openship 0.6.6 → 0.6.7

package/dist/{chunk-77QDF6UD.js → chunk-LHFXSC36.js}

@@ -3,24 +3,37 @@
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
+  BuildKitTraceDecoder,
   createDockerBuildContext,
-  generateDockerfile,
+  missingContextDockerfileMessage,
   prepareSourceTree,
-  resolveDockerfileCandidates,
-  resolveServiceDockerfile,
-  staticBuilderOutputPath
-} from "./chunk-LUKYPVJ4.js";
+  resolveServiceDockerfile
+} from "./chunk-XWHWTHEL.js";
+import {
+  isArtifactPathRef,
+  removeManagedArtifact
+} from "./chunk-WU54BXFE.js";
 import {
   BuildCancelledError,
   BuildLogger,
   assembleGitClone,
+  builderContextRoot,
+  dockerBuildContextDirectory,
+  droppedRuntimeEnvMessage,
+  generateDockerfile,
+  isExcludedDocRootEntry,
   killProcessesUnderDir,
   materializeGitSsh,
+  normalizeDockerRelativePath,
   parseLogLevel,
+  resolveContextDockerfileCandidates,
+  resolveDockerfileCandidates,
   shellGitSshWriter,
+  splitRuntimeEnv,
   sq,
+  staticBuilderOutputPath,
   transferLocalDirectory
-} from "./chunk-LH2PLRQO.js";
+} from "./chunk-H4FS5BED.js";
 import {
   DOCKER_DIAL_STDIO_COMMAND,
   attachDialStdioDiagnostics,
@@ -29,23 +42,28 @@ import {
   execSshCommand,
   openDockerDialStdioChannel,
   openSshUnixSocket
-} from "./chunk-PCPVTH6M.js";
+} from "./chunk-5T4UVOM3.js";
 import {
   dirOf,
   ensureOwnedDir
-} from "./chunk-UVNMQM7W.js";
+} from "./chunk-FZ6QCF6B.js";
+import {
+  OPENSHIP_LABEL
+} from "./chunk-UWEV6XTS.js";
+import {
+  isRuntimeNotFoundError
+} from "./chunk-N5YZMO33.js";
 import {
   formatCpuCores,
   formatMemoryMb,
   hasCpuLimit,
   hasMemoryLimit,
-  isRuntimeNotFoundError,
   ownsNetworkEndpoint,
   registryConfigKeys,
   registryForImage,
   safeErrorMessage,
   withTimeout
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-2VSW6Q6C.js";
 import {
   __commonJS,
   __require,
@@ -4609,6 +4627,7 @@ var tarFs = __toESM(require_tar_fs(), 1);
 import Dockerode from "dockerode";
 import { createGzip } from "zlib";
 import { PassThrough, Writable } from "stream";
+import { relative, sep } from "path";
 
 // ../../packages/adapters/src/runtime/docker-auth.ts
 import { readFile } from "fs/promises";
@@ -4712,6 +4731,10 @@ var MODE_SUFFIX = /:(ro|rw|z|Z|nocopy)$/;
 function scopedVolumeName(slug, name) {
   return `openship-${slug}-${name}`;
 }
+function ensureScopedVolumeName(slug, source) {
+  const prefix = `openship-${slug}-`;
+  return source.startsWith(prefix) ? source : scopedVolumeName(slug, source);
+}
 function isHostPathSource(source) {
   return source.startsWith("/") || source.startsWith("./") || source.startsWith("../") || source.startsWith("~");
 }
@@ -5701,9 +5724,10 @@ function parsePortBindings(portSpecs) {
   }
   return { exposedPorts, portBindings };
 }
-function packBuildContext(contextDir, entries, cancelSignal) {
+function packBuildContext(contextDir, entries, cancelSignal, ignoreContextPath) {
   const controller = new AbortController();
-  const pack2 = tarFs.pack(contextDir, { entries });
+  const ignore = ignoreContextPath ? (absolutePath) => ignoreContextPath(relative(contextDir, absolutePath).split(sep).join("/")) : void 0;
+  const pack2 = tarFs.pack(contextDir, { entries, ignore });
   const body = pack2.pipe(createGzip());
   let contextError = null;
   const capture = (err) => {
@@ -5835,14 +5859,22 @@ function extractNetworkInfo(data) {
       break;
     }
   }
+  const hostPortByContainerPort = {};
   let hostPort;
-  for (const bindings of Object.values(data.NetworkSettings.Ports ?? {})) {
-    if (bindings?.[0]?.HostPort) {
-      hostPort = parseInt(bindings[0].HostPort, 10);
-      break;
-    }
+  for (const [key, bindings] of Object.entries(data.NetworkSettings.Ports ?? {})) {
+    const bound = bindings?.[0]?.HostPort;
+    if (!bound) continue;
+    const parsed = parseInt(bound, 10);
+    if (!Number.isFinite(parsed)) continue;
+    const containerPort = parseInt(key.split("/")[0] ?? "", 10);
+    if (Number.isFinite(containerPort)) hostPortByContainerPort[containerPort] = parsed;
+    hostPort ??= parsed;
   }
-  return { ip, hostPort };
+  return {
+    ip,
+    hostPort,
+    ...Object.keys(hostPortByContainerPort).length ? { hostPortByContainerPort } : {}
+  };
 }
 function parseLoadedImageRef(output) {
   const matches = [...(output || "").matchAll(/Loaded image(?: ID)?:\s*(\S+)/gi)];
@@ -5999,11 +6031,11 @@ var DockerRuntime = class _DockerRuntime {
   /** Labels applied to both build images and deploy containers. */
   labels(config) {
     const l = {
-      "openship.project": config.projectId
+      [OPENSHIP_LABEL.project]: config.projectId
     };
-    if (config.deploymentId) l["openship.deployment"] = config.deploymentId;
-    if (config.sessionId) l["openship.build"] = config.sessionId;
-    if (config.service) l["openship.service"] = config.service;
+    if (config.deploymentId) l[OPENSHIP_LABEL.deployment] = config.deploymentId;
+    if (config.sessionId) l[OPENSHIP_LABEL.build] = config.sessionId;
+    if (config.service) l[OPENSHIP_LABEL.service] = config.service;
     return l;
   }
   // ── Build lifecycle ────────────────────────────────────────────────────
@@ -6045,12 +6077,20 @@ var DockerRuntime = class _DockerRuntime {
     logger.log(`[${step}] ${label} ${message}`);
     logger.step(step, status, message);
   }
-  handleBuildEvent(event, logger) {
+  handleBuildEvent(event, logger, trace) {
     const errorMessage = event.errorDetail?.message ?? event.error;
     if (errorMessage) {
       logger.log(errorMessage, "error");
       return errorMessage;
     }
+    if (event.id === "moby.buildkit.trace" && typeof event.aux === "string") {
+      let hint = null;
+      for (const line of trace?.push(event.aux) ?? []) {
+        logger.log(line.message, line.level === "error" ? "error" : parseLogLevel(line.message));
+        hint ??= this.extractBuildFailureHint(line.message);
+      }
+      return hint;
+    }
     if (event.stream) {
       const line = event.stream.trim();
       if (!line) return null;
@@ -6107,6 +6147,12 @@ var DockerRuntime = class _DockerRuntime {
     if (/returned a non-zero code:\s*\d+/i.test(line)) {
       return line;
     }
+    if (/requires? BuildKit|BuildKit is enabled but the buildx component/i.test(line)) {
+      return `${line} \u2014 this Dockerfile needs BuildKit. Install the docker buildx plugin on the build host (\`docker-buildx-plugin\`), or remove the BuildKit-only instruction.`;
+    }
+    if (/buildkit (is )?(not (supported|enabled)|disabled)|builder version.*not supported/i.test(line)) {
+      return `${line} \u2014 this Dockerfile needs BuildKit but this Docker daemon has it disabled. Enable it ("features": {"buildkit": true} in daemon.json) or remove the BuildKit-only instruction.`;
+    }
     if (/\/workspace\/package\.json/i.test(line) && /ENOENT/i.test(line)) {
       return "Docker build ran from /workspace but package.json was not found there. The configured rootDirectory is likely empty or incorrect.";
     }
@@ -6158,12 +6204,35 @@ var DockerRuntime = class _DockerRuntime {
       { excludes: [] }
     );
   }
+  /**
+   * Is BuildKit usable on the remote host? Probed, never assumed: a plain `docker`
+   * CLI without the buildx plugin HARD-FAILS when BuildKit is requested explicitly
+   * ("BuildKit is enabled but the buildx component is missing or broken"), while an
+   * unadorned `docker build` on the same box falls back to the legacy builder and
+   * works — the same trap {@link buildImage} in system/managed-image.ts documents.
+   * So we ask first, and only then opt in.
+   *
+   * Memoized per adapter instance (one instance ≈ one target daemon), so a compose
+   * batch pays a single `docker buildx version` for N images.
+   */
+  buildKitProbe = null;
+  async remoteBuildKitAvailable() {
+    const executor = this.connectionOptions?.executor;
+    if (!executor) return false;
+    const probe = this.buildKitProbe ??= executor.exec("docker buildx version >/dev/null 2>&1 && echo OPENSHIP_BUILDKIT_OK || true").then((out) => out.split(/\r?\n/).some((line) => line.trim() === "OPENSHIP_BUILDKIT_OK")).catch(() => false);
+    const available = await probe;
+    if (!available) this.buildKitProbe = null;
+    return available;
+  }
   /**
    * Run native `docker build` on the remote host against an already-transferred
-   * context dir. One image; `dockerfileName` selects which Dockerfile in the
-   * shared tree to use (so N services can build from one transferred context).
+   * context dir. One image; `dockerfileName` selects which Dockerfile to use (so N
+   * services can build from one transferred tree) and is relative to
+   * `remoteBuildDir` — the build CONTEXT, which for a compose service is its own
+   * `build:` directory inside that tree, not the tree root (#634).
    */
-  async buildImageOnRemote(config, remoteContextDir, dockerfileName, tag, log, signal) {
+  async buildImageOnRemote(config, remoteBuildDir, dockerfileName, tag, log, opts) {
+    const signal = opts?.signal;
     const executor = this.connectionOptions?.executor;
     if (!executor) throw new Error("SSH build path requires an executor on connectionOptions");
     const buildArgs = Object.entries({
@@ -6174,7 +6243,22 @@ var DockerRuntime = class _DockerRuntime {
       this.labels({ projectId: config.projectId, sessionId: config.sessionId })
     ).map(([k, v]) => `--label ${sq(`${k}=${v}`)}`).join(" ");
     const dockerfileFlag = dockerfileName && dockerfileName !== "Dockerfile" ? ` -f ${sq(dockerfileName)}` : "";
-    const buildCmd = `cd ${sq(remoteContextDir)} && docker build --progress=plain -t ${sq(tag)}${dockerfileFlag} ${labelArgs} ${buildArgs} --force-rm .`;
+    const buildKit = await this.remoteBuildKitAvailable();
+    const builderEnv = buildKit ? "DOCKER_BUILDKIT=1 " : "";
+    const builderFlags = buildKit ? " --progress=plain" : " --force-rm";
+    if (buildKit) {
+      log.log("Builder: BuildKit (docker buildx detected on the host)");
+    } else if (opts?.requiresBuildKit) {
+      log.log(
+        "This Dockerfile needs BuildKit, but the build host's docker CLI has no buildx plugin. Install it (`docker-buildx-plugin`, or Docker's official packages) \u2014 the build below will use the legacy builder and is likely to fail.",
+        "warn"
+      );
+    } else {
+      log.log(
+        "Builder: legacy (docker buildx not available on the host) \u2014 BuildKit-only Dockerfile syntax such as `RUN --mount` will not work"
+      );
+    }
+    const buildCmd = `cd ${sq(remoteBuildDir)} && ${builderEnv}docker build${builderFlags} -t ${sq(tag)}${dockerfileFlag} ${labelArgs} ${buildArgs} .`;
     log.log(`Running on remote: ${buildCmd}`);
     log.log("\u2500\u2500\u2500 docker build output \u2500\u2500\u2500");
     this.emitDockerStep(log, "install", "running", "Running install inside container (docker build)");
@@ -6286,15 +6370,50 @@ var DockerRuntime = class _DockerRuntime {
    * (clone-on-server). Mirrors resolveServiceDockerfile but probes the remote
    * tree with `test -f` instead of the local FS: a repository Dockerfile
    * candidate is used when present; otherwise a Dockerfile is generated locally
-   * (pure fn) and written to the remote tree. Returns the dockerfile path
-   * relative to `remoteContextDir`.
+   * (pure fn) and written to the remote tree.
+   *
+   * Returns the build CONTEXT dir on the host plus the Dockerfile path relative to
+   * it — the same pair {@link resolveServiceDockerfile} produces locally, because
+   * these two resolvers are one behaviour with two probes and a narrowed context
+   * learned by only one of them would leave #634 reproducible on this target.
    */
-  async resolveRemoteDockerfile(config, remoteContextDir, generatedName, requireRepositoryDockerfile) {
+  async resolveRemoteDockerfile(config, remoteContextDir, generatedName, requireRepositoryDockerfile, log) {
     const executor = this.connectionOptions?.executor;
     if (!executor) throw new Error("Clone-on-server requires an SSH executor on connectionOptions");
-    for (const candidate of resolveDockerfileCandidates(config.rootDirectory, config.dockerfilePath)) {
-      const out = await executor.exec(`test -f ${sq(`${remoteContextDir}/${candidate}`)} && echo yes || true`).catch(() => "");
-      if (out.trim() === "yes") return candidate;
+    const contextSubdir = dockerBuildContextDirectory(config);
+    const remoteBuildDir = contextSubdir ? `${remoteContextDir}/${contextSubdir}` : remoteContextDir;
+    if (contextSubdir) {
+      const real = await executor.exec(`cd ${sq(remoteBuildDir)} 2>/dev/null && pwd -P || true`).then((out) => out.trim()).catch(() => "");
+      const root = await executor.exec(`cd ${sq(remoteContextDir)} && pwd -P`).then((out) => out.trim()).catch(() => "");
+      if (!real) {
+        throw new Error(
+          `Build context "${contextSubdir}" is not a directory in the cloned source. Check the service's build path.`
+        );
+      }
+      if (!root || real !== root && !real.startsWith(`${root}/`)) {
+        throw new Error(`Build context "${contextSubdir}" resolves outside the cloned source.`);
+      }
+    }
+    const candidates = contextSubdir ? resolveContextDockerfileCandidates(contextSubdir, config.dockerfilePath) : resolveDockerfileCandidates(config.rootDirectory, config.dockerfilePath);
+    for (const candidate of candidates) {
+      const out = await executor.exec(`test -f ${sq(`${remoteBuildDir}/${candidate}`)} && echo yes || true`).catch(() => "");
+      if (out.trim() === "yes") {
+        const explicit = normalizeDockerRelativePath(config.dockerfilePath);
+        if (contextSubdir && explicit && candidate === "Dockerfile" && explicit !== "Dockerfile" && explicit !== `${contextSubdir}/Dockerfile`) {
+          log?.log(
+            `Configured Dockerfile "${config.dockerfilePath}" was not found in build context "${contextSubdir}" \u2014 using ${contextSubdir}/Dockerfile instead.`,
+            "warn"
+          );
+        }
+        return { remoteBuildDir, dockerfileName: candidate };
+      }
+    }
+    if (contextSubdir) {
+      throw new Error(
+        missingContextDockerfileMessage(contextSubdir, config.dockerfilePath, {
+          generatedRecipeRefused: !requireRepositoryDockerfile
+        })
+      );
     }
     if (requireRepositoryDockerfile) {
       const expected = config.dockerfilePath?.trim() || "Dockerfile";
@@ -6303,7 +6422,7 @@ var DockerRuntime = class _DockerRuntime {
       );
     }
     await executor.writeFile(`${remoteContextDir}/${generatedName}`, generateDockerfile(config));
-    return generatedName;
+    return { remoteBuildDir, dockerfileName: generatedName };
   }
   async buildViaSshTarPipe(config, buildContext, tag, log, signal) {
     const remoteContextDir = `/tmp/openship-build-${config.sessionId}`;
@@ -6311,11 +6430,11 @@ var DockerRuntime = class _DockerRuntime {
       await this.transferBuildContext(buildContext.contextDir, remoteContextDir, log);
       await this.buildImageOnRemote(
         config,
-        remoteContextDir,
+        buildContext.contextSubdir ? `${remoteContextDir}/${buildContext.contextSubdir}` : remoteContextDir,
         buildContext.dockerfileName,
         tag,
         log,
-        signal
+        { signal, requiresBuildKit: buildContext.requiresBuildKit }
       );
     } finally {
       this.connectionOptions?.executor?.exec(`rm -rf ${sq(remoteContextDir)}`).catch(() => {
@@ -6323,6 +6442,41 @@ var DockerRuntime = class _DockerRuntime {
       await buildContext.cleanup();
     }
   }
+  /**
+   * Pick the Engine-API builder for ONE dockerode build, for BOTH dockerode call
+   * sites (single image and compose batch) — they are the same decision and a
+   * builder learned by only one of them is the "two executors" trap all over again.
+   *
+   * The classic builder is kept as the DEFAULT deliberately. It is what every
+   * self-hosted local build has always used; switching wholesale would change layer
+   * caching for everyone and silently drop the build CPU/memory caps, which BuildKit
+   * ignores. So BuildKit is opted into only where the classic builder cannot work at
+   * all — a Dockerfile whose syntax it rejects (#634).
+   *
+   * Through the ENGINE API (`version=2`), not by shelling out to `docker build`,
+   * which is the first alternative that comes to mind and is not available: the API
+   * image ships `openssh-client rsync git` and no docker CLI (apps/api/Dockerfile),
+   * and the transport may be a TCP socket with no shell at the other end at all.
+   * Nothing needs the buildx plugin either — BuildKit lives in the daemon.
+   *
+   * Asymmetric with the remote CLI path on purpose: there, BuildKit is taken whenever
+   * buildx exists, because that command passes no --memory/--cpus (so there is no cap
+   * to lose) and on docker ≥23 the CLI already defaults to it — the prefix mostly
+   * buys the log line and the buildx-missing warning.
+   */
+  selectDockerodeBuilder(config, requiresBuildKit, log) {
+    if (!requiresBuildKit) return { options: {} };
+    log.log(
+      "Dockerfile uses BuildKit-only syntax (RUN --mount, a syntax directive or a heredoc) \u2014 building with BuildKit."
+    );
+    if (Object.keys(dockerBuildResourceLimits(config.resources)).length > 0) {
+      log.log(
+        "Build CPU/memory limits are not enforced under BuildKit \u2014 this build runs uncapped.",
+        "warn"
+      );
+    }
+    return { options: { version: "2" }, trace: new BuildKitTraceDecoder() };
+  }
   /**
    * Dockerode build path. Used for local socket and TCP transports, plus
    * SSH transports that didn't get an executor wired in (shouldn't happen
@@ -6335,10 +6489,12 @@ var DockerRuntime = class _DockerRuntime {
   async buildViaDockerode(config, buildContext, tag, log, cancelSignal) {
     log.log(`Streaming build context to Docker daemon - image tag: ${tag}`);
     const { body, abortSignal, takeError } = packBuildContext(
-      buildContext.contextDir,
+      buildContext.buildContextDir,
       buildContext.contextEntries,
-      cancelSignal
+      cancelSignal,
+      buildContext.ignoreContextPath
     );
+    const builder = this.selectDockerodeBuilder(config, buildContext.requiresBuildKit, log);
     try {
       const stream = await this.docker.buildImage(body, {
         t: tag,
@@ -6353,10 +6509,11 @@ var DockerRuntime = class _DockerRuntime {
         // needs several GB). Opt-in only; see dockerBuildResourceLimits.
         ...dockerBuildResourceLimits(config.resources),
         forcerm: true,
+        ...builder.options,
         abortSignal
       });
       log.log("Connected to Docker daemon. Build output follows:");
-      await this.streamDockerodeBuild(stream, log);
+      await this.streamDockerodeBuild(stream, log, builder.trace);
       log.log("Docker daemon finished streaming build output. Finalizing image...\n");
     } catch (err) {
       const contextErr = takeError();
@@ -6370,7 +6527,7 @@ var DockerRuntime = class _DockerRuntime {
    * idle timeout + keepalive, and throw on a fatal build event. Shared by the
    * single-image dockerode path and the local batch build (buildImages).
    */
-  async streamDockerodeBuild(stream, log) {
+  async streamDockerodeBuild(stream, log, trace) {
     let fatalBuildError = null;
     await new Promise((resolve, reject) => {
       let settled = false;
@@ -6427,7 +6584,7 @@ var DockerRuntime = class _DockerRuntime {
         },
         (event) => {
           resetIdleTimer();
-          fatalBuildError ??= this.handleBuildEvent(event, log);
+          fatalBuildError ??= this.handleBuildEvent(event, log, trace);
         }
       );
     });
@@ -6496,20 +6653,16 @@ var DockerRuntime = class _DockerRuntime {
           await this.cloneSourceOnRemote(config, remoteContextDir, log);
           if (abort.signal.aborted) throw new BuildCancelledError();
           this.emitDockerStep(log, "clone", "completed", "Source cloned on the server");
-          const dockerfileName = await this.resolveRemoteDockerfile(
+          const { remoteBuildDir, dockerfileName } = await this.resolveRemoteDockerfile(
             config,
             remoteContextDir,
             "Dockerfile.openship",
-            config.stack === "docker"
-          );
-          await this.buildImageOnRemote(
-            config,
-            remoteContextDir,
-            dockerfileName,
-            tag,
-            log,
-            abort.signal
+            config.stack === "docker",
+            log
           );
+          await this.buildImageOnRemote(config, remoteBuildDir, dockerfileName, tag, log, {
+            signal: abort.signal
+          });
         } finally {
           sshExecutor.exec(`rm -rf ${sq(remoteContextDir)}`).catch(() => {
           });
@@ -6539,7 +6692,9 @@ var DockerRuntime = class _DockerRuntime {
       } catch {
         this.emitDockerStep(log, "clone", "completed", "Docker build context ready");
       }
-      if (buildContext.rootDirectory) {
+      if (buildContext.contextSubdir) {
+        log.log(`Using Docker build context: ${buildContext.contextSubdir}`);
+      } else if (buildContext.rootDirectory) {
         log.log(`Using Docker build root: ${buildContext.rootDirectory}`);
       }
       if (buildContext.usesRepositoryDockerfile) {
@@ -6608,6 +6763,7 @@ var DockerRuntime = class _DockerRuntime {
           await this.extractDocRootViaDaemon(tag, docRoot, hostOutDir);
         }
       }
+      await this.pruneBuildFilesFromDocRoot(config, hostOutDir, sshExecutor ?? null, log);
       log.log(`Static files ready at ${hostOutDir}
 `);
     } finally {
@@ -6692,6 +6848,74 @@ var DockerRuntime = class _DockerRuntime {
    * expensive one: every extractor can succeed having copied nothing, which deploys
    * green and then 404s the entire site.
    */
+  /**
+   * Names that must never end up in a public doc-root, matched at its TOP LEVEL
+   * only.
+   *
+   * `.git` is the repository — serving it publishes full source history. The
+   * Dockerfiles and `.dockerignore` are OUR build inputs, and one of them is
+   * literally written into the tree by `resolveServiceDockerfile`.
+   */
+  static DOC_ROOT_EXCLUDED = [
+    ".dockerignore",
+    ".git",
+    "Dockerfile",
+    "Dockerfile.*"
+  ];
+  /**
+   * Remove build inputs from an extracted static doc-root, then re-assert the
+   * contract that it still holds something servable.
+   *
+   * Only runs when the doc-root IS the build context — `outputDirectory` empty or
+   * "." — which is the zero-build "just files, index.html at the root" project. A
+   * real output directory (`dist`, `build`) is written by the build and contains
+   * none of this, so the prune is a no-op there.
+   *
+   * Two distinct problems, one fix. The build context is pruned by `.dockerignore`
+   * and THEN the generated recipe is written into it, so for these projects the
+   * published site contained `.dockerignore` + `Dockerfile.openship…` — and any
+   * tracked `.git` — at their own public URLs. Worse, those files count as
+   * content: a repo with an allowlist `.dockerignore` (`*` + `!src`) extracted to
+   * a tree holding ONLY the two build files, which passed the non-empty check and
+   * deployed green as a site that 404s every request. Pruning first and
+   * re-checking after is what makes that check mean "there is something to serve".
+   */
+  async pruneBuildFilesFromDocRoot(config, hostOutDir, sshExecutor, log) {
+    if (staticBuilderOutputPath(config) !== builderContextRoot(config)) return;
+    if (sshExecutor) {
+      const globs = _DockerRuntime.DOC_ROOT_EXCLUDED.map(
+        (name) => `${sq(hostOutDir)}/${name}`
+      ).join(" ");
+      await sshExecutor.exec(`rm -rf ${globs}`).catch(() => {
+      });
+      log.log(`Excluded build files from the published output (${hostOutDir}).
+`);
+      const listing = (await sshExecutor.exec(`ls -A ${sq(hostOutDir)} | head -1`).catch(() => "x")).trim();
+      this.assertDocRootServable(!listing, hostOutDir);
+      return;
+    }
+    const { readdir, rm } = await import("fs/promises");
+    const { join: join3 } = await import("path");
+    const entries = await readdir(hostOutDir).catch(() => null);
+    if (entries === null) return;
+    const doomed = entries.filter((name) => isExcludedDocRootEntry(name));
+    for (const name of doomed) {
+      await rm(join3(hostOutDir, name), { recursive: true, force: true }).catch(() => {
+      });
+    }
+    if (doomed.length > 0) {
+      log.log(`Excluded build files from the published output: ${doomed.join(", ")}
+`);
+    }
+    this.assertDocRootServable(entries.length === doomed.length, hostOutDir);
+  }
+  /** Post-prune half of the doc-root contract: build inputs are not content. */
+  assertDocRootServable(isEmpty, hostOutDir) {
+    if (!isEmpty) return;
+    throw new Error(
+      `the static output at ${hostOutDir} contains only build files (Dockerfile / .dockerignore) and nothing to serve \u2014 check the project's output directory setting and its .dockerignore.`
+    );
+  }
   assertDocRootFilled(isEmpty, docRoot) {
     if (!isEmpty) return;
     throw new Error(
@@ -6878,7 +7102,25 @@ var DockerRuntime = class _DockerRuntime {
         prepareLogger.step("clone", "completed", "Source cloned on the server");
       } else {
         prepareLogger.step("clone", "running", "Preparing shared build context...");
-        tree = await prepareSourceTree(source, { onLog: prepareLogger.callback });
+        tree = await prepareSourceTree(source, {
+          onLog: prepareLogger.callback,
+          // Any service building from its OWN `build:` directory makes the source
+          // root's `.dockerignore` the wrong file to prune this SHARED tree with —
+          // it would delete files the other contexts need. Those builds filter their
+          // own context instead; see SourceTree.dockerignorePruned.
+          //
+          // A malformed value throws here; `true` is the safe answer for it, because
+          // it only skips a destructive prune. Letting the throw out would fail the
+          // WHOLE batch, while per-spec resolution below reports it against the one
+          // service that owns it.
+          perServiceBuildContexts: specs.some((spec) => {
+            try {
+              return Boolean(dockerBuildContextDirectory(spec.config));
+            } catch {
+              return true;
+            }
+          })
+        });
       }
       const resolvedList = await Promise.all(
         specs.map(async (spec) => {
@@ -6886,34 +7128,54 @@ var DockerRuntime = class _DockerRuntime {
           const requireRepo = spec.requireRepositoryDockerfile ?? spec.config.stack === "docker";
           try {
             if (cloneOnServer) {
-              const dockerfileName = await this.resolveRemoteDockerfile(
+              const { remoteBuildDir, dockerfileName } = await this.resolveRemoteDockerfile(
                 spec.config,
                 remoteContextDir,
                 generatedName,
-                requireRepo
+                requireRepo,
+                spec.logger
               );
               return {
                 spec,
                 dockerfileName,
+                remoteBuildSubdir: dockerBuildContextDirectory(spec.config),
+                remoteBuildDir,
+                buildContextDir: null,
                 contextEntries: null,
+                ignoreContextPath: void 0,
+                // Only the dockerode branch consults it, and clone-on-server never
+                // reaches that branch (it is SSH by construction).
+                requiresBuildKit: false,
                 error: null
               };
             }
             const resolved = await resolveServiceDockerfile(tree.contextDir, spec.config, {
               requireRepositoryDockerfile: requireRepo,
-              generatedName
+              generatedName,
+              dockerignorePruned: tree.dockerignorePruned,
+              onLog: spec.logger.callback
             });
             return {
               spec,
               dockerfileName: resolved.dockerfileName,
+              remoteBuildSubdir: resolved.contextSubdir,
+              remoteBuildDir: resolved.contextSubdir ? `${remoteContextDir}/${resolved.contextSubdir}` : remoteContextDir,
+              buildContextDir: resolved.buildContextDir,
               contextEntries: resolved.contextEntries,
+              ignoreContextPath: resolved.ignoreContextPath,
+              requiresBuildKit: resolved.requiresBuildKit,
               error: null
             };
           } catch (err) {
             return {
               spec,
               dockerfileName: null,
+              remoteBuildSubdir: "",
+              remoteBuildDir: remoteContextDir,
+              buildContextDir: null,
               contextEntries: null,
+              ignoreContextPath: void 0,
+              requiresBuildKit: false,
               error: safeErrorMessage(err)
             };
           }
@@ -6935,7 +7197,17 @@ var DockerRuntime = class _DockerRuntime {
         }
       }
       const results = [];
-      for (const { spec, dockerfileName, contextEntries, error } of resolvedList) {
+      for (const {
+        spec,
+        dockerfileName,
+        remoteBuildDir,
+        remoteBuildSubdir,
+        buildContextDir,
+        contextEntries,
+        ignoreContextPath,
+        requiresBuildKit,
+        error
+      } of resolvedList) {
         const startedAt = Date.now();
         const tag = this.imageTag(spec.config.slug, spec.config.sessionId);
         const signal = abortControllers.get(spec.config.sessionId)?.signal;
@@ -6958,20 +7230,30 @@ var DockerRuntime = class _DockerRuntime {
         }
         spec.onStart?.();
         try {
+          if (remoteBuildSubdir) {
+            spec.logger.log(`Using Docker build context: ${remoteBuildSubdir}
+`);
+          }
           if (isSsh) {
             await this.buildImageOnRemote(
               spec.config,
-              remoteContextDir,
+              remoteBuildDir,
               dockerfileName,
               tag,
               spec.logger,
-              signal
+              { signal, requiresBuildKit }
             );
           } else {
             const { body, abortSignal, takeError } = packBuildContext(
-              tree.contextDir,
+              buildContextDir ?? tree.contextDir,
               contextEntries ?? [],
-              signal
+              signal,
+              ignoreContextPath
+            );
+            const builder = this.selectDockerodeBuilder(
+              spec.config,
+              requiresBuildKit,
+              spec.logger
             );
             try {
               const stream = await this.docker.buildImage(body, {
@@ -6984,9 +7266,10 @@ var DockerRuntime = class _DockerRuntime {
                 buildargs: { ...spec.config.envVars, NODE_ENV: "production" },
                 ...dockerBuildResourceLimits(spec.config.resources),
                 forcerm: true,
+                ...builder.options,
                 abortSignal
               });
-              await this.streamDockerodeBuild(stream, spec.logger);
+              await this.streamDockerodeBuild(stream, spec.logger, builder.trace);
             } catch (err) {
               const contextErr = takeError();
               throw contextErr ? new Error(`Failed to read Docker build context: ${safeErrorMessage(contextErr)}`, { cause: contextErr }) : err;
@@ -7072,10 +7355,10 @@ var DockerRuntime = class _DockerRuntime {
     }
     const containers = await this.docker.listContainers({
       all: true,
-      filters: { label: ["openship.build"] }
+      filters: { label: [OPENSHIP_LABEL.build] }
     });
     for (const c of containers) {
-      const buildId = c.Labels?.["openship.build"];
+      const buildId = c.Labels?.[OPENSHIP_LABEL.build];
       if (!buildId || !cancelCovers(sessionId, buildId)) continue;
       try {
         await this.docker.getContainer(c.Id).remove({ force: true });
@@ -7096,10 +7379,18 @@ var DockerRuntime = class _DockerRuntime {
       throw new Error("Docker deploy requires an imageRef (built image tag)");
     }
     const containerName = `openship-${config.runtimeName || config.projectId}-${config.deploymentId}`;
+    const projectEnv = splitRuntimeEnv(config.envVars);
+    if (projectEnv.dropped.length > 0) {
+      log({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: "warn",
+        message: droppedRuntimeEnvMessage(projectEnv.dropped)
+      });
+    }
     const env = [
       ...config.portless ? [] : [`PORT=${config.port}`],
       `NODE_ENV=${config.environment === "production" ? "production" : "development"}`,
-      ...Object.entries(config.envVars).map(([k, v]) => `${k}=${v}`)
+      ...projectEnv.entries.map(([k, v]) => `${k}=${v}`)
     ];
     const cmd = config.startCommand ? ["sh", "-c", config.startCommand] : void 0;
     const restartPolicy = resolveRestartPolicy(config.restartPolicy);
@@ -7217,6 +7508,11 @@ var DockerRuntime = class _DockerRuntime {
     await container.restart();
   }
   async removeImage(imageRef) {
+    if (isArtifactPathRef(imageRef)) {
+      throw new Error(
+        `"${imageRef}" is a host directory, not an image reference \u2014 remove it with destroy().`
+      );
+    }
     const image = this.docker.getImage(imageRef);
     try {
       await image.remove({ force: true });
@@ -7225,16 +7521,18 @@ var DockerRuntime = class _DockerRuntime {
     }
   }
   async destroy(containerId) {
-    if (containerId.startsWith("/")) {
-      const executor = this.transport.kind === "ssh" ? this.connectionOptions?.executor : null;
-      if (executor) {
-        await executor.exec(`rm -rf ${sq(containerId)}`).catch(() => {
-        });
-      } else {
-        const { rm } = await import("fs/promises");
-        await rm(containerId, { recursive: true, force: true }).catch(() => {
-        });
+    if (isArtifactPathRef(containerId)) {
+      if (this.transport.kind === "ssh") {
+        const executor = this.connectionOptions?.executor;
+        if (!executor) {
+          throw new Error(
+            `Cannot remove ${containerId}: the SSH transport has no command executor, and removing it locally would delete the wrong machine's files.`
+          );
+        }
+        await removeManagedArtifact(executor, containerId);
+        return;
       }
+      await removeManagedArtifact(null, containerId);
       return;
     }
     const container = this.docker.getContainer(containerId);
@@ -7274,8 +7572,8 @@ var DockerRuntime = class _DockerRuntime {
     return images.map((img) => ({
       id: img.Id,
       repoTags: (img.RepoTags ?? []).filter((t) => t && t !== "<none>:<none>"),
-      buildId: img.Labels?.["openship.build"],
-      deploymentId: img.Labels?.["openship.deployment"],
+      buildId: img.Labels?.[OPENSHIP_LABEL.build],
+      deploymentId: img.Labels?.[OPENSHIP_LABEL.deployment],
       size: img.Size ?? 0
     }));
   }
@@ -7320,7 +7618,7 @@ var DockerRuntime = class _DockerRuntime {
     return containers.map((c) => ({
       containerId: c.Id,
       status: stateMap[(c.State ?? "").toLowerCase().trim()] ?? "stopped",
-      serviceName: c.Labels?.["openship.service"]
+      serviceName: c.Labels?.[OPENSHIP_LABEL.service]
     }));
   }
   // ── Rollback primitives (retention half only) ────────────────────────
@@ -7349,17 +7647,18 @@ var DockerRuntime = class _DockerRuntime {
     }
   }
   async purge(deployment) {
+    const failures = [];
     if (deployment.containerId) {
-      try {
-        await this.destroy(deployment.containerId);
-      } catch {
-      }
+      await this.destroy(deployment.containerId).catch((err) => failures.push(err));
     }
     if (deployment.imageRef && ownsBuiltImage(deployment.imageRef)) {
-      try {
-        await this.removeImage(deployment.imageRef);
-      } catch {
-      }
+      await this.removeImage(deployment.imageRef).catch((err) => failures.push(err));
+    }
+    if (failures.length === 1) throw failures[0];
+    if (failures.length > 1) {
+      throw new Error(
+        failures.map((err) => err instanceof Error ? err.message : String(err)).join("; ")
+      );
     }
   }
   /**
@@ -7677,7 +7976,7 @@ var DockerRuntime = class _DockerRuntime {
     };
     const startedAt = data.State.StartedAt;
     const uptimeSeconds = startedAt && data.State.Running ? Math.floor((Date.now() - new Date(startedAt).getTime()) / 1e3) : void 0;
-    const { ip, hostPort } = extractNetworkInfo(data);
+    const { ip, hostPort, hostPortByContainerPort } = extractNetworkInfo(data);
     let status;
     if (data.State.Running) {
       status = "running";
@@ -7692,6 +7991,7 @@ var DockerRuntime = class _DockerRuntime {
       status,
       ip,
       hostPort,
+      ...hostPortByContainerPort ? { hostPortByContainerPort } : {},
       uptimeSeconds: uptimeSeconds && uptimeSeconds > 0 ? uptimeSeconds : void 0
     };
   }
@@ -8177,7 +8477,7 @@ var DockerRuntime = class _DockerRuntime {
     const ownNames = /* @__PURE__ */ new Set();
     const foreign = /* @__PURE__ */ new Map();
     for (const c of containers) {
-      const owner = c.Labels?.["openship.project"];
+      const owner = c.Labels?.[OPENSHIP_LABEL.project];
       if (!owner) continue;
       for (const m of c.Mounts ?? []) {
         if (m.Type !== "volume" || !m.Name || !named.has(m.Name)) continue;
@@ -8231,7 +8531,7 @@ var DockerRuntime = class _DockerRuntime {
       );
       if (onNetwork) continue;
       if (this.cannotJoinNetworks(c)) continue;
-      const service = c.Labels?.["openship.service"];
+      const service = c.Labels?.[OPENSHIP_LABEL.service];
       try {
         await network.connect({
           Container: c.Id,
@@ -8255,7 +8555,7 @@ var DockerRuntime = class _DockerRuntime {
    * doesn't exist (source not deployed) is skipped and nothing here ever throws —
    * a link networking failure must never fail the consumer's deploy.
    */
-  async attachToExternalNetworks(projectId, networkNames) {
+  async attachToExternalNetworks(projectId, networkNames, extraContainerIds = []) {
     if (networkNames.length === 0) return;
     let containers;
     try {
@@ -8266,6 +8566,22 @@ var DockerRuntime = class _DockerRuntime {
     } catch {
       return;
     }
+    if (extraContainerIds.length > 0) {
+      const seen = new Set(containers.map((c) => c.Id));
+      for (const id of extraContainerIds) {
+        if (seen.has(id)) continue;
+        try {
+          const info = await this.docker.getContainer(id).inspect();
+          containers.push({
+            Id: info.Id,
+            NetworkSettings: { Networks: info.NetworkSettings?.Networks ?? {} },
+            HostConfig: { NetworkMode: info.HostConfig?.NetworkMode }
+          });
+          seen.add(info.Id);
+        } catch {
+        }
+      }
+    }
     for (const name of networkNames) {
       const network = this.docker.getNetwork(name);
       let netId;
@@ -8319,9 +8635,17 @@ var DockerRuntime = class _DockerRuntime {
       await existing.remove({ force: true });
     } catch {
     }
+    const serviceEnv = splitRuntimeEnv(config.environment);
+    if (serviceEnv.dropped.length > 0) {
+      log({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        level: "warn",
+        message: `[${config.serviceName}] ${droppedRuntimeEnvMessage(serviceEnv.dropped)}`
+      });
+    }
     const env = [
       ...config.publicPort && config.environment.PORT === void 0 ? [`PORT=${config.publicPort}`] : [],
-      ...Object.entries(config.environment).map(([k, v]) => `${k}=${v}`)
+      ...serviceEnv.entries.map(([k, v]) => `${k}=${v}`)
     ];
     const cmd = resolveComposeCmd(config);
     const entrypoint = resolveComposeEntrypoint(config.advanced);
@@ -8405,7 +8729,7 @@ var DockerRuntime = class _DockerRuntime {
           deploymentId: config.deploymentId,
           projectId: config.projectId
         }),
-        "openship.service": config.serviceName
+        [OPENSHIP_LABEL.service]: config.serviceName
       },
       ...healthcheck && { Healthcheck: healthcheck },
       ...stopConfig,
@@ -8444,7 +8768,7 @@ var DockerRuntime = class _DockerRuntime {
       throw startErr;
     }
     const data = await container.inspect();
-    const { ip, hostPort } = extractNetworkInfo(data);
+    const { ip, hostPort, hostPortByContainerPort } = extractNetworkInfo(data);
     const imageDigest = await this.resolveImageDigest(config.image).catch(() => void 0);
     log({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8457,6 +8781,7 @@ var DockerRuntime = class _DockerRuntime {
       status: "running",
       ip,
       hostPort,
+      ...hostPortByContainerPort ? { hostPortByContainerPort } : {},
       imageDigest
     };
   }
@@ -8467,6 +8792,16 @@ var DockerRuntime = class _DockerRuntime {
    * RepoDigests) or any inspect error. Works local + SSH (plain inspect, no
    * followProgress). Never throws.
    */
+  /**
+   * PUBLIC because it is the only anchor the update scanner has.
+   *
+   * `resolveDeployedDrift` reads `service_deployment.image_digest` to tell a moved mutable
+   * tag (`:latest`, `:16`) from an unchanged one — a REF comparison can't, since the ref
+   * string is identical either way. A deploy records it here; an ADOPTED stack records
+   * nothing, and an adopted stack is image-mode by definition (registry images, no repo),
+   * so every migrated `postgres:16`/`redis:7` project was told "up to date" forever. The
+   * adopt paths need to read it for a container they did not create.
+   */
   async resolveImageDigest(ref) {
     const info = await this.docker.getImage(ref).inspect();
     const repoDigests = info?.RepoDigests ?? [];
@@ -8483,7 +8818,7 @@ var DockerRuntime = class _DockerRuntime {
 };
 
 export {
-  scopedVolumeName,
+  ensureScopedVolumeName,
   isHostPathSource,
   startExecStream,
   startAttachStream,