openship 0.6.5 → 0.6.7

package/dist/{chunk-VDESJSG6.js → chunk-LHFXSC36.js}

@@ -3,24 +3,37 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
+  BuildKitTraceDecoder,
   createDockerBuildContext,
-  generateDockerfile,
+  missingContextDockerfileMessage,
   prepareSourceTree,
-  resolveDockerfileCandidates,
-  resolveServiceDockerfile,
-  staticBuilderOutputPath
-} from "./chunk-LFCSC4IU.js";
+  resolveServiceDockerfile
+} from "./chunk-XWHWTHEL.js";
+import {
+  isArtifactPathRef,
+  removeManagedArtifact
+} from "./chunk-WU54BXFE.js";
 import {
   BuildCancelledError,
   BuildLogger,
   assembleGitClone,
+  builderContextRoot,
+  dockerBuildContextDirectory,
+  droppedRuntimeEnvMessage,
+  generateDockerfile,
+  isExcludedDocRootEntry,
   killProcessesUnderDir,
   materializeGitSsh,
+  normalizeDockerRelativePath,
   parseLogLevel,
+  resolveContextDockerfileCandidates,
+  resolveDockerfileCandidates,
   shellGitSshWriter,
+  splitRuntimeEnv,
   sq,
+  staticBuilderOutputPath,
   transferLocalDirectory
-} from "./chunk-TM2IQPYU.js";
+} from "./chunk-H4FS5BED.js";
 import {
   DOCKER_DIAL_STDIO_COMMAND,
   attachDialStdioDiagnostics,
@@ -29,21 +42,28 @@ import {
   execSshCommand,
   openDockerDialStdioChannel,
   openSshUnixSocket
-} from "./chunk-5OUWIPOB.js";
+} from "./chunk-5T4UVOM3.js";
 import {
   dirOf,
   ensureOwnedDir
-} from "./chunk-WFRXYWK2.js";
+} from "./chunk-FZ6QCF6B.js";
+import {
+  OPENSHIP_LABEL
+} from "./chunk-UWEV6XTS.js";
+import {
+  isRuntimeNotFoundError
+} from "./chunk-N5YZMO33.js";
 import {
   formatCpuCores,
   formatMemoryMb,
   hasCpuLimit,
   hasMemoryLimit,
-  isRuntimeNotFoundError,
   ownsNetworkEndpoint,
+  registryConfigKeys,
+  registryForImage,
   safeErrorMessage,
   withTimeout
-} from "./chunk-LEYSL46B.js";
+} from "./chunk-2VSW6Q6C.js";
 import {
   __commonJS,
   __require,
@@ -313,7 +333,7 @@ var require_buffer_list = __commonJS({
         }
       }, {
         key: "join",
-        value: function join2(s) {
+        value: function join3(s) {
           if (this.length === 0) return "";
           var p = this.head;
           var ret = "" + p.data;
@@ -4607,6 +4627,83 @@ var tarFs = __toESM(require_tar_fs(), 1);
 import Dockerode from "dockerode";
 import { createGzip } from "zlib";
 import { PassThrough, Writable } from "stream";
+import { relative, sep } from "path";
+
+// ../../packages/adapters/src/runtime/docker-auth.ts
+import { readFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+function firstPresent(values, keys) {
+  if (!values) return void 0;
+  for (const key of keys) {
+    if (Object.hasOwn(values, key)) return { key, value: values[key] };
+  }
+  return void 0;
+}
+function dockerConfigJsonFor(auth) {
+  const a = auth;
+  const registry = a.serveraddress?.trim();
+  if (!registry) return null;
+  if (a.identitytoken) {
+    return JSON.stringify({ auths: { [registry]: { identitytoken: a.identitytoken } } });
+  }
+  if (!a.username || !a.password) return null;
+  const encoded = Buffer.from(`${a.username}:${a.password}`).toString("base64");
+  return JSON.stringify({ auths: { [registry]: { auth: encoded } } });
+}
+function toAuthConfig(entry, serveraddress) {
+  if (entry.identitytoken) {
+    return { identitytoken: entry.identitytoken, serveraddress };
+  }
+  if (entry.username && entry.password) {
+    return { username: entry.username, password: entry.password, serveraddress };
+  }
+  if (!entry.auth) return void 0;
+  let decoded;
+  try {
+    decoded = Buffer.from(entry.auth, "base64").toString("utf8");
+  } catch {
+    return void 0;
+  }
+  const separator = decoded.indexOf(":");
+  if (separator < 1) return void 0;
+  return {
+    username: decoded.slice(0, separator),
+    password: decoded.slice(separator + 1),
+    serveraddress
+  };
+}
+var DockerCredentialHelperError = class extends Error {
+  constructor(registry) {
+    super(
+      `Openship can't read the credentials for ${registry}: they are stored in a Docker credential helper, which is not available inside the Openship container. Add the credentials inline to the Docker config (docker logout ${registry}, remove the credential helper for it, then docker login ${registry}), or use a public image.`
+    );
+    this.name = "DockerCredentialHelperError";
+  }
+};
+async function resolveDockerAuth(ref) {
+  const registry = registryForImage(ref);
+  const configPath = join(
+    process.env.DOCKER_CONFIG || join(homedir(), ".docker"),
+    "config.json"
+  );
+  let config;
+  try {
+    config = JSON.parse(await readFile(configPath, "utf8"));
+  } catch {
+    return void 0;
+  }
+  if (!config || typeof config !== "object") return void 0;
+  const keys = registryConfigKeys(registry);
+  const inline = firstPresent(config.auths, keys);
+  const usable = inline ? toAuthConfig(inline.value, inline.key) : void 0;
+  if (usable) return usable;
+  const helperForRegistry = firstPresent(config.credHelpers, keys);
+  if (helperForRegistry || config.credsStore && inline) {
+    throw new DockerCredentialHelperError(registry);
+  }
+  return void 0;
+}
 
 // ../../packages/adapters/src/runtime/source-tarball.ts
 function githubTarballUrl(repoUrl, ref) {
@@ -4634,6 +4731,10 @@ var MODE_SUFFIX = /:(ro|rw|z|Z|nocopy)$/;
 function scopedVolumeName(slug, name) {
   return `openship-${slug}-${name}`;
 }
+function ensureScopedVolumeName(slug, source) {
+  const prefix = `openship-${slug}-`;
+  return source.startsWith(prefix) ? source : scopedVolumeName(slug, source);
+}
 function isHostPathSource(source) {
   return source.startsWith("/") || source.startsWith("./") || source.startsWith("../") || source.startsWith("~");
 }
@@ -4792,6 +4893,9 @@ function resolveComposeCmd(config) {
   if (config.commandArgv != null) return config.commandArgv;
   return config.command ? ["sh", "-c", config.command] : void 0;
 }
+function resolveComposeEntrypoint(advanced) {
+  return advanced?.entrypoint ?? void 0;
+}
 
 // ../../packages/adapters/src/runtime/resource-limits.ts
 function dockerResourceLimits(resources) {
@@ -4843,8 +4947,8 @@ function describeResourceLimits(resources) {
 // ../../packages/adapters/src/runtime/docker-transport.ts
 import { createHash } from "crypto";
 import { readFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 
 // ../../packages/adapters/src/runtime/docker-ssh-agent.ts
 import net2 from "net";
@@ -5317,7 +5421,7 @@ function createDockerSshBridge(opts) {
 var DEFAULT_DOCKER_SOCKET_PATH = "/var/run/docker.sock";
 var contextSocketCache = /* @__PURE__ */ new Map();
 function resolveDockerContextSocket(env) {
-  const configDir = env.DOCKER_CONFIG?.trim() || join(homedir(), ".docker");
+  const configDir = env.DOCKER_CONFIG?.trim() || join2(homedir2(), ".docker");
   let name = env.DOCKER_CONTEXT?.trim();
   const cacheKey = `${configDir}\0${name ?? ""}`;
   const cached = contextSocketCache.get(cacheKey);
@@ -5325,13 +5429,13 @@ function resolveDockerContextSocket(env) {
   let socket = null;
   try {
     if (!name) {
-      const config = JSON.parse(readFileSync(join(configDir, "config.json"), "utf8"));
+      const config = JSON.parse(readFileSync(join2(configDir, "config.json"), "utf8"));
       name = typeof config.currentContext === "string" ? config.currentContext.trim() : "";
     }
     if (name && name !== "default") {
       const digest = createHash("sha256").update(name).digest("hex");
       const meta = JSON.parse(
-        readFileSync(join(configDir, "contexts", "meta", digest, "meta.json"), "utf8")
+        readFileSync(join2(configDir, "contexts", "meta", digest, "meta.json"), "utf8")
       );
       const host = meta.Endpoints?.docker?.Host;
       if (typeof host === "string" && host.startsWith("unix://")) {
@@ -5620,9 +5724,10 @@ function parsePortBindings(portSpecs) {
   }
   return { exposedPorts, portBindings };
 }
-function packBuildContext(contextDir, entries, cancelSignal) {
+function packBuildContext(contextDir, entries, cancelSignal, ignoreContextPath) {
   const controller = new AbortController();
-  const pack2 = tarFs.pack(contextDir, { entries });
+  const ignore = ignoreContextPath ? (absolutePath) => ignoreContextPath(relative(contextDir, absolutePath).split(sep).join("/")) : void 0;
+  const pack2 = tarFs.pack(contextDir, { entries, ignore });
   const body = pack2.pipe(createGzip());
   let contextError = null;
   const capture = (err) => {
@@ -5754,14 +5859,22 @@ function extractNetworkInfo(data) {
       break;
     }
   }
+  const hostPortByContainerPort = {};
   let hostPort;
-  for (const bindings of Object.values(data.NetworkSettings.Ports ?? {})) {
-    if (bindings?.[0]?.HostPort) {
-      hostPort = parseInt(bindings[0].HostPort, 10);
-      break;
-    }
+  for (const [key, bindings] of Object.entries(data.NetworkSettings.Ports ?? {})) {
+    const bound = bindings?.[0]?.HostPort;
+    if (!bound) continue;
+    const parsed = parseInt(bound, 10);
+    if (!Number.isFinite(parsed)) continue;
+    const containerPort = parseInt(key.split("/")[0] ?? "", 10);
+    if (Number.isFinite(containerPort)) hostPortByContainerPort[containerPort] = parsed;
+    hostPort ??= parsed;
   }
-  return { ip, hostPort };
+  return {
+    ip,
+    hostPort,
+    ...Object.keys(hostPortByContainerPort).length ? { hostPortByContainerPort } : {}
+  };
 }
 function parseLoadedImageRef(output) {
   const matches = [...(output || "").matchAll(/Loaded image(?: ID)?:\s*(\S+)/gi)];
@@ -5918,11 +6031,11 @@ var DockerRuntime = class _DockerRuntime {
   /** Labels applied to both build images and deploy containers. */
   labels(config) {
     const l = {
-      "openship.project": config.projectId
+      [OPENSHIP_LABEL.project]: config.projectId
     };
-    if (config.deploymentId) l["openship.deployment"] = config.deploymentId;
-    if (config.sessionId) l["openship.build"] = config.sessionId;
-    if (config.service) l["openship.service"] = config.service;
+    if (config.deploymentId) l[OPENSHIP_LABEL.deployment] = config.deploymentId;
+    if (config.sessionId) l[OPENSHIP_LABEL.build] = config.sessionId;
+    if (config.service) l[OPENSHIP_LABEL.service] = config.service;
     return l;
   }
   // ── Build lifecycle ────────────────────────────────────────────────────
@@ -5933,7 +6046,7 @@ var DockerRuntime = class _DockerRuntime {
    */
   async estimateContextSize(dir) {
     const { stat, readdir } = await import("fs/promises");
-    const { join: join2 } = await import("path");
+    const { join: join3 } = await import("path");
     let total = 0;
     const stack = [dir];
     while (stack.length) {
@@ -5945,7 +6058,7 @@ var DockerRuntime = class _DockerRuntime {
         continue;
       }
       for (const entry of entries) {
-        const full = join2(current, entry.name);
+        const full = join3(current, entry.name);
         if (entry.isDirectory()) {
           stack.push(full);
         } else if (entry.isFile()) {
@@ -5964,12 +6077,20 @@ var DockerRuntime = class _DockerRuntime {
     logger.log(`[${step}] ${label} ${message}`);
     logger.step(step, status, message);
   }
-  handleBuildEvent(event, logger) {
+  handleBuildEvent(event, logger, trace) {
     const errorMessage = event.errorDetail?.message ?? event.error;
     if (errorMessage) {
       logger.log(errorMessage, "error");
       return errorMessage;
     }
+    if (event.id === "moby.buildkit.trace" && typeof event.aux === "string") {
+      let hint = null;
+      for (const line of trace?.push(event.aux) ?? []) {
+        logger.log(line.message, line.level === "error" ? "error" : parseLogLevel(line.message));
+        hint ??= this.extractBuildFailureHint(line.message);
+      }
+      return hint;
+    }
     if (event.stream) {
       const line = event.stream.trim();
       if (!line) return null;
@@ -6026,6 +6147,12 @@ var DockerRuntime = class _DockerRuntime {
     if (/returned a non-zero code:\s*\d+/i.test(line)) {
       return line;
     }
+    if (/requires? BuildKit|BuildKit is enabled but the buildx component/i.test(line)) {
+      return `${line} \u2014 this Dockerfile needs BuildKit. Install the docker buildx plugin on the build host (\`docker-buildx-plugin\`), or remove the BuildKit-only instruction.`;
+    }
+    if (/buildkit (is )?(not (supported|enabled)|disabled)|builder version.*not supported/i.test(line)) {
+      return `${line} \u2014 this Dockerfile needs BuildKit but this Docker daemon has it disabled. Enable it ("features": {"buildkit": true} in daemon.json) or remove the BuildKit-only instruction.`;
+    }
     if (/\/workspace\/package\.json/i.test(line) && /ENOENT/i.test(line)) {
       return "Docker build ran from /workspace but package.json was not found there. The configured rootDirectory is likely empty or incorrect.";
     }
@@ -6077,12 +6204,35 @@ var DockerRuntime = class _DockerRuntime {
       { excludes: [] }
     );
   }
+  /**
+   * Is BuildKit usable on the remote host? Probed, never assumed: a plain `docker`
+   * CLI without the buildx plugin HARD-FAILS when BuildKit is requested explicitly
+   * ("BuildKit is enabled but the buildx component is missing or broken"), while an
+   * unadorned `docker build` on the same box falls back to the legacy builder and
+   * works — the same trap {@link buildImage} in system/managed-image.ts documents.
+   * So we ask first, and only then opt in.
+   *
+   * Memoized per adapter instance (one instance ≈ one target daemon), so a compose
+   * batch pays a single `docker buildx version` for N images.
+   */
+  buildKitProbe = null;
+  async remoteBuildKitAvailable() {
+    const executor = this.connectionOptions?.executor;
+    if (!executor) return false;
+    const probe = this.buildKitProbe ??= executor.exec("docker buildx version >/dev/null 2>&1 && echo OPENSHIP_BUILDKIT_OK || true").then((out) => out.split(/\r?\n/).some((line) => line.trim() === "OPENSHIP_BUILDKIT_OK")).catch(() => false);
+    const available = await probe;
+    if (!available) this.buildKitProbe = null;
+    return available;
+  }
   /**
    * Run native `docker build` on the remote host against an already-transferred
-   * context dir. One image; `dockerfileName` selects which Dockerfile in the
-   * shared tree to use (so N services can build from one transferred context).
+   * context dir. One image; `dockerfileName` selects which Dockerfile to use (so N
+   * services can build from one transferred tree) and is relative to
+   * `remoteBuildDir` — the build CONTEXT, which for a compose service is its own
+   * `build:` directory inside that tree, not the tree root (#634).
    */
-  async buildImageOnRemote(config, remoteContextDir, dockerfileName, tag, log, signal) {
+  async buildImageOnRemote(config, remoteBuildDir, dockerfileName, tag, log, opts) {
+    const signal = opts?.signal;
     const executor = this.connectionOptions?.executor;
     if (!executor) throw new Error("SSH build path requires an executor on connectionOptions");
     const buildArgs = Object.entries({
@@ -6093,7 +6243,22 @@ var DockerRuntime = class _DockerRuntime {
       this.labels({ projectId: config.projectId, sessionId: config.sessionId })
     ).map(([k, v]) => `--label ${sq(`${k}=${v}`)}`).join(" ");
     const dockerfileFlag = dockerfileName && dockerfileName !== "Dockerfile" ? ` -f ${sq(dockerfileName)}` : "";
-    const buildCmd = `cd ${sq(remoteContextDir)} && docker build --progress=plain -t ${sq(tag)}${dockerfileFlag} ${labelArgs} ${buildArgs} --force-rm .`;
+    const buildKit = await this.remoteBuildKitAvailable();
+    const builderEnv = buildKit ? "DOCKER_BUILDKIT=1 " : "";
+    const builderFlags = buildKit ? " --progress=plain" : " --force-rm";
+    if (buildKit) {
+      log.log("Builder: BuildKit (docker buildx detected on the host)");
+    } else if (opts?.requiresBuildKit) {
+      log.log(
+        "This Dockerfile needs BuildKit, but the build host's docker CLI has no buildx plugin. Install it (`docker-buildx-plugin`, or Docker's official packages) \u2014 the build below will use the legacy builder and is likely to fail.",
+        "warn"
+      );
+    } else {
+      log.log(
+        "Builder: legacy (docker buildx not available on the host) \u2014 BuildKit-only Dockerfile syntax such as `RUN --mount` will not work"
+      );
+    }
+    const buildCmd = `cd ${sq(remoteBuildDir)} && ${builderEnv}docker build${builderFlags} -t ${sq(tag)}${dockerfileFlag} ${labelArgs} ${buildArgs} .`;
     log.log(`Running on remote: ${buildCmd}`);
     log.log("\u2500\u2500\u2500 docker build output \u2500\u2500\u2500");
     this.emitDockerStep(log, "install", "running", "Running install inside container (docker build)");
@@ -6205,15 +6370,50 @@ var DockerRuntime = class _DockerRuntime {
    * (clone-on-server). Mirrors resolveServiceDockerfile but probes the remote
    * tree with `test -f` instead of the local FS: a repository Dockerfile
    * candidate is used when present; otherwise a Dockerfile is generated locally
-   * (pure fn) and written to the remote tree. Returns the dockerfile path
-   * relative to `remoteContextDir`.
+   * (pure fn) and written to the remote tree.
+   *
+   * Returns the build CONTEXT dir on the host plus the Dockerfile path relative to
+   * it — the same pair {@link resolveServiceDockerfile} produces locally, because
+   * these two resolvers are one behaviour with two probes and a narrowed context
+   * learned by only one of them would leave #634 reproducible on this target.
    */
-  async resolveRemoteDockerfile(config, remoteContextDir, generatedName, requireRepositoryDockerfile) {
+  async resolveRemoteDockerfile(config, remoteContextDir, generatedName, requireRepositoryDockerfile, log) {
     const executor = this.connectionOptions?.executor;
     if (!executor) throw new Error("Clone-on-server requires an SSH executor on connectionOptions");
-    for (const candidate of resolveDockerfileCandidates(config.rootDirectory, config.dockerfilePath)) {
-      const out = await executor.exec(`test -f ${sq(`${remoteContextDir}/${candidate}`)} && echo yes || true`).catch(() => "");
-      if (out.trim() === "yes") return candidate;
+    const contextSubdir = dockerBuildContextDirectory(config);
+    const remoteBuildDir = contextSubdir ? `${remoteContextDir}/${contextSubdir}` : remoteContextDir;
+    if (contextSubdir) {
+      const real = await executor.exec(`cd ${sq(remoteBuildDir)} 2>/dev/null && pwd -P || true`).then((out) => out.trim()).catch(() => "");
+      const root = await executor.exec(`cd ${sq(remoteContextDir)} && pwd -P`).then((out) => out.trim()).catch(() => "");
+      if (!real) {
+        throw new Error(
+          `Build context "${contextSubdir}" is not a directory in the cloned source. Check the service's build path.`
+        );
+      }
+      if (!root || real !== root && !real.startsWith(`${root}/`)) {
+        throw new Error(`Build context "${contextSubdir}" resolves outside the cloned source.`);
+      }
+    }
+    const candidates = contextSubdir ? resolveContextDockerfileCandidates(contextSubdir, config.dockerfilePath) : resolveDockerfileCandidates(config.rootDirectory, config.dockerfilePath);
+    for (const candidate of candidates) {
+      const out = await executor.exec(`test -f ${sq(`${remoteBuildDir}/${candidate}`)} && echo yes || true`).catch(() => "");
+      if (out.trim() === "yes") {
+        const explicit = normalizeDockerRelativePath(config.dockerfilePath);
+        if (contextSubdir && explicit && candidate === "Dockerfile" && explicit !== "Dockerfile" && explicit !== `${contextSubdir}/Dockerfile`) {
+          log?.log(
+            `Configured Dockerfile "${config.dockerfilePath}" was not found in build context "${contextSubdir}" \u2014 using ${contextSubdir}/Dockerfile instead.`,
+            "warn"
+          );
+        }
+        return { remoteBuildDir, dockerfileName: candidate };
+      }
+    }
+    if (contextSubdir) {
+      throw new Error(
+        missingContextDockerfileMessage(contextSubdir, config.dockerfilePath, {
+          generatedRecipeRefused: !requireRepositoryDockerfile
+        })
+      );
     }
     if (requireRepositoryDockerfile) {
       const expected = config.dockerfilePath?.trim() || "Dockerfile";
@@ -6222,7 +6422,7 @@ var DockerRuntime = class _DockerRuntime {
       );
     }
     await executor.writeFile(`${remoteContextDir}/${generatedName}`, generateDockerfile(config));
-    return generatedName;
+    return { remoteBuildDir, dockerfileName: generatedName };
   }
   async buildViaSshTarPipe(config, buildContext, tag, log, signal) {
     const remoteContextDir = `/tmp/openship-build-${config.sessionId}`;
@@ -6230,11 +6430,11 @@ var DockerRuntime = class _DockerRuntime {
       await this.transferBuildContext(buildContext.contextDir, remoteContextDir, log);
       await this.buildImageOnRemote(
         config,
-        remoteContextDir,
+        buildContext.contextSubdir ? `${remoteContextDir}/${buildContext.contextSubdir}` : remoteContextDir,
         buildContext.dockerfileName,
         tag,
         log,
-        signal
+        { signal, requiresBuildKit: buildContext.requiresBuildKit }
       );
     } finally {
       this.connectionOptions?.executor?.exec(`rm -rf ${sq(remoteContextDir)}`).catch(() => {
@@ -6242,6 +6442,41 @@ var DockerRuntime = class _DockerRuntime {
       await buildContext.cleanup();
     }
   }
+  /**
+   * Pick the Engine-API builder for ONE dockerode build, for BOTH dockerode call
+   * sites (single image and compose batch) — they are the same decision and a
+   * builder learned by only one of them is the "two executors" trap all over again.
+   *
+   * The classic builder is kept as the DEFAULT deliberately. It is what every
+   * self-hosted local build has always used; switching wholesale would change layer
+   * caching for everyone and silently drop the build CPU/memory caps, which BuildKit
+   * ignores. So BuildKit is opted into only where the classic builder cannot work at
+   * all — a Dockerfile whose syntax it rejects (#634).
+   *
+   * Through the ENGINE API (`version=2`), not by shelling out to `docker build`,
+   * which is the first alternative that comes to mind and is not available: the API
+   * image ships `openssh-client rsync git` and no docker CLI (apps/api/Dockerfile),
+   * and the transport may be a TCP socket with no shell at the other end at all.
+   * Nothing needs the buildx plugin either — BuildKit lives in the daemon.
+   *
+   * Asymmetric with the remote CLI path on purpose: there, BuildKit is taken whenever
+   * buildx exists, because that command passes no --memory/--cpus (so there is no cap
+   * to lose) and on docker ≥23 the CLI already defaults to it — the prefix mostly
+   * buys the log line and the buildx-missing warning.
+   */
+  selectDockerodeBuilder(config, requiresBuildKit, log) {
+    if (!requiresBuildKit) return { options: {} };
+    log.log(
+      "Dockerfile uses BuildKit-only syntax (RUN --mount, a syntax directive or a heredoc) \u2014 building with BuildKit."
+    );
+    if (Object.keys(dockerBuildResourceLimits(config.resources)).length > 0) {
+      log.log(
+        "Build CPU/memory limits are not enforced under BuildKit \u2014 this build runs uncapped.",
+        "warn"
+      );
+    }
+    return { options: { version: "2" }, trace: new BuildKitTraceDecoder() };
+  }
   /**
    * Dockerode build path. Used for local socket and TCP transports, plus
    * SSH transports that didn't get an executor wired in (shouldn't happen
@@ -6254,10 +6489,12 @@ var DockerRuntime = class _DockerRuntime {
   async buildViaDockerode(config, buildContext, tag, log, cancelSignal) {
     log.log(`Streaming build context to Docker daemon - image tag: ${tag}`);
     const { body, abortSignal, takeError } = packBuildContext(
-      buildContext.contextDir,
+      buildContext.buildContextDir,
       buildContext.contextEntries,
-      cancelSignal
+      cancelSignal,
+      buildContext.ignoreContextPath
     );
+    const builder = this.selectDockerodeBuilder(config, buildContext.requiresBuildKit, log);
     try {
       const stream = await this.docker.buildImage(body, {
         t: tag,
@@ -6272,10 +6509,11 @@ var DockerRuntime = class _DockerRuntime {
         // needs several GB). Opt-in only; see dockerBuildResourceLimits.
         ...dockerBuildResourceLimits(config.resources),
         forcerm: true,
+        ...builder.options,
         abortSignal
       });
       log.log("Connected to Docker daemon. Build output follows:");
-      await this.streamDockerodeBuild(stream, log);
+      await this.streamDockerodeBuild(stream, log, builder.trace);
       log.log("Docker daemon finished streaming build output. Finalizing image...\n");
     } catch (err) {
       const contextErr = takeError();
@@ -6289,7 +6527,7 @@ var DockerRuntime = class _DockerRuntime {
    * idle timeout + keepalive, and throw on a fatal build event. Shared by the
    * single-image dockerode path and the local batch build (buildImages).
    */
-  async streamDockerodeBuild(stream, log) {
+  async streamDockerodeBuild(stream, log, trace) {
     let fatalBuildError = null;
     await new Promise((resolve, reject) => {
       let settled = false;
@@ -6346,7 +6584,7 @@ var DockerRuntime = class _DockerRuntime {
         },
         (event) => {
           resetIdleTimer();
-          fatalBuildError ??= this.handleBuildEvent(event, log);
+          fatalBuildError ??= this.handleBuildEvent(event, log, trace);
         }
       );
     });
@@ -6415,20 +6653,16 @@ var DockerRuntime = class _DockerRuntime {
           await this.cloneSourceOnRemote(config, remoteContextDir, log);
           if (abort.signal.aborted) throw new BuildCancelledError();
           this.emitDockerStep(log, "clone", "completed", "Source cloned on the server");
-          const dockerfileName = await this.resolveRemoteDockerfile(
+          const { remoteBuildDir, dockerfileName } = await this.resolveRemoteDockerfile(
             config,
             remoteContextDir,
             "Dockerfile.openship",
-            config.stack === "docker"
-          );
-          await this.buildImageOnRemote(
-            config,
-            remoteContextDir,
-            dockerfileName,
-            tag,
-            log,
-            abort.signal
+            config.stack === "docker",
+            log
           );
+          await this.buildImageOnRemote(config, remoteBuildDir, dockerfileName, tag, log, {
+            signal: abort.signal
+          });
         } finally {
           sshExecutor.exec(`rm -rf ${sq(remoteContextDir)}`).catch(() => {
           });
@@ -6458,7 +6692,9 @@ var DockerRuntime = class _DockerRuntime {
       } catch {
         this.emitDockerStep(log, "clone", "completed", "Docker build context ready");
       }
-      if (buildContext.rootDirectory) {
+      if (buildContext.contextSubdir) {
+        log.log(`Using Docker build context: ${buildContext.contextSubdir}`);
+      } else if (buildContext.rootDirectory) {
         log.log(`Using Docker build root: ${buildContext.rootDirectory}`);
       }
       if (buildContext.usesRepositoryDockerfile) {
@@ -6527,6 +6763,7 @@ var DockerRuntime = class _DockerRuntime {
           await this.extractDocRootViaDaemon(tag, docRoot, hostOutDir);
         }
       }
+      await this.pruneBuildFilesFromDocRoot(config, hostOutDir, sshExecutor ?? null, log);
       log.log(`Static files ready at ${hostOutDir}
 `);
     } finally {
@@ -6611,6 +6848,74 @@ var DockerRuntime = class _DockerRuntime {
    * expensive one: every extractor can succeed having copied nothing, which deploys
    * green and then 404s the entire site.
    */
+  /**
+   * Names that must never end up in a public doc-root, matched at its TOP LEVEL
+   * only.
+   *
+   * `.git` is the repository — serving it publishes full source history. The
+   * Dockerfiles and `.dockerignore` are OUR build inputs, and one of them is
+   * literally written into the tree by `resolveServiceDockerfile`.
+   */
+  static DOC_ROOT_EXCLUDED = [
+    ".dockerignore",
+    ".git",
+    "Dockerfile",
+    "Dockerfile.*"
+  ];
+  /**
+   * Remove build inputs from an extracted static doc-root, then re-assert the
+   * contract that it still holds something servable.
+   *
+   * Only runs when the doc-root IS the build context — `outputDirectory` empty or
+   * "." — which is the zero-build "just files, index.html at the root" project. A
+   * real output directory (`dist`, `build`) is written by the build and contains
+   * none of this, so the prune is a no-op there.
+   *
+   * Two distinct problems, one fix. The build context is pruned by `.dockerignore`
+   * and THEN the generated recipe is written into it, so for these projects the
+   * published site contained `.dockerignore` + `Dockerfile.openship…` — and any
+   * tracked `.git` — at their own public URLs. Worse, those files count as
+   * content: a repo with an allowlist `.dockerignore` (`*` + `!src`) extracted to
+   * a tree holding ONLY the two build files, which passed the non-empty check and
+   * deployed green as a site that 404s every request. Pruning first and
+   * re-checking after is what makes that check mean "there is something to serve".
+   */
+  async pruneBuildFilesFromDocRoot(config, hostOutDir, sshExecutor, log) {
+    if (staticBuilderOutputPath(config) !== builderContextRoot(config)) return;
+    if (sshExecutor) {
+      const globs = _DockerRuntime.DOC_ROOT_EXCLUDED.map(
+        (name) => `${sq(hostOutDir)}/${name}`
+      ).join(" ");
+      await sshExecutor.exec(`rm -rf ${globs}`).catch(() => {
+      });
+      log.log(`Excluded build files from the published output (${hostOutDir}).
+`);
+      const listing = (await sshExecutor.exec(`ls -A ${sq(hostOutDir)} | head -1`).catch(() => "x")).trim();
+      this.assertDocRootServable(!listing, hostOutDir);
+      return;
+    }
+    const { readdir, rm } = await import("fs/promises");
+    const { join: join3 } = await import("path");
+    const entries = await readdir(hostOutDir).catch(() => null);
+    if (entries === null) return;
+    const doomed = entries.filter((name) => isExcludedDocRootEntry(name));
+    for (const name of doomed) {
+      await rm(join3(hostOutDir, name), { recursive: true, force: true }).catch(() => {
+      });
+    }
+    if (doomed.length > 0) {
+      log.log(`Excluded build files from the published output: ${doomed.join(", ")}
+`);
+    }
+    this.assertDocRootServable(entries.length === doomed.length, hostOutDir);
+  }
+  /** Post-prune half of the doc-root contract: build inputs are not content. */
+  assertDocRootServable(isEmpty, hostOutDir) {
+    if (!isEmpty) return;
+    throw new Error(
+      `the static output at ${hostOutDir} contains only build files (Dockerfile / .dockerignore) and nothing to serve \u2014 check the project's output directory setting and its .dockerignore.`
+    );
+  }
   assertDocRootFilled(isEmpty, docRoot) {
     if (!isEmpty) return;
     throw new Error(
@@ -6663,12 +6968,12 @@ var DockerRuntime = class _DockerRuntime {
    */
   async extractDocRootViaBindMount(tag, docRoot, hostOutDir) {
     const { mkdir, readdir, writeFile, rm } = await import("fs/promises");
-    const { join: join2 } = await import("path");
+    const { join: join3 } = await import("path");
     const { randomBytes } = await import("crypto");
     await mkdir(hostOutDir, { recursive: true });
     const OUT = "/__openship_out";
     const probe = `.openship-extract-probe-${randomBytes(6).toString("hex")}`;
-    await writeFile(join2(hostOutDir, probe), "probe");
+    await writeFile(join3(hostOutDir, probe), "probe");
     const container = await this.docker.createContainer({
       Image: tag,
       // Override the ENTRYPOINT: builder base images (node, bun) ship a
@@ -6708,7 +7013,7 @@ var DockerRuntime = class _DockerRuntime {
     } finally {
       await container.remove({ force: true }).catch(() => {
       });
-      await rm(join2(hostOutDir, probe), { force: true }).catch(() => {
+      await rm(join3(hostOutDir, probe), { force: true }).catch(() => {
       });
     }
   }
@@ -6797,7 +7102,25 @@ var DockerRuntime = class _DockerRuntime {
         prepareLogger.step("clone", "completed", "Source cloned on the server");
       } else {
         prepareLogger.step("clone", "running", "Preparing shared build context...");
-        tree = await prepareSourceTree(source, { onLog: prepareLogger.callback });
+        tree = await prepareSourceTree(source, {
+          onLog: prepareLogger.callback,
+          // Any service building from its OWN `build:` directory makes the source
+          // root's `.dockerignore` the wrong file to prune this SHARED tree with —
+          // it would delete files the other contexts need. Those builds filter their
+          // own context instead; see SourceTree.dockerignorePruned.
+          //
+          // A malformed value throws here; `true` is the safe answer for it, because
+          // it only skips a destructive prune. Letting the throw out would fail the
+          // WHOLE batch, while per-spec resolution below reports it against the one
+          // service that owns it.
+          perServiceBuildContexts: specs.some((spec) => {
+            try {
+              return Boolean(dockerBuildContextDirectory(spec.config));
+            } catch {
+              return true;
+            }
+          })
+        });
       }
       const resolvedList = await Promise.all(
         specs.map(async (spec) => {
@@ -6805,34 +7128,54 @@ var DockerRuntime = class _DockerRuntime {
           const requireRepo = spec.requireRepositoryDockerfile ?? spec.config.stack === "docker";
           try {
             if (cloneOnServer) {
-              const dockerfileName = await this.resolveRemoteDockerfile(
+              const { remoteBuildDir, dockerfileName } = await this.resolveRemoteDockerfile(
                 spec.config,
                 remoteContextDir,
                 generatedName,
-                requireRepo
+                requireRepo,
+                spec.logger
               );
               return {
                 spec,
                 dockerfileName,
+                remoteBuildSubdir: dockerBuildContextDirectory(spec.config),
+                remoteBuildDir,
+                buildContextDir: null,
                 contextEntries: null,
+                ignoreContextPath: void 0,
+                // Only the dockerode branch consults it, and clone-on-server never
+                // reaches that branch (it is SSH by construction).
+                requiresBuildKit: false,
                 error: null
               };
             }
             const resolved = await resolveServiceDockerfile(tree.contextDir, spec.config, {
               requireRepositoryDockerfile: requireRepo,
-              generatedName
+              generatedName,
+              dockerignorePruned: tree.dockerignorePruned,
+              onLog: spec.logger.callback
             });
             return {
               spec,
               dockerfileName: resolved.dockerfileName,
+              remoteBuildSubdir: resolved.contextSubdir,
+              remoteBuildDir: resolved.contextSubdir ? `${remoteContextDir}/${resolved.contextSubdir}` : remoteContextDir,
+              buildContextDir: resolved.buildContextDir,
               contextEntries: resolved.contextEntries,
+              ignoreContextPath: resolved.ignoreContextPath,
+              requiresBuildKit: resolved.requiresBuildKit,
               error: null
             };
           } catch (err) {
             return {
               spec,
               dockerfileName: null,
+              remoteBuildSubdir: "",
+              remoteBuildDir: remoteContextDir,
+              buildContextDir: null,
               contextEntries: null,
+              ignoreContextPath: void 0,
+              requiresBuildKit: false,
               error: safeErrorMessage(err)
             };
           }
@@ -6854,7 +7197,17 @@ var DockerRuntime = class _DockerRuntime {
         }
       }
       const results = [];
-      for (const { spec, dockerfileName, contextEntries, error } of resolvedList) {
+      for (const {
+        spec,
+        dockerfileName,
+        remoteBuildDir,
+        remoteBuildSubdir,
+        buildContextDir,
+        contextEntries,
+        ignoreContextPath,
+        requiresBuildKit,
+        error
+      } of resolvedList) {
         const startedAt = Date.now();
         const tag = this.imageTag(spec.config.slug, spec.config.sessionId);
         const signal = abortControllers.get(spec.config.sessionId)?.signal;
@@ -6877,20 +7230,30 @@ var DockerRuntime = class _DockerRuntime {
         }
         spec.onStart?.();
         try {
+          if (remoteBuildSubdir) {
+            spec.logger.log(`Using Docker build context: ${remoteBuildSubdir}
+`);
+          }
           if (isSsh) {
             await this.buildImageOnRemote(
               spec.config,
-              remoteContextDir,
+              remoteBuildDir,
               dockerfileName,
               tag,
               spec.logger,
-              signal
+              { signal, requiresBuildKit }
             );
           } else {
             const { body, abortSignal, takeError } = packBuildContext(
-              tree.contextDir,
+              buildContextDir ?? tree.contextDir,
               contextEntries ?? [],
-              signal
+              signal,
+              ignoreContextPath
+            );
+            const builder = this.selectDockerodeBuilder(
+              spec.config,
+              requiresBuildKit,
+              spec.logger
             );
             try {
               const stream = await this.docker.buildImage(body, {
@@ -6903,9 +7266,10 @@ var DockerRuntime = class _DockerRuntime {
                 buildargs: { ...spec.config.envVars, NODE_ENV: "production" },
                 ...dockerBuildResourceLimits(spec.config.resources),
                 forcerm: true,
+                ...builder.options,
                 abortSignal
               });
-              await this.streamDockerodeBuild(stream, spec.logger);
+              await this.streamDockerodeBuild(stream, spec.logger, builder.trace);
             } catch (err) {
               const contextErr = takeError();
               throw contextErr ? new Error(`Failed to read Docker build context: ${safeErrorMessage(contextErr)}`, { cause: contextErr }) : err;
@@ -6991,10 +7355,10 @@ var DockerRuntime = class _DockerRuntime {
     }
     const containers = await this.docker.listContainers({
       all: true,
-      filters: { label: ["openship.build"] }
+      filters: { label: [OPENSHIP_LABEL.build] }
     });
     for (const c of containers) {
-      const buildId = c.Labels?.["openship.build"];
+      const buildId = c.Labels?.[OPENSHIP_LABEL.build];
       if (!buildId || !cancelCovers(sessionId, buildId)) continue;
       try {
         await this.docker.getContainer(c.Id).remove({ force: true });
@@ -7015,10 +7379,18 @@ var DockerRuntime = class _DockerRuntime {
       throw new Error("Docker deploy requires an imageRef (built image tag)");
     }
     const containerName = `openship-${config.runtimeName || config.projectId}-${config.deploymentId}`;
+    const projectEnv = splitRuntimeEnv(config.envVars);
+    if (projectEnv.dropped.length > 0) {
+      log({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: "warn",
+        message: droppedRuntimeEnvMessage(projectEnv.dropped)
+      });
+    }
     const env = [
       ...config.portless ? [] : [`PORT=${config.port}`],
       `NODE_ENV=${config.environment === "production" ? "production" : "development"}`,
-      ...Object.entries(config.envVars).map(([k, v]) => `${k}=${v}`)
+      ...projectEnv.entries.map(([k, v]) => `${k}=${v}`)
     ];
     const cmd = config.startCommand ? ["sh", "-c", config.startCommand] : void 0;
     const restartPolicy = resolveRestartPolicy(config.restartPolicy);
@@ -7136,6 +7508,11 @@ var DockerRuntime = class _DockerRuntime {
     await container.restart();
   }
   async removeImage(imageRef) {
+    if (isArtifactPathRef(imageRef)) {
+      throw new Error(
+        `"${imageRef}" is a host directory, not an image reference \u2014 remove it with destroy().`
+      );
+    }
     const image = this.docker.getImage(imageRef);
     try {
       await image.remove({ force: true });
@@ -7144,16 +7521,18 @@ var DockerRuntime = class _DockerRuntime {
     }
   }
   async destroy(containerId) {
-    if (containerId.startsWith("/")) {
-      const executor = this.transport.kind === "ssh" ? this.connectionOptions?.executor : null;
-      if (executor) {
-        await executor.exec(`rm -rf ${sq(containerId)}`).catch(() => {
-        });
-      } else {
-        const { rm } = await import("fs/promises");
-        await rm(containerId, { recursive: true, force: true }).catch(() => {
-        });
+    if (isArtifactPathRef(containerId)) {
+      if (this.transport.kind === "ssh") {
+        const executor = this.connectionOptions?.executor;
+        if (!executor) {
+          throw new Error(
+            `Cannot remove ${containerId}: the SSH transport has no command executor, and removing it locally would delete the wrong machine's files.`
+          );
+        }
+        await removeManagedArtifact(executor, containerId);
+        return;
       }
+      await removeManagedArtifact(null, containerId);
       return;
     }
     const container = this.docker.getContainer(containerId);
@@ -7193,8 +7572,8 @@ var DockerRuntime = class _DockerRuntime {
     return images.map((img) => ({
       id: img.Id,
       repoTags: (img.RepoTags ?? []).filter((t) => t && t !== "<none>:<none>"),
-      buildId: img.Labels?.["openship.build"],
-      deploymentId: img.Labels?.["openship.deployment"],
+      buildId: img.Labels?.[OPENSHIP_LABEL.build],
+      deploymentId: img.Labels?.[OPENSHIP_LABEL.deployment],
       size: img.Size ?? 0
     }));
   }
@@ -7239,7 +7618,7 @@ var DockerRuntime = class _DockerRuntime {
     return containers.map((c) => ({
       containerId: c.Id,
       status: stateMap[(c.State ?? "").toLowerCase().trim()] ?? "stopped",
-      serviceName: c.Labels?.["openship.service"]
+      serviceName: c.Labels?.[OPENSHIP_LABEL.service]
     }));
   }
   // ── Rollback primitives (retention half only) ────────────────────────
@@ -7268,17 +7647,18 @@ var DockerRuntime = class _DockerRuntime {
     }
   }
   async purge(deployment) {
+    const failures = [];
     if (deployment.containerId) {
-      try {
-        await this.destroy(deployment.containerId);
-      } catch {
-      }
+      await this.destroy(deployment.containerId).catch((err) => failures.push(err));
     }
     if (deployment.imageRef && ownsBuiltImage(deployment.imageRef)) {
-      try {
-        await this.removeImage(deployment.imageRef);
-      } catch {
-      }
+      await this.removeImage(deployment.imageRef).catch((err) => failures.push(err));
+    }
+    if (failures.length === 1) throw failures[0];
+    if (failures.length > 1) {
+      throw new Error(
+        failures.map((err) => err instanceof Error ? err.message : String(err)).join("; ")
+      );
     }
   }
   /**
@@ -7425,13 +7805,39 @@ var DockerRuntime = class _DockerRuntime {
     }
     const executor = this.connectionOptions?.executor;
     if (executor) {
-      await executor.exec(`docker pull ${sq(ref)}`, { timeout: 10 * 6e4 });
+      const timeout = 10 * 6e4;
+      const auth = await this.connectionOptions?.resolveRegistryAuth?.(ref);
+      const config = auth ? dockerConfigJsonFor(auth) : null;
+      if (!config) {
+        await executor.exec(`docker pull ${sq(ref)}`, { timeout });
+        return;
+      }
+      const dir = `/tmp/openship-pull-${crypto.randomUUID()}`;
+      try {
+        await executor.exec(`mkdir -m 700 ${sq(dir)}`);
+        await executor.writeFile(`${dir}/config.json`, config);
+        await executor.exec(`chmod 600 ${sq(dir)}/config.json`);
+        await executor.exec(
+          `DOCKER_CONFIG=${sq(dir)} docker pull ${sq(ref)}; rc=$?; rm -rf ${sq(dir)}; exit $rc`,
+          { timeout }
+        );
+      } finally {
+        await executor.exec(`rm -rf ${sq(dir)}`).catch(() => {
+        });
+      }
       return;
     }
-    const stream = await this.docker.pull(ref);
-    await new Promise((resolve, reject) => {
-      this.docker.modem.followProgress(stream, (err) => err ? reject(err) : resolve());
-    });
+    const authconfig = this.connectionOptions?.resolveRegistryAuth ? await this.connectionOptions.resolveRegistryAuth(ref) : await resolveDockerAuth(ref);
+    try {
+      const stream = await this.docker.pull(ref, authconfig ? { authconfig } : {});
+      await new Promise((resolve, reject) => {
+        this.docker.modem.followProgress(stream, (err) => err ? reject(err) : resolve());
+      });
+    } catch (err) {
+      throw new Error(
+        `Failed to pull ${ref} from ${registryForImage(ref)}: ${safeErrorMessage(err)}`
+      );
+    }
   }
   /** Is this image tag present on THIS daemon? Distinguishes a locally-built
    *  image (must be transferred cross-server) from a registry tag (the target
@@ -7570,7 +7976,7 @@ var DockerRuntime = class _DockerRuntime {
     };
     const startedAt = data.State.StartedAt;
     const uptimeSeconds = startedAt && data.State.Running ? Math.floor((Date.now() - new Date(startedAt).getTime()) / 1e3) : void 0;
-    const { ip, hostPort } = extractNetworkInfo(data);
+    const { ip, hostPort, hostPortByContainerPort } = extractNetworkInfo(data);
     let status;
     if (data.State.Running) {
       status = "running";
@@ -7585,6 +7991,7 @@ var DockerRuntime = class _DockerRuntime {
       status,
       ip,
       hostPort,
+      ...hostPortByContainerPort ? { hostPortByContainerPort } : {},
       uptimeSeconds: uptimeSeconds && uptimeSeconds > 0 ? uptimeSeconds : void 0
     };
   }
@@ -8070,7 +8477,7 @@ var DockerRuntime = class _DockerRuntime {
     const ownNames = /* @__PURE__ */ new Set();
     const foreign = /* @__PURE__ */ new Map();
     for (const c of containers) {
-      const owner = c.Labels?.["openship.project"];
+      const owner = c.Labels?.[OPENSHIP_LABEL.project];
       if (!owner) continue;
       for (const m of c.Mounts ?? []) {
         if (m.Type !== "volume" || !m.Name || !named.has(m.Name)) continue;
@@ -8124,7 +8531,7 @@ var DockerRuntime = class _DockerRuntime {
       );
       if (onNetwork) continue;
       if (this.cannotJoinNetworks(c)) continue;
-      const service = c.Labels?.["openship.service"];
+      const service = c.Labels?.[OPENSHIP_LABEL.service];
       try {
         await network.connect({
           Container: c.Id,
@@ -8148,7 +8555,7 @@ var DockerRuntime = class _DockerRuntime {
    * doesn't exist (source not deployed) is skipped and nothing here ever throws —
    * a link networking failure must never fail the consumer's deploy.
    */
-  async attachToExternalNetworks(projectId, networkNames) {
+  async attachToExternalNetworks(projectId, networkNames, extraContainerIds = []) {
     if (networkNames.length === 0) return;
     let containers;
     try {
@@ -8159,6 +8566,22 @@ var DockerRuntime = class _DockerRuntime {
     } catch {
       return;
     }
+    if (extraContainerIds.length > 0) {
+      const seen = new Set(containers.map((c) => c.Id));
+      for (const id of extraContainerIds) {
+        if (seen.has(id)) continue;
+        try {
+          const info = await this.docker.getContainer(id).inspect();
+          containers.push({
+            Id: info.Id,
+            NetworkSettings: { Networks: info.NetworkSettings?.Networks ?? {} },
+            HostConfig: { NetworkMode: info.HostConfig?.NetworkMode }
+          });
+          seen.add(info.Id);
+        } catch {
+        }
+      }
+    }
     for (const name of networkNames) {
       const network = this.docker.getNetwork(name);
       let netId;
@@ -8212,11 +8635,20 @@ var DockerRuntime = class _DockerRuntime {
       await existing.remove({ force: true });
     } catch {
     }
+    const serviceEnv = splitRuntimeEnv(config.environment);
+    if (serviceEnv.dropped.length > 0) {
+      log({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: "warn",
+        message: `[${config.serviceName}] ${droppedRuntimeEnvMessage(serviceEnv.dropped)}`
+      });
+    }
     const env = [
       ...config.publicPort && config.environment.PORT === void 0 ? [`PORT=${config.publicPort}`] : [],
-      ...Object.entries(config.environment).map(([k, v]) => `${k}=${v}`)
+      ...serviceEnv.entries.map(([k, v]) => `${k}=${v}`)
     ];
     const cmd = resolveComposeCmd(config);
+    const entrypoint = resolveComposeEntrypoint(config.advanced);
     const sharedNetwork = config.namespaces?.network;
     const sharesNetns = !!sharedNetwork && sharedNetwork !== "none";
     const ownsProjectEndpoint = ownsNetworkEndpoint(sharedNetwork);
@@ -8282,6 +8714,12 @@ var DockerRuntime = class _DockerRuntime {
       name: containerName,
       Image: config.image,
       Cmd: cmd,
+      // Entrypoint (#575). SPREAD rather than assigned, because `undefined` and `[]`
+      // must reach Docker differently: absent leaves the image's own ENTRYPOINT
+      // alone, while `Entrypoint: []` clears it. Assigning `undefined` would send the
+      // key, and the same conditional-spread shape is why `toStopConfig` returns an
+      // object instead of nullable fields.
+      ...entrypoint === void 0 ? {} : { Entrypoint: entrypoint },
       Env: env,
       // Docker rejects an explicit hostname when the network namespace is another
       // container's — that container owns the UTS identity too.
@@ -8291,7 +8729,7 @@ var DockerRuntime = class _DockerRuntime {
           deploymentId: config.deploymentId,
           projectId: config.projectId
         }),
-        "openship.service": config.serviceName
+        [OPENSHIP_LABEL.service]: config.serviceName
       },
       ...healthcheck && { Healthcheck: healthcheck },
       ...stopConfig,
@@ -8330,7 +8768,7 @@ var DockerRuntime = class _DockerRuntime {
       throw startErr;
     }
     const data = await container.inspect();
-    const { ip, hostPort } = extractNetworkInfo(data);
+    const { ip, hostPort, hostPortByContainerPort } = extractNetworkInfo(data);
     const imageDigest = await this.resolveImageDigest(config.image).catch(() => void 0);
     log({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8343,6 +8781,7 @@ var DockerRuntime = class _DockerRuntime {
       status: "running",
       ip,
       hostPort,
+      ...hostPortByContainerPort ? { hostPortByContainerPort } : {},
       imageDigest
     };
   }
@@ -8353,6 +8792,16 @@ var DockerRuntime = class _DockerRuntime {
    * RepoDigests) or any inspect error. Works local + SSH (plain inspect, no
    * followProgress). Never throws.
    */
+  /**
+   * PUBLIC because it is the only anchor the update scanner has.
+   *
+   * `resolveDeployedDrift` reads `service_deployment.image_digest` to tell a moved mutable
+   * tag (`:latest`, `:16`) from an unchanged one — a REF comparison can't, since the ref
+   * string is identical either way. A deploy records it here; an ADOPTED stack records
+   * nothing, and an adopted stack is image-mode by definition (registry images, no repo),
+   * so every migrated `postgres:16`/`redis:7` project was told "up to date" forever. The
+   * adopt paths need to read it for a container they did not create.
+   */
   async resolveImageDigest(ref) {
     const info = await this.docker.getImage(ref).inspect();
     const repoDigests = info?.RepoDigests ?? [];
@@ -8369,7 +8818,7 @@ var DockerRuntime = class _DockerRuntime {
 };
 
 export {
-  scopedVolumeName,
+  ensureScopedVolumeName,
   isHostPathSource,
   startExecStream,
   startAttachStream,