if (typeof host === "string" && host.startsWith("unix://")) {
@@ -5330,6 +5527,35 @@ var RESTART_POLICIES = {
   no: { Name: "no", MaximumRetryCount: 0 }
 };
 var DOCKER_BUILD_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+var activeDockerBuilds = /* @__PURE__ */ new Map();
+var pendingDockerBuildCancellations = /* @__PURE__ */ new Map();
+var PENDING_CANCEL_TTL_MS = 10 * 60 * 1e3;
+function cancelCovers(cancelledId, sessionId) {
+  return sessionId === cancelledId || sessionId.startsWith(`${cancelledId}-`);
+}
+function recordPendingCancellation(sessionId) {
+  clearTimeout(pendingDockerBuildCancellations.get(sessionId));
+  const timer = setTimeout(
+    () => pendingDockerBuildCancellations.delete(sessionId),
+    PENDING_CANCEL_TTL_MS
+  );
+  timer.unref?.();
+  pendingDockerBuildCancellations.set(sessionId, timer);
+}
+function registerDockerBuild(sessionId) {
+  const abort = new AbortController();
+  for (const cancelledId of pendingDockerBuildCancellations.keys()) {
+    if (cancelCovers(cancelledId, sessionId)) {
+      abort.abort();
+      break;
+    }
+  }
+  activeDockerBuilds.set(sessionId, abort);
+  return abort;
+}
+function releaseDockerBuild(sessionId, abort) {
+  if (activeDockerBuilds.get(sessionId) === abort) activeDockerBuilds.delete(sessionId);
+}
 var DEFAULT_IN_CONTAINER_EXEC_TIMEOUT_MS = 12e4;
 var SIGTERM_EXIT_CODE = 143;
 var IN_CONTAINER_EXEC_WATCHDOG = [
@@ -5475,7 +5701,7 @@ function parsePortBindings(portSpecs) {
   }
   return { exposedPorts, portBindings };
 }
-function packBuildContext(contextDir, entries) {
+function packBuildContext(contextDir, entries, cancelSignal) {
   const controller = new AbortController();
   const pack2 = tarFs.pack(contextDir, { entries });
   const body = pack2.pipe(createGzip());
@@ -5484,6 +5710,10 @@ function packBuildContext(contextDir, entries) {
     contextError ??= err instanceof Error ? err : new Error(String(err));
     if (!controller.signal.aborted) controller.abort();
   };
+  if (cancelSignal) {
+    if (cancelSignal.aborted) controller.abort();
+    else cancelSignal.addEventListener("abort", () => controller.abort(), { once: true });
+  }
   pack2.once("error", capture);
   body.once("error", capture);
   return { body, abortSignal: controller.signal, takeError: () => contextError };
@@ -5519,7 +5749,9 @@ function toDockerHealthcheck(hc) {
   if (typeof hc.test === "string" && hc.test.trim()) {
     Test = ["CMD-SHELL", hc.test];
   } else if (Array.isArray(hc.test) && hc.test.length > 0) {
-    Test = ["CMD", ...hc.test];
+    const head = hc.test[0];
+    if (head === "NONE") return { Test: ["NONE"] };
+    Test = head === "CMD" || head === "CMD-SHELL" ? [...hc.test] : ["CMD", ...hc.test];
   }
   if (!Test) return void 0;
   const Interval = parseDurationNs(hc.interval);
@@ -5533,6 +5765,28 @@ function toDockerHealthcheck(hc) {
     ...StartPeriod !== void 0 && { StartPeriod }
   };
 }
+function toStopConfig(advanced) {
+  const out = {};
+  const signal = advanced?.stopSignal?.trim();
+  if (signal) out.StopSignal = signal;
+  const graceNs = parseDurationNs(advanced?.stopGracePeriod);
+  if (graceNs !== void 0) {
+    out.StopTimeout = graceNs <= 0 ? 0 : Math.max(1, Math.round(graceNs / 1e9));
+  }
+  return out;
+}
+async function gracefulStopForGrace(container) {
+  let stopTimeout;
+  try {
+    stopTimeout = (await container.inspect()).Config.StopTimeout;
+  } catch {
+    return;
+  }
+  if (typeof stopTimeout === "number" && stopTimeout > 0) {
+    await container.stop().catch(() => {
+    });
+  }
+}
 function hasDockerFrameHeader(buf, offset = 0) {
   return buf.length >= offset + 8 && (buf[offset] === 1 || buf[offset] === 2) && buf[offset + 1] === 0 && buf[offset + 2] === 0 && buf[offset + 3] === 0;
 }
@@ -5654,7 +5908,15 @@ var DockerRuntime = class _DockerRuntime {
     "deploymentContainerQuery",
     "hostContainerQuery",
     "stabilityProbe",
-    "containerEvents"
+    "containerEvents",
+    // Docker implements `inContainerExecutor` but had never DECLARED the capability.
+    // Nothing gated on it (every caller tested for the method), so the omission was
+    // invisible — but it meant the honest answer to supports("inContainerExec") was
+    // wrong for the one runtime that best supports it.
+    "inContainerExec",
+    // A docker exec lands in the container's own namespaces, so a command run
+    // through it cannot reach the host. Bare deliberately does NOT declare this.
+    "isolatedExec"
   ]);
   /** Docker honors every extended compose key we currently support. */
   unsupportedComposeKeys = /* @__PURE__ */ new Set();
@@ -5752,7 +6014,7 @@ var DockerRuntime = class _DockerRuntime {
    */
   async estimateContextSize(dir) {
     const { stat, readdir } = await import("fs/promises");
-    const { join: join2 } = await import("path");
+    const { join: join3 } = await import("path");
     let total = 0;
     const stack = [dir];
     while (stack.length) {
@@ -5764,7 +6026,7 @@ var DockerRuntime = class _DockerRuntime {
         continue;
       }
       for (const entry of entries) {
-        const full = join2(current, entry.name);
+        const full = join3(current, entry.name);
         if (entry.isDirectory()) {
           stack.push(full);
         } else if (entry.isFile()) {
@@ -5901,7 +6163,7 @@ var DockerRuntime = class _DockerRuntime {
    * context dir. One image; `dockerfileName` selects which Dockerfile in the
    * shared tree to use (so N services can build from one transferred context).
    */
-  async buildImageOnRemote(config, remoteContextDir, dockerfileName, tag, log) {
+  async buildImageOnRemote(config, remoteContextDir, dockerfileName, tag, log, signal) {
     const executor = this.connectionOptions?.executor;
     if (!executor) throw new Error("SSH build path requires an executor on connectionOptions");
     const buildArgs = Object.entries({
@@ -5916,10 +6178,15 @@ var DockerRuntime = class _DockerRuntime {
     log.log(`Running on remote: ${buildCmd}`);
     log.log("\u2500\u2500\u2500 docker build output \u2500\u2500\u2500");
     this.emitDockerStep(log, "install", "running", "Running install inside container (docker build)");
-    const { code } = await executor.streamExec(buildCmd, (entry) => {
-      log.log(entry.message, parseLogLevel(entry.message));
-    });
+    const { code } = await executor.streamExec(
+      buildCmd,
+      (entry) => {
+        log.log(entry.message, parseLogLevel(entry.message));
+      },
+      { signal }
+    );
     log.log("\u2500\u2500\u2500 end docker build output \u2500\u2500\u2500");
+    if (signal?.aborted) throw new BuildCancelledError();
     if (code !== 0) throw new Error(`docker build exited with code ${code}`);
     this.emitDockerStep(log, "install", "completed", "Image build finished");
   }
@@ -6038,11 +6305,18 @@ var DockerRuntime = class _DockerRuntime {
     await executor.writeFile(`${remoteContextDir}/${generatedName}`, generateDockerfile(config));
     return generatedName;
   }
-  async buildViaSshTarPipe(config, buildContext, tag, log) {
+  async buildViaSshTarPipe(config, buildContext, tag, log, signal) {
     const remoteContextDir = `/tmp/openship-build-${config.sessionId}`;
     try {
       await this.transferBuildContext(buildContext.contextDir, remoteContextDir, log);
-      await this.buildImageOnRemote(config, remoteContextDir, buildContext.dockerfileName, tag, log);
+      await this.buildImageOnRemote(
+        config,
+        remoteContextDir,
+        buildContext.dockerfileName,
+        tag,
+        log,
+        signal
+      );
     } finally {
       this.connectionOptions?.executor?.exec(`rm -rf ${sq(remoteContextDir)}`).catch(() => {
       });
@@ -6058,11 +6332,12 @@ var DockerRuntime = class _DockerRuntime {
    * but it's correct for local/TCP where there's no separate SSH
    * connection to piggyback on.
    */
-  async buildViaDockerode(config, buildContext, tag, log) {
+  async buildViaDockerode(config, buildContext, tag, log, cancelSignal) {
     log.log(`Streaming build context to Docker daemon - image tag: ${tag}`);
     const { body, abortSignal, takeError } = packBuildContext(
       buildContext.contextDir,
-      buildContext.contextEntries
+      buildContext.contextEntries,
+      cancelSignal
     );
     try {
       const stream = await this.docker.buildImage(body, {
@@ -6195,7 +6470,17 @@ var DockerRuntime = class _DockerRuntime {
     const log = logger ?? new BuildLogger();
     const startTime = Date.now();
     const tag = this.imageTag(config.slug, config.sessionId);
+    const abort = registerDockerBuild(config.sessionId);
+    const cancelled = () => {
+      log.step("build", "failed", "Docker build cancelled");
+      return {
+        sessionId: config.sessionId,
+        status: "cancelled",
+        durationMs: Date.now() - startTime
+      };
+    };
     try {
+      if (abort.signal.aborted) return cancelled();
       log.log(`Build strategy: docker (${this.transport.description})
 `);
       try {
@@ -6209,6 +6494,7 @@ var DockerRuntime = class _DockerRuntime {
         try {
           this.emitDockerStep(log, "clone", "running", "Cloning source on the server...");
           await this.cloneSourceOnRemote(config, remoteContextDir, log);
+          if (abort.signal.aborted) throw new BuildCancelledError();
           this.emitDockerStep(log, "clone", "completed", "Source cloned on the server");
           const dockerfileName = await this.resolveRemoteDockerfile(
             config,
@@ -6216,11 +6502,19 @@ var DockerRuntime = class _DockerRuntime {
             "Dockerfile.openship",
             config.stack === "docker"
           );
-          await this.buildImageOnRemote(config, remoteContextDir, dockerfileName, tag, log);
+          await this.buildImageOnRemote(
+            config,
+            remoteContextDir,
+            dockerfileName,
+            tag,
+            log,
+            abort.signal
+          );
         } finally {
           sshExecutor.exec(`rm -rf ${sq(remoteContextDir)}`).catch(() => {
           });
         }
+        if (abort.signal.aborted) return cancelled();
         await this.verifyImageBuilt(tag);
         log.log(`Image ${tag} is ready.
 `);
@@ -6232,6 +6526,7 @@ var DockerRuntime = class _DockerRuntime {
         requireRepositoryDockerfile: config.stack === "docker",
         onLog: log.callback
       });
+      if (abort.signal.aborted) throw new BuildCancelledError();
       try {
         const sizeBytes = await this.estimateContextSize(buildContext.contextDir);
         const sizeMB = (sizeBytes / 1024 / 1024).toFixed(1);
@@ -6268,10 +6563,11 @@ var DockerRuntime = class _DockerRuntime {
         this.emitDockerStep(log, "build", "skipped", "No build command configured");
       }
       if (sshExecutor) {
-        await this.buildViaSshTarPipe(config, buildContext, tag, log);
+        await this.buildViaSshTarPipe(config, buildContext, tag, log, abort.signal);
       } else {
-        await this.buildViaDockerode(config, buildContext, tag, log);
+        await this.buildViaDockerode(config, buildContext, tag, log, abort.signal);
       }
+      if (abort.signal.aborted) return cancelled();
       await this.verifyImageBuilt(tag);
       log.log(`Image ${tag} is ready.
 `);
@@ -6280,9 +6576,12 @@ var DockerRuntime = class _DockerRuntime {
       const durationMs = Date.now() - startTime;
       return { sessionId: config.sessionId, status: "deploying", imageRef: tag, durationMs };
     } catch (err) {
+      if (abort.signal.aborted || err instanceof BuildCancelledError) return cancelled();
       const msg = safeErrorMessage(err);
       log.step("build", "failed", `Docker build failed: ${msg}`);
       return { sessionId: config.sessionId, status: "failed", durationMs: Date.now() - startTime, errorMessage: `Docker build failed: ${msg}` };
+    } finally {
+      releaseDockerBuild(config.sessionId, abort);
     }
   }
   /**
@@ -6344,23 +6643,33 @@ var DockerRuntime = class _DockerRuntime {
     }
     const tag = buildResult.imageRef;
     const extractStart = Date.now();
+    const abort = registerDockerBuild(config.sessionId);
+    const elapsed = () => (buildResult.durationMs ?? 0) + (Date.now() - extractStart);
+    const cancelled = () => {
+      log.step("build", "failed", "Static extract cancelled");
+      return { sessionId: config.sessionId, status: "cancelled", durationMs: elapsed() };
+    };
     try {
       await this.moveStaticBuildToHost(tag, config, hostOutDir, log);
+      if (abort.signal.aborted) return cancelled();
       return {
         sessionId: config.sessionId,
         status: "deploying",
         imageRef: hostOutDir,
-        durationMs: (buildResult.durationMs ?? 0) + (Date.now() - extractStart)
+        durationMs: elapsed()
       };
     } catch (err) {
+      if (abort.signal.aborted || err instanceof BuildCancelledError) return cancelled();
       const msg = safeErrorMessage(err);
       log.step("build", "failed", `Static extract failed: ${msg}`);
       return {
         sessionId: config.sessionId,
         status: "failed",
-        durationMs: (buildResult.durationMs ?? 0) + (Date.now() - extractStart),
+        durationMs: elapsed(),
         errorMessage: `Static extract failed: ${msg}`
       };
+    } finally {
+      releaseDockerBuild(config.sessionId, abort);
     }
   }
   /**
@@ -6394,6 +6703,7 @@ var DockerRuntime = class _DockerRuntime {
   async extractDocRootOverSsh(sshExecutor, tag, docRoot, hostOutDir) {
     const cid = (await sshExecutor.exec(`docker create ${sq(tag)}`)).trim();
     try {
+      await ensureOwnedDir(sshExecutor, dirOf(hostOutDir));
       await sshExecutor.exec(`mkdir -p ${sq(hostOutDir)}`);
       await sshExecutor.exec(`docker cp ${sq(`${cid}:${docRoot}/.`)} ${sq(hostOutDir)}`);
       const listing = (await sshExecutor.exec(`ls -A ${sq(hostOutDir)} | head -1`).catch(() => "")).trim();
@@ -6434,12 +6744,12 @@ var DockerRuntime = class _DockerRuntime {
    */
   async extractDocRootViaBindMount(tag, docRoot, hostOutDir) {
     const { mkdir, readdir, writeFile, rm } = await import("fs/promises");
-    const { join: join2 } = await import("path");
+    const { join: join3 } = await import("path");
     const { randomBytes } = await import("crypto");
     await mkdir(hostOutDir, { recursive: true });
     const OUT = "/__openship_out";
     const probe = `.openship-extract-probe-${randomBytes(6).toString("hex")}`;
-    await writeFile(join2(hostOutDir, probe), "probe");
+    await writeFile(join3(hostOutDir, probe), "probe");
     const container = await this.docker.createContainer({
       Image: tag,
       // Override the ENTRYPOINT: builder base images (node, bun) ship a
@@ -6479,7 +6789,7 @@ var DockerRuntime = class _DockerRuntime {
     } finally {
       await container.remove({ force: true }).catch(() => {
       });
-      await rm(join2(hostOutDir, probe), { force: true }).catch(() => {
+      await rm(join3(hostOutDir, probe), { force: true }).catch(() => {
       });
     }
   }
@@ -6542,16 +6852,34 @@ var DockerRuntime = class _DockerRuntime {
     const isSsh = this.transport.kind === "ssh" && !!this.connectionOptions?.executor;
     const cloneOnServer = isSsh && !!source.cloneOnServer;
     const remoteContextDir = `/tmp/openship-build-${source.sessionId}`;
+    const abortControllers = new Map(
+      specs.map((spec) => [spec.config.sessionId, registerDockerBuild(spec.config.sessionId)])
+    );
+    const isCancelled = (sessionId) => abortControllers.get(sessionId)?.signal.aborted === true;
+    const allCancelled = () => [...abortControllers.values()].every((c) => c.signal.aborted);
+    const cancelledResult = (sessionId, startedAt) => ({
+      sessionId,
+      status: "cancelled",
+      durationMs: Date.now() - startedAt
+    });
     let tree = null;
-    if (cloneOnServer) {
-      prepareLogger.step("clone", "running", "Cloning source on the server...");
-      await this.cloneSourceOnRemote(source, remoteContextDir, prepareLogger);
-      prepareLogger.step("clone", "completed", "Source cloned on the server");
-    } else {
-      prepareLogger.step("clone", "running", "Preparing shared build context...");
-      tree = await prepareSourceTree(source, { onLog: prepareLogger.callback });
-    }
     try {
+      if (allCancelled()) {
+        const startedAt = Date.now();
+        return specs.map((spec) => {
+          const result = cancelledResult(spec.config.sessionId, startedAt);
+          spec.onResult?.(result);
+          return { serviceName: spec.serviceName, result };
+        });
+      }
+      if (cloneOnServer) {
+        prepareLogger.step("clone", "running", "Cloning source on the server...");
+        await this.cloneSourceOnRemote(source, remoteContextDir, prepareLogger);
+        prepareLogger.step("clone", "completed", "Source cloned on the server");
+      } else {
+        prepareLogger.step("clone", "running", "Preparing shared build context...");
+        tree = await prepareSourceTree(source, { onLog: prepareLogger.callback });
+      }
       const resolvedList = await Promise.all(
         specs.map(async (spec) => {
           const generatedName = `Dockerfile.openship.${spec.config.sessionId}`;
@@ -6602,7 +6930,7 @@ var DockerRuntime = class _DockerRuntime {
         } catch {
           prepareLogger.step("clone", "completed", "Shared build context ready");
         }
-        if (isSsh) {
+        if (isSsh && !allCancelled()) {
           await this.transferBuildContext(tree.contextDir, remoteContextDir, prepareLogger);
         }
       }
@@ -6610,6 +6938,13 @@ var DockerRuntime = class _DockerRuntime {
       for (const { spec, dockerfileName, contextEntries, error } of resolvedList) {
         const startedAt = Date.now();
         const tag = this.imageTag(spec.config.slug, spec.config.sessionId);
+        const signal = abortControllers.get(spec.config.sessionId)?.signal;
+        if (isCancelled(spec.config.sessionId)) {
+          const result = cancelledResult(spec.config.sessionId, startedAt);
+          spec.onResult?.(result);
+          results.push({ serviceName: spec.serviceName, result });
+          continue;
+        }
         if (error || !dockerfileName) {
           const result = {
             sessionId: spec.config.sessionId,
@@ -6629,12 +6964,14 @@ var DockerRuntime = class _DockerRuntime {
               remoteContextDir,
               dockerfileName,
               tag,
-              spec.logger
+              spec.logger,
+              signal
             );
           } else {
             const { body, abortSignal, takeError } = packBuildContext(
               tree.contextDir,
-              contextEntries ?? []
+              contextEntries ?? [],
+              signal
             );
             try {
               const stream = await this.docker.buildImage(body, {
@@ -6655,6 +6992,12 @@ var DockerRuntime = class _DockerRuntime {
               throw contextErr ? new Error(`Failed to read Docker build context: ${safeErrorMessage(contextErr)}`, { cause: contextErr }) : err;
             }
           }
+          if (isCancelled(spec.config.sessionId)) {
+            const result2 = cancelledResult(spec.config.sessionId, startedAt);
+            spec.onResult?.(result2);
+            results.push({ serviceName: spec.serviceName, result: result2 });
+            continue;
+          }
           await this.verifyImageBuilt(tag);
           if (spec.config.staticExtractOnly && spec.config.staticOutDir) {
             await this.moveStaticBuildToHost(
@@ -6663,7 +7006,7 @@ var DockerRuntime = class _DockerRuntime {
               spec.config.staticOutDir,
               spec.logger
             );
-            const result2 = {
+            const result2 = isCancelled(spec.config.sessionId) ? cancelledResult(spec.config.sessionId, startedAt) : {
               sessionId: spec.config.sessionId,
               status: "deploying",
               imageRef: spec.config.staticOutDir,
@@ -6684,6 +7027,13 @@ var DockerRuntime = class _DockerRuntime {
           spec.onResult?.(result);
           results.push({ serviceName: spec.serviceName, result });
         } catch (err) {
+          if (isCancelled(spec.config.sessionId) || err instanceof BuildCancelledError) {
+            spec.logger.log("Docker build cancelled\n", "error");
+            const result2 = cancelledResult(spec.config.sessionId, startedAt);
+            spec.onResult?.(result2);
+            results.push({ serviceName: spec.serviceName, result: result2 });
+            continue;
+          }
           const msg = safeErrorMessage(err);
           spec.logger.log(`Docker build failed: ${msg}
 `, "error");
@@ -6699,6 +7049,9 @@ var DockerRuntime = class _DockerRuntime {
       }
       return results;
     } finally {
+      for (const [sessionId, abort] of abortControllers) {
+        releaseDockerBuild(sessionId, abort);
+      }
       if (isSsh) {
         this.connectionOptions?.executor?.exec(`rm -rf ${sq(remoteContextDir)}`).catch(() => {
         });
@@ -6707,11 +7060,23 @@ var DockerRuntime = class _DockerRuntime {
     }
   }
   async cancelBuild(sessionId) {
+    for (const [activeId, abort] of activeDockerBuilds) {
+      if (cancelCovers(sessionId, activeId)) abort.abort();
+    }
+    recordPendingCancellation(sessionId);
+    const executor = this.transport.kind === "ssh" ? this.connectionOptions?.executor : void 0;
+    if (executor) {
+      await killProcessesUnderDir(executor, `/tmp/openship-build-${sessionId}`, {
+        includeSuffixed: true
+      });
+    }
     const containers = await this.docker.listContainers({
       all: true,
-      filters: { label: [`openship.build=${sessionId}`] }
+      filters: { label: ["openship.build"] }
     });
     for (const c of containers) {
+      const buildId = c.Labels?.["openship.build"];
+      if (!buildId || !cancelCovers(sessionId, buildId)) continue;
       try {
         await this.docker.getContainer(c.Id).remove({ force: true });
       } catch {
@@ -6732,7 +7097,7 @@ var DockerRuntime = class _DockerRuntime {
     }
     const containerName = `openship-${config.runtimeName || config.projectId}-${config.deploymentId}`;
     const env = [
-      `PORT=${config.port}`,
+      ...config.portless ? [] : [`PORT=${config.port}`],
       `NODE_ENV=${config.environment === "production" ? "production" : "development"}`,
       ...Object.entries(config.envVars).map(([k, v]) => `${k}=${v}`)
     ];
@@ -6796,7 +7161,9 @@ var DockerRuntime = class _DockerRuntime {
         // rebuild, exactly like a compose service.
         ...networkId ? { service: config.networkAlias } : {}
       }),
-      ExposedPorts: { [`${config.port}/tcp`]: {} },
+      // A worker exposes and publishes no port (#538-B); everything else exposes
+      // its app port for the loopback publish below.
+      ...config.portless ? {} : { ExposedPorts: { [`${config.port}/tcp`]: {} } },
       ...networkId ? { NetworkingConfig: { EndpointsConfig: { [networkId]: { Aliases: aliases } } } } : {},
       HostConfig: {
         RestartPolicy: restartPolicy,
@@ -6814,10 +7181,13 @@ var DockerRuntime = class _DockerRuntime {
         // app directly, bypassing the edge's SSL/rate-limit/rules (and Docker's
         // iptables bypass ufw). A pinned `config.hostPort` (loopback-port route
         // strategy) is stable across redeploys; otherwise a random loopback port.
-        PortBindings: {
-          [`${config.port}/tcp`]: [
-            { HostIp: "127.0.0.1", HostPort: config.hostPort ? String(config.hostPort) : "" }
-          ]
+        // A worker (config.portless) binds no host port at all (#538-B).
+        ...config.portless ? {} : {
+          PortBindings: {
+            [`${config.port}/tcp`]: [
+              { HostIp: "127.0.0.1", HostPort: config.hostPort ? String(config.hostPort) : "" }
+            ]
+          }
         }
       }
     });
@@ -6869,6 +7239,7 @@ var DockerRuntime = class _DockerRuntime {
     }
     const container = this.docker.getContainer(containerId);
     try {
+      await gracefulStopForGrace(container);
       await container.remove({ force: true });
     } catch (err) {
       if (!isDockerNotFoundError(err)) throw err;
@@ -7135,13 +7506,39 @@ var DockerRuntime = class _DockerRuntime {
     }
     const executor = this.connectionOptions?.executor;
     if (executor) {
-      await executor.exec(`docker pull ${sq(ref)}`, { timeout: 10 * 6e4 });
+      const timeout = 10 * 6e4;
+      const auth = await this.connectionOptions?.resolveRegistryAuth?.(ref);
+      const config = auth ? dockerConfigJsonFor(auth) : null;
+      if (!config) {
+        await executor.exec(`docker pull ${sq(ref)}`, { timeout });
+        return;
+      }
+      const dir = `/tmp/openship-pull-${crypto.randomUUID()}`;
+      try {
+        await executor.exec(`mkdir -m 700 ${sq(dir)}`);
+        await executor.writeFile(`${dir}/config.json`, config);
+        await executor.exec(`chmod 600 ${sq(dir)}/config.json`);
+        await executor.exec(
+          `DOCKER_CONFIG=${sq(dir)} docker pull ${sq(ref)}; rc=$?; rm -rf ${sq(dir)}; exit $rc`,
+          { timeout }
+        );
+      } finally {
+        await executor.exec(`rm -rf ${sq(dir)}`).catch(() => {
+        });
+      }
       return;
     }
-    const stream = await this.docker.pull(ref);
-    await new Promise((resolve, reject) => {
-      this.docker.modem.followProgress(stream, (err) => err ? reject(err) : resolve());
-    });
+    const authconfig = this.connectionOptions?.resolveRegistryAuth ? await this.connectionOptions.resolveRegistryAuth(ref) : await resolveDockerAuth(ref);
+    try {
+      const stream = await this.docker.pull(ref, authconfig ? { authconfig } : {});
+      await new Promise((resolve, reject) => {
+        this.docker.modem.followProgress(stream, (err) => err ? reject(err) : resolve());
+      });
+    } catch (err) {
+      throw new Error(
+        `Failed to pull ${ref} from ${registryForImage(ref)}: ${safeErrorMessage(err)}`
+      );
+    }
   }
   /** Is this image tag present on THIS daemon? Distinguishes a locally-built
    *  image (must be transferred cross-server) from a registry tag (the target
@@ -7731,16 +8128,17 @@ var DockerRuntime = class _DockerRuntime {
     const network = this.docker.getNetwork(networkId);
     for (const m of members) {
       if (!m.containerId) continue;
+      const aliases = m.aliases.filter(Boolean);
       try {
         await network.connect({
           Container: m.containerId,
-          EndpointConfig: m.alias ? { Aliases: [m.alias] } : {}
+          EndpointConfig: aliases.length ? { Aliases: aliases } : {}
         });
       } catch (err) {
         const msg = err?.message ?? "";
         if (!/already exists|already connected/i.test(msg)) {
           console.warn(
-            `[docker] group join failed for ${m.containerId.slice(0, 12)} (${m.alias}): ${msg}`
+            `[docker] group join failed for ${m.containerId.slice(0, 12)} (${aliases.join(", ")}): ${msg}`
           );
         }
       }
@@ -7802,6 +8200,20 @@ var DockerRuntime = class _DockerRuntime {
    * the narrow case where the network's identity changed out-of-band (docker
    * network prune/rm, daemon/host rebuild) and surviving containers fell off it.
    */
+  /**
+   * A container that can never be attached to a network, because it doesn't own a
+   * network namespace to attach (compose `network_mode: container:…`/`none`, or a
+   * migration-adopted `host`).
+   *
+   * Both membership loops below are best-effort and swallow errors, so without this
+   * they'd still work — they'd just log "connect failed" for such a container on
+   * every single deploy, forever, over something that is correct by design. Read
+   * from `HostConfig.NetworkMode`, which `/containers/json` reports.
+   */
+  cannotJoinNetworks(container) {
+    const mode = container.HostConfig?.NetworkMode;
+    return !!mode && (mode.startsWith("container:") || mode === "none" || mode === "host");
+  }
   async reconcileNetworkMembership(networkId, projectId) {
     let containers;
     try {
@@ -7818,6 +8230,7 @@ var DockerRuntime = class _DockerRuntime {
         (n) => n?.NetworkID === networkId
       );
       if (onNetwork) continue;
+      if (this.cannotJoinNetworks(c)) continue;
       const service = c.Labels?.["openship.service"];
       try {
         await network.connect({
@@ -7867,6 +8280,7 @@ var DockerRuntime = class _DockerRuntime {
           (n) => n?.NetworkID === netId
         );
         if (onNetwork) continue;
+        if (this.cannotJoinNetworks(c)) continue;
         try {
           await network.connect({ Container: c.Id });
         } catch (err) {
@@ -7901,6 +8315,7 @@ var DockerRuntime = class _DockerRuntime {
     const containerName = `openship-${config.slug}-${config.serviceName}`;
     try {
       const existing = this.docker.getContainer(containerName);
+      await gracefulStopForGrace(existing);
       await existing.remove({ force: true });
     } catch {
     }
@@ -7909,6 +8324,11 @@ var DockerRuntime = class _DockerRuntime {
       ...Object.entries(config.environment).map(([k, v]) => `${k}=${v}`)
     ];
     const cmd = resolveComposeCmd(config);
+    const entrypoint = resolveComposeEntrypoint(config.advanced);
+    const sharedNetwork = config.namespaces?.network;
+    const sharesNetns = !!sharedNetwork && sharedNetwork !== "none";
+    const ownsProjectEndpoint = ownsNetworkEndpoint(sharedNetwork);
+    const sharedPid = config.namespaces?.pid;
     const { exposedPorts, portBindings } = parsePortBindings(config.ports);
     if (!config.namespaceVolumes) {
       await this.assertNoForeignNamedVolumeCollision(config);
@@ -7917,6 +8337,7 @@ var DockerRuntime = class _DockerRuntime {
     const binds = scopedBinds.length > 0 ? scopedBinds : void 0;
     const restartPolicy = resolveRestartPolicy(config.restart);
     const healthcheck = toDockerHealthcheck(config.advanced?.healthcheck);
+    const stopConfig = toStopConfig(config.advanced);
     log({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       message: `Creating service container ${containerName} from ${config.image}...
@@ -7929,6 +8350,23 @@ var DockerRuntime = class _DockerRuntime {
 `,
       level: "info"
     });
+    if (sharedNetwork) {
+      log({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: `Network namespace: ${sharedNetwork} \u2014 this container gets no interface of its own` + (sharesNetns ? `, so its ports, project-network alias, and hostname come from the service it shares. Publish and route on THAT service instead.
+` : ` and no network access at all.
+`),
+        level: "warn"
+      });
+    }
+    if (sharedPid) {
+      log({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        message: `PID namespace: ${sharedPid}
+`,
+        level: "info"
+      });
+    }
     if (!config.image.startsWith("openship/")) {
       try {
         log({
@@ -7952,8 +8390,16 @@ var DockerRuntime = class _DockerRuntime {
       name: containerName,
       Image: config.image,
       Cmd: cmd,
+      // Entrypoint (#575). SPREAD rather than assigned, because `undefined` and `[]`
+      // must reach Docker differently: absent leaves the image's own ENTRYPOINT
+      // alone, while `Entrypoint: []` clears it. Assigning `undefined` would send the
+      // key, and the same conditional-spread shape is why `toStopConfig` returns an
+      // object instead of nullable fields.
+      ...entrypoint === void 0 ? {} : { Entrypoint: entrypoint },
       Env: env,
-      Hostname: config.serviceName,
+      // Docker rejects an explicit hostname when the network namespace is another
+      // container's — that container owns the UTS identity too.
+      ...sharesNetns ? {} : { Hostname: config.serviceName },
       Labels: {
         ...this.labels({
           deploymentId: config.deploymentId,
@@ -7962,23 +8408,31 @@ var DockerRuntime = class _DockerRuntime {
         "openship.service": config.serviceName
       },
       ...healthcheck && { Healthcheck: healthcheck },
-      ExposedPorts: exposedPorts,
+      ...stopConfig,
+      ...ownsProjectEndpoint ? { ExposedPorts: exposedPorts } : {},
       HostConfig: {
         RestartPolicy: restartPolicy,
         ...dockerResourceLimits(config.resources),
-        PortBindings: portBindings,
+        ...ownsProjectEndpoint ? { PortBindings: portBindings } : {},
         Binds: binds,
-        NetworkMode: group.id
+        // The project network is the default; a compose `network_mode` replaces it.
+        NetworkMode: sharedNetwork ?? group.id,
+        ...sharedPid ? { PidMode: sharedPid } : {}
       },
-      NetworkingConfig: {
-        EndpointsConfig: {
-          [group.id]: {
-            // Default service name plus any operator-chosen aliases; both
-            // resolve to this container on the project network.
-            Aliases: buildNetworkAliases(config.serviceName, config.extraAliases)
+      // A declared network mode means there is no endpoint to name — omit the
+      // block entirely rather than send an empty one (and never contradict
+      // `NetworkMode: none` by attaching a network anyway).
+      ...ownsProjectEndpoint ? {
+        NetworkingConfig: {
+          EndpointsConfig: {
+            [group.id]: {
+              // Default service name plus any operator-chosen aliases; both
+              // resolve to this container on the project network.
+              Aliases: buildNetworkAliases(config.serviceName, config.extraAliases)
+            }
           }
         }
-      }
+      } : {}
     });
     try {
       await container.start();
@@ -8034,12 +8488,17 @@ export {
   startExecStream,
   startAttachStream,
   daemonConnectionFrom,
+  DEFAULT_DOCKER_SOCKET_PATH,
+  resolveLocalDockerSocketPath,
   ownsBuiltImage,
   buildInContainerExecCmd,
   resolveExecExitCode,
   buildNetworkAliases,
   parsePortBindings,
   packBuildContext,
+  toDockerHealthcheck,
+  toStopConfig,
+  gracefulStopForGrace,
   splitDockerFrames,
   parseContainerEventLine,
   DockerRuntime