openship 0.6.9 → 0.7.1

package/dist/{chunk-3MP6ACKM.js → chunk-7MCPDYKP.js}

@@ -9,11 +9,11 @@ import {
   prepareSourceTree,
   resolveDockerBuildArgs,
   resolveServiceDockerfile
-} from "./chunk-6GU6JSK6.js";
+} from "./chunk-S5GU345P.js";
 import {
   isArtifactPathRef,
   removeManagedArtifact
-} from "./chunk-SK4FFCFR.js";
+} from "./chunk-AMADTKC6.js";
 import {
   BuildCancelledError,
   BuildLogger,
@@ -22,6 +22,7 @@ import {
   dockerBuildContextDirectory,
   droppedRuntimeEnvMessage,
   generateDockerfile,
+  gitShellCommand,
   isExcludedDocRootEntry,
   killProcessesUnderDir,
   materializeGitSsh,
@@ -34,7 +35,7 @@ import {
   sq,
   staticBuilderOutputPath,
   transferLocalDirectory
-} from "./chunk-AHJYP7DG.js";
+} from "./chunk-IVMPA6RC.js";
 import {
   DOCKER_DIAL_STDIO_COMMAND,
   attachDialStdioDiagnostics,
@@ -43,17 +44,17 @@ import {
   execSshCommand,
   openDockerDialStdioChannel,
   openSshUnixSocket
-} from "./chunk-TAZZZKYO.js";
+} from "./chunk-TKK5NPDQ.js";
 import {
   dirOf,
   ensureOwnedDir
-} from "./chunk-NPSRGIHV.js";
+} from "./chunk-B2BQX6JX.js";
 import {
   OPENSHIP_LABEL
-} from "./chunk-D6HU4VUZ.js";
+} from "./chunk-7TQP6723.js";
 import {
   isRuntimeNotFoundError
-} from "./chunk-N5YZMO33.js";
+} from "./chunk-L4DRH6ZA.js";
 import {
   formatCpuCores,
   formatMemoryMb,
@@ -64,7 +65,7 @@ import {
   registryForImage,
   safeErrorMessage,
   withTimeout
-} from "./chunk-WEZFTL4V.js";
+} from "./chunk-COI4VFRW.js";
 import {
   __commonJS,
   __require,
@@ -4626,10 +4627,46 @@ var require_tar_fs = __commonJS({
 // ../../packages/adapters/src/runtime/docker.ts
 var tarFs = __toESM(require_tar_fs(), 1);
 import Dockerode from "dockerode";
+import { randomUUID } from "crypto";
 import { createGzip } from "zlib";
 import { PassThrough, Writable } from "stream";
 import { relative, sep } from "path";
 
+// ../../packages/adapters/src/runtime/docker-container-info.ts
+function bindingPriority(ip) {
+  const normalized = ip?.trim().replace(/^\[|\]$/g, "") ?? "";
+  if (normalized === "127.0.0.1" || normalized === "::1") return 3;
+  if (/^127(?:\.\d{1,3}){3}$/.test(normalized)) return 2;
+  if (normalized && normalized !== "0.0.0.0" && normalized !== "::") return 1;
+  return 0;
+}
+function dockerPublishedPortInfo(ports) {
+  const selected = /* @__PURE__ */ new Map();
+  for (const binding of ports) {
+    if ((binding.type || "tcp").toLowerCase() !== "tcp") continue;
+    if (!Number.isSafeInteger(binding.privatePort) || binding.privatePort < 1 || binding.privatePort > 65535) {
+      continue;
+    }
+    const hostPort2 = binding.publicPort;
+    if (typeof hostPort2 !== "number" || !Number.isSafeInteger(hostPort2) || hostPort2 < 1 || hostPort2 > 65535) {
+      continue;
+    }
+    const priority = bindingPriority(binding.ip);
+    const previous = selected.get(binding.privatePort);
+    if (!previous || priority > previous.priority) {
+      selected.set(binding.privatePort, { hostPort: hostPort2, priority });
+    }
+  }
+  const hostPortByContainerPort = Object.fromEntries(
+    [...selected].map(([containerPort, binding]) => [containerPort, binding.hostPort])
+  );
+  const hostPort = selected.values().next().value?.hostPort;
+  return {
+    ...hostPort !== void 0 ? { hostPort } : {},
+    ...selected.size > 0 ? { hostPortByContainerPort } : {}
+  };
+}
+
 // ../../packages/adapters/src/runtime/docker-auth.ts
 import { readFile } from "fs/promises";
 import { homedir } from "os";
@@ -4805,11 +4842,13 @@ function bridgeSocket(socket, leftover) {
   });
   return out;
 }
-function upgradeRequest(conn, path, body) {
+function upgradeRequest(conn, path, body, opts = {}) {
   return new Promise((resolve, reject) => {
     const socket = connect(conn);
     let settled = false;
     let head = Buffer.alloc(0);
+    const protocol = opts.protocol ?? "tcp";
+    const timeoutLabel = opts.timeoutLabel ?? "docker exec";
     const fail = (err) => {
       if (settled) return;
       settled = true;
@@ -4818,7 +4857,7 @@ function upgradeRequest(conn, path, body) {
       reject(err);
     };
     const timer = setTimeout(
-      () => fail(new Error(`docker exec upgrade timed out after ${UPGRADE_TIMEOUT_MS}ms`)),
+      () => fail(new Error(`${timeoutLabel} upgrade timed out after ${UPGRADE_TIMEOUT_MS}ms`)),
       UPGRADE_TIMEOUT_MS
     );
     const onData = (chunk) => {
@@ -4827,7 +4866,8 @@ function upgradeRequest(conn, path, body) {
       const text = head.toString("latin1");
       const end = text.indexOf(HEADER_END);
       if (end === -1) {
-        if (head.length > 64 * 1024) fail(new Error("docker exec upgrade: response head too large"));
+        if (head.length > 64 * 1024)
+          fail(new Error(`${timeoutLabel} upgrade: response head too large`));
         return;
       }
       const statusLine = text.slice(0, text.indexOf("\r\n"));
@@ -4848,14 +4888,17 @@ function upgradeRequest(conn, path, body) {
     socket.on("data", onData);
     socket.on("error", fail);
     socket.on("close", onEarlyClose);
+    const extraHeaders = Object.entries(opts.headers ?? {}).map(([name, value]) => `${name}: ${value}\r
+`).join("");
+    const contentType = opts.contentType ? `Content-Type: ${opts.contentType}\r
+` : "";
     socket.write(
       `POST ${path} HTTP/1.1\r
 Host: ${conn.socketPath ? "localhost" : conn.host ?? "localhost"}\r
-Content-Type: application/json\r
-Content-Length: ${Buffer.byteLength(body)}\r
+` + contentType + `Content-Length: ${Buffer.byteLength(body)}\r
 Connection: Upgrade\r
-Upgrade: tcp\r
-\r
+Upgrade: ${protocol}\r
+` + extraHeaders + `\r
 ` + body
     );
   });
@@ -4864,7 +4907,8 @@ function startExecStream(conn, execId, opts) {
   return upgradeRequest(
     conn,
     `/exec/${execId}/start`,
-    JSON.stringify({ Detach: false, Tty: opts.tty })
+    JSON.stringify({ Detach: false, Tty: opts.tty }),
+    { contentType: "application/json" }
   );
 }
 function startAttachStream(conn, containerId, opts) {
@@ -4874,7 +4918,55 @@ function startAttachStream(conn, containerId, opts) {
     stdout: opts.stdout ? "1" : "0",
     stderr: opts.stderr ? "1" : "0"
   });
-  return upgradeRequest(conn, `/containers/${containerId}/attach?${q.toString()}`, "");
+  return upgradeRequest(conn, `/containers/${containerId}/attach?${q.toString()}`, "", {
+    contentType: "application/json"
+  });
+}
+function startBuildKitSessionStream(conn, sessionId, sessionName) {
+  if (!sessionId || /[\r\n]/.test(sessionId) || /[\r\n]/.test(sessionName)) {
+    return Promise.reject(new Error("Invalid Docker BuildKit session identity"));
+  }
+  return upgradeRequest(conn, "/session", "", {
+    protocol: "h2c",
+    headers: {
+      "X-Docker-Expose-Session-Uuid": sessionId,
+      "X-Docker-Expose-Session-Name": sessionName
+    },
+    timeoutLabel: "Docker BuildKit session"
+  });
+}
+var patchedBuildKitModems = /* @__PURE__ */ new WeakSet();
+function headerValue(headers, name) {
+  if (!headers || typeof headers !== "object") return "";
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== name.toLowerCase()) continue;
+    if (Array.isArray(value)) return value.length > 0 ? String(value[0]) : "";
+    return value == null ? "" : String(value);
+  }
+  return "";
+}
+function installDockerodeBuildKitSessionWorkaround(docker) {
+  if (!docker.modem || typeof docker.modem !== "object") return;
+  const modem = docker.modem;
+  if (typeof modem.dial !== "function" || patchedBuildKitModems.has(modem)) return;
+  const originalDial = modem.dial.bind(modem);
+  modem.dial = (options, callback) => {
+    const upgrade = headerValue(options.headers, "upgrade");
+    if (options.path !== "/session" || options.hijack !== true || upgrade.toLowerCase() !== "h2c" || !callback) {
+      return originalDial(options, callback);
+    }
+    const sessionId = headerValue(options.headers, "x-docker-expose-session-uuid");
+    const sessionName = headerValue(options.headers, "x-docker-expose-session-name");
+    void startBuildKitSessionStream(
+      daemonConnectionFrom(docker),
+      sessionId,
+      sessionName || "openship"
+    ).then(
+      (socket) => callback(null, socket),
+      (error) => callback(error instanceof Error ? error : new Error(String(error)), null)
+    );
+  };
+  patchedBuildKitModems.add(modem);
 }
 function daemonConnectionFrom(docker) {
   const m = docker.modem ?? {};
@@ -5113,7 +5205,10 @@ function awaitFirstByte(upstream, ms) {
       upstream.removeListener("close", onFail);
       resolve(outcome);
     };
-    const onData = (chunk) => finish({ kind: "data", chunk });
+    const onData = (chunk) => {
+      upstream.pause();
+      finish({ kind: "data", chunk });
+    };
     const onFail = () => finish({ kind: "closed" });
     const timer = setTimeout(() => finish({ kind: "silent" }), ms);
     upstream.on("data", onData);
@@ -5373,7 +5468,9 @@ function createDockerSshBridge(opts) {
         firstByte.kind === "closed" ? "channel closed before answering" : "channel opened but no data flowed"
       );
     } catch (err) {
-      console.warn(`[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err)}`);
+      console.warn(
+        `[docker-ssh] bridge client failed (${opts.host ?? "?"}): ${safeErrorMessage(err)}`
+      );
       capture.fail(bridgeFailureReason(opts, safeErrorMessage(err)));
     }
   };
@@ -5386,7 +5483,9 @@ function createDockerSshBridge(opts) {
     void bridgeClient(client);
   });
   server.on("error", (err) => {
-    console.warn(`[docker-ssh] bridge listener error (${opts.host ?? "?"}): ${safeErrorMessage(err)}`);
+    console.warn(
+      `[docker-ssh] bridge listener error (${opts.host ?? "?"}): ${safeErrorMessage(err)}`
+    );
   });
   return {
     start: () => new Promise((resolve, reject) => {
@@ -5532,6 +5631,244 @@ function resolveDockerTransport(opts) {
   };
 }
 
+// ../../packages/adapters/src/runtime/docker-build-diagnostics.ts
+var DEFAULT_DOCKER_BUILD_IDLE_TIMEOUT_MS = 10 * 6e4;
+var MIN_DOCKER_BUILD_IDLE_TIMEOUT_MS = 6e4;
+var MAX_DOCKER_BUILD_IDLE_TIMEOUT_MS = 24 * 60 * 6e4;
+function getDockerBuildIdleTimeoutMs(raw = process.env.OPENSHIP_BUILD_IDLE_TIMEOUT_MS) {
+  if (raw == null || raw.trim() === "") return DEFAULT_DOCKER_BUILD_IDLE_TIMEOUT_MS;
+  const value = Number(raw);
+  return Number.isSafeInteger(value) && value >= MIN_DOCKER_BUILD_IDLE_TIMEOUT_MS && value <= MAX_DOCKER_BUILD_IDLE_TIMEOUT_MS ? value : DEFAULT_DOCKER_BUILD_IDLE_TIMEOUT_MS;
+}
+function memoryGuidance(context) {
+  const memoryMb = context.configuredMemoryMb;
+  if (context.memoryLimitApplied && memoryMb && memoryMb > 0) {
+    return `The classic Docker builder was capped at ${memoryMb} MB RAM; raise Build Memory in Project Settings \u2192 Resources if this build needs more.`;
+  }
+  return "This build path was not under an OpenShip-enforced memory cap; check available RAM/swap and the host or Docker daemon OOM logs.";
+}
+function exitCodeFromLine(line) {
+  const match = line.match(
+    /(?:returned a non-zero code|exited? with(?: exit)? code|exit code)\s*:?\s*(\d+)\b/i
+  );
+  return match ? Number(match[1]) : null;
+}
+function extractDockerBuildFailureHint(line, context = {}) {
+  const code = exitCodeFromLine(line);
+  if (code === 137) {
+    return `${line} \u2014 The build process was killed by SIGKILL (exit code 137). Memory exhaustion is the most common cause, but exit 137 alone does not prove OOM. ${memoryGuidance(context)}`;
+  }
+  if (code === 143) {
+    return `${line} \u2014 The build process received SIGTERM (exit code 143), usually because it was cancelled or stopped by another supervisor.`;
+  }
+  if (code !== null) return line;
+  if (/JavaScript heap out of memory|Fatal process out of memory|Ineffective mark-compacts near heap limit|Reached heap limit Allocation failed|fatal error:\s*(?:runtime:\s*)?out of memory/i.test(
+    line
+  )) {
+    return `${line} \u2014 The build process explicitly reported that it ran out of memory. ${memoryGuidance(context)}`;
+  }
+  if (/\bENOMEM\b|cannot allocate memory/i.test(line)) {
+    return `${line} \u2014 The build process could not allocate memory (ENOMEM). ${memoryGuidance(context)}`;
+  }
+  return null;
+}
+function chooseDockerBuildFailureHint(current, candidate) {
+  if (!candidate) return current;
+  if (!current) return candidate;
+  const score = (message) => {
+    if (/explicitly reported that it ran out of memory|could not allocate memory/i.test(message)) {
+      return 4;
+    }
+    if (/SIGKILL \(exit code 137\)/i.test(message)) return 3;
+    if (/BuildKit|package\.json was not found/i.test(message)) return 2;
+    if (/returned a non-zero code|failed to solve|executor failed running|error: build/i.test(message)) {
+      return 1;
+    }
+    return 0;
+  };
+  return score(candidate) > score(current) ? candidate : current;
+}
+function dockerBuildExitMessage(code, streamedHint, context = {}) {
+  if (streamedHint) return streamedHint;
+  const plain = `docker build exited with code ${code}`;
+  return extractDockerBuildFailureHint(plain, context) ?? plain;
+}
+function formatDuration(ms) {
+  if (ms % 6e4 === 0) {
+    const minutes = ms / 6e4;
+    return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+  }
+  const seconds = Math.ceil(ms / 1e3);
+  return `${seconds} second${seconds === 1 ? "" : "s"}`;
+}
+function dockerBuildIdleTimeoutError(timeoutMs, context = {}) {
+  const limit = context.memoryLimitApplied && context.configuredMemoryMb && context.configuredMemoryMb > 0 ? ` The classic Docker builder was capped at ${context.configuredMemoryMb} MB RAM, so sustained memory pressure is one possible cause.` : "";
+  return new Error(
+    `Docker build produced no output for ${formatDuration(timeoutMs)} and was cancelled.${limit} Other common causes are package-registry or DNS failures, a process waiting for input, and a stalled Docker daemon.`
+  );
+}
+function startDockerBuildIdleMonitor(options) {
+  let stopped = false;
+  let lastProgressAt = Date.now();
+  let lastReportedMinute = 0;
+  let deadline;
+  const armDeadline = () => {
+    clearTimeout(deadline);
+    deadline = setTimeout(() => {
+      if (stopped) return;
+      stopped = true;
+      clearInterval(heartbeat);
+      options.onTimeout();
+    }, options.timeoutMs);
+    deadline.unref?.();
+  };
+  const heartbeat = setInterval(() => {
+    if (stopped) return;
+    const idleMs = Date.now() - lastProgressAt;
+    const idleMinutes = Math.floor(idleMs / 6e4);
+    if (idleMinutes > lastReportedMinute) {
+      lastReportedMinute = idleMinutes;
+      options.onIdle(idleMs);
+    }
+  }, 6e4);
+  heartbeat.unref?.();
+  armDeadline();
+  return {
+    progress() {
+      if (stopped) return;
+      lastProgressAt = Date.now();
+      lastReportedMinute = 0;
+      armDeadline();
+    },
+    stop() {
+      if (stopped) return;
+      stopped = true;
+      clearTimeout(deadline);
+      clearInterval(heartbeat);
+    }
+  };
+}
+
+// ../../packages/adapters/src/runtime/docker-build-container-tracker.ts
+function normalizedImageId(value) {
+  return (value ?? "").replace(/^sha256:/, "").toLowerCase();
+}
+function commandMatches(instruction, actual) {
+  const run = instruction.match(/^RUN\s+([\s\S]+)$/i)?.[1]?.trim();
+  if (!run || !actual?.length) return false;
+  if (run.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(run);
+      return Array.isArray(parsed) && parsed.every((part) => typeof part === "string") && parsed.length === actual.length && parsed.every((part, index) => part === actual[index]);
+    } catch {
+      return false;
+    }
+  }
+  return actual[actual.length - 1] === run;
+}
+var LegacyBuildContainerTracker = class {
+  constructor(client, expectedMemoryBytes, ownershipHost) {
+    this.client = client;
+    this.expectedMemoryBytes = expectedMemoryBytes;
+    this.ownershipHost = ownershipHost;
+  }
+  parentImageId = null;
+  pendingStep = null;
+  active = null;
+  expectedStepTotal = null;
+  lastStepNumber = 0;
+  chunkBuffer = "";
+  queue = Promise.resolve();
+  termination = null;
+  /** Consume one complete dockerode `event.stream` field. */
+  observe(stream) {
+    if (!stream) return;
+    for (const rawLine of stream.split(/\r?\n/)) {
+      this.enqueueLine(rawLine);
+    }
+  }
+  /** Consume an arbitrary SSH stdout/stderr chunk, retaining a partial line. */
+  observeChunk(chunk) {
+    if (!chunk) return;
+    const parts = `${this.chunkBuffer}${chunk}`.split(/\r\n|\n|\r/);
+    this.chunkBuffer = parts.pop() ?? "";
+    if (this.chunkBuffer.length > 8192) this.chunkBuffer = this.chunkBuffer.slice(-8192);
+    for (const line of parts) this.enqueueLine(line);
+  }
+  flush() {
+    this.enqueueLine(this.chunkBuffer);
+    this.chunkBuffer = "";
+  }
+  enqueueLine(rawLine) {
+    const line = rawLine.trim();
+    if (!line) return;
+    this.queue = this.queue.then(
+      () => this.observeLine(line),
+      () => this.observeLine(line)
+    );
+  }
+  async observeLine(line) {
+    if (this.active) {
+      const removed = line.match(/^---> Removed intermediate container\s+([a-f0-9]{12,64})$/i);
+      if (removed?.[1]?.toLowerCase() === this.active.id) {
+        try {
+          const info = await this.client.inspect(this.active.id);
+          if (!info?.State?.Running) this.active = null;
+        } catch {
+        }
+      }
+      return;
+    }
+    const layer = line.match(/^--->\s+([a-f0-9]{12,64})$/i);
+    if (layer?.[1]) {
+      this.parentImageId = layer[1].toLowerCase();
+      return;
+    }
+    const step = line.match(/^Step\s+(\d+)\/(\d+)\s*:\s*([\s\S]+)$/i);
+    if (step?.[1] && step[2] && step[3]) {
+      const number = Number(step[1]);
+      const total = Number(step[2]);
+      const firstStep = this.lastStepNumber === 0 && number === 1;
+      const nextStep = number === this.lastStepNumber + 1;
+      const sameTotal = this.expectedStepTotal === null || total === this.expectedStepTotal;
+      if (number >= 1 && total >= number && sameTotal && (firstStep || nextStep)) {
+        this.expectedStepTotal ??= total;
+        this.lastStepNumber = number;
+        this.pendingStep = {
+          number,
+          total,
+          instruction: step[3].trim(),
+          parentImageId: this.parentImageId
+        };
+      }
+      return;
+    }
+    const running = line.match(/^---> Running in\s+([a-f0-9]{12,64})$/i);
+    if (running?.[1] && this.pendingStep && /^RUN\s+/i.test(this.pendingStep.instruction)) {
+      this.active = { ...this.pendingStep, id: running[1].toLowerCase() };
+      this.pendingStep = null;
+    }
+  }
+  async terminate() {
+    await this.queue;
+    const candidate = this.active;
+    if (!candidate) return { status: "none" };
+    const info = await this.client.inspect(candidate.id);
+    if (!info?.State?.Running) return { status: "not-running", id: candidate.id };
+    const actualId = info.Id?.toLowerCase() ?? "";
+    const actualImage = normalizedImageId(info.Config?.Image);
+    const expectedMemory = this.expectedMemoryBytes ?? 0;
+    const ownershipEntry = `${this.ownershipHost}:127.0.0.1`;
+    const verified = actualId.startsWith(candidate.id) && candidate.parentImageId !== null && actualImage.startsWith(candidate.parentImageId) && (info.HostConfig?.Memory ?? 0) === expectedMemory && info.HostConfig?.ExtraHosts?.includes(ownershipEntry) === true && commandMatches(candidate.instruction, info.Config?.Cmd);
+    if (!verified) return { status: "unverified", id: candidate.id };
+    await this.client.kill(candidate.id);
+    return { status: "killed", id: candidate.id };
+  }
+  terminateActive() {
+    return this.termination ??= this.terminate();
+  }
+};
+
 // ../../packages/adapters/src/runtime/docker.ts
 var isDockerNotFoundError = isRuntimeNotFoundError;
 function ownsBuiltImage(imageRef) {
@@ -5549,7 +5886,42 @@ var RESTART_POLICIES = {
   "unless-stopped": { Name: "unless-stopped", MaximumRetryCount: 0 },
   no: { Name: "no", MaximumRetryCount: 0 }
 };
-var DOCKER_BUILD_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+var BUILD_CONTAINER_CLEANUP_TIMEOUT_MS = 5e3;
+var BUILD_CONTAINER_IDENTIFICATION_GRACE_MS = 500;
+function newBuildOwnershipHost() {
+  return `openship-build-${randomUUID()}.invalid`;
+}
+async function boundedBuildContainerCleanup(cleanup) {
+  let timer = null;
+  const guarded = cleanup.catch(() => null);
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(null), BUILD_CONTAINER_CLEANUP_TIMEOUT_MS);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([guarded, deadline]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function stopTrackedBuildContainer(tracker, log, reason) {
+  if (!tracker) return;
+  tracker.flush();
+  const cleanup = await boundedBuildContainerCleanup(tracker.terminateActive());
+  if (cleanup?.status === "killed") {
+    log.log(`Stopped ${reason} Docker build container ${cleanup.id.slice(0, 12)}.`);
+  } else if (cleanup?.status === "unverified") {
+    log.log(
+      `${reason === "timed-out" ? "Timed-out" : "Interrupted"} build container ${cleanup.id.slice(0, 12)} did not match this build's verified step; it was left untouched.`,
+      "warn"
+    );
+  } else if (cleanup === null) {
+    log.log(
+      `${reason === "timed-out" ? "Timed-out" : "Interrupted"} Docker build cleanup could not be confirmed within 5 seconds; Docker may still be releasing the build container.`,
+      "warn"
+    );
+  }
+}
 var activeDockerBuilds = /* @__PURE__ */ new Map();
 var pendingDockerBuildCancellations = /* @__PURE__ */ new Map();
 var PENDING_CANCEL_TTL_MS = 10 * 60 * 1e3;
@@ -5719,21 +6091,34 @@ function parsePortBindings(portSpecs) {
 }
 function packBuildContext(contextDir, entries, cancelSignal, ignoreContextPath) {
   const controller = new AbortController();
+  const abort = (reason) => {
+    if (!controller.signal.aborted) controller.abort(reason);
+  };
   const ignore = ignoreContextPath ? (absolutePath) => ignoreContextPath(relative(contextDir, absolutePath).split(sep).join("/")) : void 0;
   const pack2 = tarFs.pack(contextDir, { entries, ignore });
   const body = pack2.pipe(createGzip());
   let contextError = null;
   const capture = (err) => {
     contextError ??= err instanceof Error ? err : new Error(String(err));
-    if (!controller.signal.aborted) controller.abort();
+    abort(contextError);
   };
+  const onCancel = () => abort(cancelSignal?.reason);
   if (cancelSignal) {
-    if (cancelSignal.aborted) controller.abort();
-    else cancelSignal.addEventListener("abort", () => controller.abort(), { once: true });
+    if (cancelSignal.aborted) abort(cancelSignal.reason);
+    else cancelSignal.addEventListener("abort", onCancel, { once: true });
   }
   pack2.once("error", capture);
   body.once("error", capture);
-  return { body, abortSignal: controller.signal, takeError: () => contextError };
+  return {
+    body,
+    abortSignal: controller.signal,
+    abort,
+    // Once buildImage has returned the response stream, streamDockerodeBuild
+    // owns cancellation. It briefly keeps that stream alive to receive Docker's
+    // exact intermediate-container id before aborting the request.
+    detachCancellation: () => cancelSignal?.removeEventListener("abort", onCancel),
+    takeError: () => contextError
+  };
 }
 var DURATION_UNITS_NS = {
   ns: 1,
@@ -5852,38 +6237,28 @@ function extractNetworkInfo(data) {
       break;
     }
   }
-  const hostPortByContainerPort = {};
-  let hostPort;
   const liveBindings = data.NetworkSettings?.Ports ?? {};
   const configuredBindings = data.HostConfig?.PortBindings ?? {};
+  const publishedPorts = [];
   for (const key of /* @__PURE__ */ new Set([...Object.keys(liveBindings), ...Object.keys(configuredBindings)])) {
     const [containerRaw, protocol = "tcp"] = key.split("/");
-    if (protocol.toLowerCase() !== "tcp") continue;
     const containerPort = Number(containerRaw);
-    if (!Number.isSafeInteger(containerPort) || containerPort < 1 || containerPort > 65535) {
-      continue;
-    }
     const live = liveBindings[key];
     const bindings = live && live.some((binding) => binding?.HostPort) ? live : configuredBindings[key];
-    const candidates = (bindings ?? []).map((binding, index) => {
-      const port = Number(binding?.HostPort);
-      if (!Number.isSafeInteger(port) || port < 1 || port > 65535) return null;
-      const ip2 = binding?.HostIp?.trim().replace(/^\[|\]$/g, "") ?? "";
-      const priority = ip2 === "127.0.0.1" || ip2 === "::1" ? 3 : /^127(?:\.\d{1,3}){3}$/.test(ip2) ? 2 : ip2 && ip2 !== "0.0.0.0" && ip2 !== "::" ? 1 : 0;
-      return { index, port, priority };
-    }).filter(
-      (candidate) => Boolean(candidate)
-    ).sort((left, right) => right.priority - left.priority || left.index - right.index);
-    const selected = candidates[0]?.port;
-    if (selected !== void 0) {
-      hostPortByContainerPort[containerPort] = selected;
-      hostPort ??= selected;
+    for (const binding of bindings ?? []) {
+      publishedPorts.push({
+        privatePort: containerPort,
+        publicPort: Number(binding?.HostPort),
+        type: protocol,
+        ...binding?.HostIp ? { ip: binding.HostIp } : {}
+      });
     }
   }
+  const { hostPort, hostPortByContainerPort } = dockerPublishedPortInfo(publishedPorts);
   return {
     ip,
     hostPort,
-    ...Object.keys(hostPortByContainerPort).length ? { hostPortByContainerPort } : {}
+    ...hostPortByContainerPort ? { hostPortByContainerPort } : {}
   };
 }
 function parseLoadedImageRef(output) {
@@ -5988,6 +6363,9 @@ var DockerRuntime = class _DockerRuntime {
   static async create(opts, systemManager, provisionLock) {
     const runtime = new _DockerRuntime(opts, systemManager, provisionLock);
     runtime._docker = new Dockerode(await runtime.transport.establish());
+    if (process.versions.bun) {
+      installDockerodeBuildKitSessionWorkaround(runtime._docker);
+    }
     return runtime;
   }
   supports(cap) {
@@ -6088,17 +6466,20 @@ var DockerRuntime = class _DockerRuntime {
     logger.log(`[${step}] ${label} ${message}`);
     logger.step(step, status, message);
   }
-  handleBuildEvent(event, logger, trace) {
+  handleBuildEvent(event, logger, trace, diagnosticContext = {}) {
     const errorMessage = event.errorDetail?.message ?? event.error;
     if (errorMessage) {
       logger.log(errorMessage, "error");
-      return errorMessage;
+      return this.extractBuildFailureHint(errorMessage, diagnosticContext) ?? errorMessage;
     }
     if (event.id === "moby.buildkit.trace" && typeof event.aux === "string") {
       let hint = null;
       for (const line of trace?.push(event.aux) ?? []) {
         logger.log(line.message, line.level === "error" ? "error" : parseLogLevel(line.message));
-        hint ??= this.extractBuildFailureHint(line.message);
+        hint = chooseDockerBuildFailureHint(
+          hint,
+          this.extractBuildFailureHint(line.message, diagnosticContext)
+        );
       }
       return hint;
     }
@@ -6125,7 +6506,7 @@ var DockerRuntime = class _DockerRuntime {
         return null;
       }
       logger.log(line, parseLogLevel(line));
-      return this.extractBuildFailureHint(line);
+      return this.extractBuildFailureHint(line, diagnosticContext);
     }
     if (event.status) {
       const parts = [event.id, event.status, event.progress].filter((p) => Boolean(p?.trim())).map((p) => p.trim());
@@ -6154,10 +6535,9 @@ var DockerRuntime = class _DockerRuntime {
   isLowSignalDockerLine(line) {
     return _DockerRuntime.DOCKER_BUILDER_NOISE.some((p) => p.test(line));
   }
-  extractBuildFailureHint(line) {
-    if (/returned a non-zero code:\s*\d+/i.test(line)) {
-      return line;
-    }
+  extractBuildFailureHint(line, diagnosticContext = {}) {
+    const processFailure = extractDockerBuildFailureHint(line, diagnosticContext);
+    if (processFailure) return processFailure;
     if (/requires? BuildKit|BuildKit is enabled but the buildx component/i.test(line)) {
       return `${line} \u2014 this Dockerfile needs BuildKit. Install the docker buildx plugin on the build host (\`docker-buildx-plugin\`), or remove the BuildKit-only instruction.`;
     }
@@ -6254,7 +6634,8 @@ var DockerRuntime = class _DockerRuntime {
     const dockerfileFlag = dockerfileName && dockerfileName !== "Dockerfile" ? ` -f ${sq(dockerfileName)}` : "";
     const buildKit = await this.remoteBuildKitAvailable();
     const builderEnv = buildKit ? "DOCKER_BUILDKIT=1 " : "";
-    const builderFlags = buildKit ? " --progress=plain" : " --force-rm";
+    const ownershipHost = buildKit ? null : newBuildOwnershipHost();
+    const builderFlags = buildKit ? " --progress=plain" : ` --force-rm --add-host ${sq(`${ownershipHost}:127.0.0.1`)}`;
     if (buildKit) {
       log.log("Builder: BuildKit (docker buildx detected on the host)");
     } else if (opts?.requiresBuildKit) {
@@ -6278,16 +6659,79 @@ var DockerRuntime = class _DockerRuntime {
       "running",
       "Running install inside container (docker build)"
     );
-    const { code } = await executor.streamExec(
-      buildCmd,
-      (entry) => {
-        log.log(entry.message, parseLogLevel(entry.message));
+    const diagnosticContext = {
+      configuredMemoryMb: config.resources.memoryMb,
+      memoryLimitApplied: false
+    };
+    const buildContainerTracker = buildKit ? null : this.remoteLegacyBuildContainerTracker(executor, ownershipHost);
+    const commandAbort = new AbortController();
+    const forwardCancellation = () => {
+      buildContainerTracker?.flush();
+      if (buildContainerTracker) void buildContainerTracker.terminateActive();
+      commandAbort.abort(signal?.reason);
+    };
+    if (signal?.aborted) forwardCancellation();
+    else signal?.addEventListener("abort", forwardCancellation, { once: true });
+    let timeoutError = null;
+    let streamedFailureHint = null;
+    const timeoutMs = getDockerBuildIdleTimeoutMs();
+    const idleMonitor = startDockerBuildIdleMonitor({
+      timeoutMs,
+      onIdle: (idleMs) => {
+        log.log(`Still building... (no output for ${Math.floor(idleMs / 6e4)}m)`);
       },
-      { signal }
-    );
+      onTimeout: () => {
+        timeoutError = dockerBuildIdleTimeoutError(timeoutMs, diagnosticContext);
+        buildContainerTracker?.flush();
+        if (buildContainerTracker) void buildContainerTracker.terminateActive();
+        commandAbort.abort(timeoutError);
+      }
+    });
+    let code = null;
+    let execError = null;
+    try {
+      const result = await executor.streamExec(
+        buildCmd,
+        (entry) => {
+          idleMonitor.progress();
+          buildContainerTracker?.observeChunk(entry.message);
+          streamedFailureHint = chooseDockerBuildFailureHint(
+            streamedFailureHint,
+            this.extractBuildFailureHint(entry.message, diagnosticContext)
+          );
+          log.log(entry.message, parseLogLevel(entry.message));
+        },
+        { signal: commandAbort.signal }
+      );
+      code = result.code;
+    } catch (error) {
+      execError = error;
+    } finally {
+      idleMonitor.stop();
+      buildContainerTracker?.flush();
+      signal?.removeEventListener("abort", forwardCancellation);
+    }
     log.log("\u2500\u2500\u2500 end docker build output \u2500\u2500\u2500");
-    if (signal?.aborted) throw new BuildCancelledError();
-    if (code !== 0) throw new Error(`docker build exited with code ${code}`);
+    if (timeoutError) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "timed-out");
+      throw timeoutError;
+    }
+    if (signal?.aborted) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw new BuildCancelledError();
+    }
+    if (execError) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw execError;
+    }
+    if (code === null) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw new Error("docker build ended without an exit code");
+    }
+    if (code !== 0) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw new Error(dockerBuildExitMessage(code, streamedFailureHint, diagnosticContext));
+    }
     this.emitDockerStep(log, "install", "completed", "Image build finished");
   }
   /**
@@ -6338,48 +6782,64 @@ var DockerRuntime = class _DockerRuntime {
         config.gitSsh
       );
     }
-    const {
-      cloneUrl,
-      gitEnv: GIT_ENV,
-      credFlag: CRED
-    } = assembleGitClone({
+    const gitInvocation = assembleGitClone({
       repoUrl: config.repoUrl,
       gitToken: config.gitToken,
       gitCredentialHelperPath: config.gitCredentialHelperPath,
       ssh: sshMaterial,
       ambient: config.gitAmbient
     });
+    const { cloneUrl, credFlag: CRED } = gitInvocation;
     const dir = sq(remoteContextDir);
     const authLabel = config.gitSsh ? "ssh key" : useHelper ? "forwarded credentials" : config.gitAmbient ? `the server's own git credentials (${config.gitAmbient.via})` : "token";
     log.log(`Cloning ${config.repoUrl} on the server \u2192 ${remoteContextDir} (${authLabel})...
 `);
     await executor.exec(`rm -rf ${dir} && mkdir -p ${dir}`);
-    const run = async (cmd) => {
+    const run = async (operation, cmd) => {
       const { code } = await executor.streamExec(
         cmd,
         (entry) => log.log(entry.message, parseLogLevel(entry.message))
       );
-      if (code !== 0) throw new Error(`git clone on server exited with code ${code}`);
+      if (code !== 0) throw new Error(`git ${operation} on server exited with code ${code}`);
     };
     try {
       if (config.commitSha) {
-        try {
-          await run(
-            `${GIT_ENV} git ${CRED} clone --progress --depth 50 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${dir} && cd ${dir} && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
-          );
-        } catch {
+        await run(
+          "clone",
+          gitShellCommand(
+            gitInvocation,
+            `clone --progress --depth 50 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${dir}`
+          )
+        );
+        const commitPresent = await executor.exec(`cd ${dir} && git ${CRED} cat-file -e ${sq(`${config.commitSha}^{commit}`)}`).then(
+          () => true,
+          () => false
+        );
+        if (!commitPresent) {
           log.log(
             `Commit ${config.commitSha} not in the shallow clone; unshallowing and retrying.
 `,
             "warn"
           );
           await run(
-            `cd ${dir} && ${GIT_ENV} git ${CRED} fetch --progress --unshallow && git ${CRED} -c advice.detachedHead=false checkout ${sq(config.commitSha)}`
+            "fetch",
+            `cd ${dir} && ${gitShellCommand(gitInvocation, "fetch --progress --unshallow")}`
           );
         }
+        await run(
+          "checkout",
+          `cd ${dir} && ${gitShellCommand(
+            gitInvocation,
+            `-c advice.detachedHead=false checkout ${sq(config.commitSha)}`
+          )}`
+        );
       } else {
         await run(
-          `${GIT_ENV} git ${CRED} clone --progress --depth 1 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${dir}`
+          "clone",
+          gitShellCommand(
+            gitInvocation,
+            `clone --progress --depth 1 --branch ${sq(config.branch)} ${sq(cloneUrl)} ${dir}`
+          )
         );
       }
       await executor.exec(`rm -rf ${sq(`${remoteContextDir}/.git`)}`).catch(() => {
@@ -6500,6 +6960,55 @@ var DockerRuntime = class _DockerRuntime {
     }
     return { options: { version: "2" }, trace: new BuildKitTraceDecoder() };
   }
+  /**
+   * Bind legacy-builder cleanup to the exact container id Docker announces in
+   * this build's own progress stream. A 404 is an ordinary "already cleaned"
+   * result; every other inspection failure remains inconclusive and therefore
+   * can never authorize a kill.
+   */
+  legacyBuildContainerTracker(expectedMemoryBytes, ownershipHost) {
+    return new LegacyBuildContainerTracker(
+      {
+        inspect: async (id) => {
+          try {
+            return await this.docker.getContainer(id).inspect();
+          } catch (error) {
+            if (isDockerNotFoundError(error)) return null;
+            throw error;
+          }
+        },
+        kill: async (id) => {
+          await this.docker.getContainer(id).kill({ signal: "SIGKILL" });
+        }
+      },
+      expectedMemoryBytes,
+      ownershipHost
+    );
+  }
+  /** Same proof model as the Engine-API tracker, using the already-live SSH executor. */
+  remoteLegacyBuildContainerTracker(executor, ownershipHost) {
+    return new LegacyBuildContainerTracker(
+      {
+        inspect: async (id) => {
+          try {
+            const output = await executor.exec(`docker container inspect ${sq(id)}`);
+            const parsed = JSON.parse(output);
+            return Array.isArray(parsed) && parsed[0] && typeof parsed[0] === "object" ? parsed[0] : null;
+          } catch (error) {
+            if (/No such (?:object|container)|not found/i.test(safeErrorMessage(error)))
+              return null;
+            throw error;
+          }
+        },
+        kill: async (id) => {
+          await executor.exec(`docker container kill --signal KILL ${sq(id)} >/dev/null`);
+        }
+      },
+      // The native CLI path intentionally applies no OpenShip memory flag.
+      void 0,
+      ownershipHost
+    );
+  }
   /**
    * Dockerode build path. Used for local socket and TCP transports, plus
    * SSH transports that didn't get an executor wired in (shouldn't happen
@@ -6511,13 +7020,21 @@ var DockerRuntime = class _DockerRuntime {
    */
   async buildViaDockerode(config, buildContext, tag, log, cancelSignal) {
     log.log(`Streaming build context to Docker daemon - image tag: ${tag}`);
-    const { body, abortSignal, takeError } = packBuildContext(
+    const { body, abortSignal, abort, detachCancellation, takeError } = packBuildContext(
       buildContext.buildContextDir,
       buildContext.contextEntries,
       cancelSignal,
       buildContext.ignoreContextPath
     );
     const builder = this.selectDockerodeBuilder(config, buildContext.requiresBuildKit, log);
+    const buildLimits = dockerBuildResourceLimits(config.resources);
+    const ownershipHost = builder.options.version !== "2" ? newBuildOwnershipHost() : null;
+    const diagnosticContext = {
+      configuredMemoryMb: config.resources.memoryMb,
+      // Engine API build limits work only with the classic builder. The
+      // BuildKit selection above already logs that its build runs uncapped.
+      memoryLimitApplied: builder.options.version !== "2" && buildLimits.memory !== void 0
+    };
     try {
       const stream = await this.docker.buildImage(body, {
         t: tag,
@@ -6527,13 +7044,23 @@ var DockerRuntime = class _DockerRuntime {
         // Omitted entirely unless the project set a build cap — a self-hosted
         // build should be free to use the machine (a production build often
         // needs several GB). Opt-in only; see dockerBuildResourceLimits.
-        ...dockerBuildResourceLimits(config.resources),
+        ...buildLimits,
+        ...ownershipHost && { extrahosts: `${ownershipHost}:127.0.0.1` },
         forcerm: true,
         ...builder.options,
         abortSignal
       });
+      detachCancellation();
       log.log("Connected to Docker daemon. Build output follows:");
-      await this.streamDockerodeBuild(stream, log, builder.trace);
+      await this.streamDockerodeBuild(stream, log, {
+        trace: builder.trace,
+        diagnosticContext,
+        abortBuild: abort,
+        cancelSignal,
+        ...ownershipHost && {
+          legacyBuilder: { expectedMemoryBytes: buildLimits.memory, ownershipHost }
+        }
+      });
       log.log("Docker daemon finished streaming build output. Finalizing image...\n");
     } catch (err) {
       const contextErr = takeError();
@@ -6541,6 +7068,7 @@ var DockerRuntime = class _DockerRuntime {
         cause: contextErr
       }) : err;
     } finally {
+      detachCancellation();
       await buildContext.cleanup();
     }
   }
@@ -6549,69 +7077,107 @@ var DockerRuntime = class _DockerRuntime {
    * idle timeout + keepalive, and throw on a fatal build event. Shared by the
    * single-image dockerode path and the local batch build (buildImages).
    */
-  async streamDockerodeBuild(stream, log, trace) {
+  async streamDockerodeBuild(stream, log, options = {}) {
     let fatalBuildError = null;
-    await new Promise((resolve, reject) => {
-      let settled = false;
-      let idleTimer = null;
-      let keepaliveTimer = null;
-      let idleMinutes = 0;
-      const clearTimers = () => {
-        if (idleTimer) {
-          clearTimeout(idleTimer);
-          idleTimer = null;
-        }
-        if (keepaliveTimer) {
-          clearInterval(keepaliveTimer);
-          keepaliveTimer = null;
-        }
-        idleMinutes = 0;
-      };
-      const fail = (error) => {
-        if (settled) return;
-        settled = true;
-        clearTimers();
-        stream.destroy?.(error);
-        reject(error);
-      };
-      const succeed = () => {
-        if (settled) return;
-        settled = true;
-        clearTimers();
-        resolve();
-      };
-      const resetIdleTimer = () => {
-        clearTimers();
-        keepaliveTimer = setInterval(() => {
-          idleMinutes += 1;
-          log.log(`Still building... (no output for ${idleMinutes}m)`);
-        }, 6e4);
-        if (keepaliveTimer.unref) keepaliveTimer.unref();
-        idleTimer = setTimeout(() => {
-          fail(
-            new Error(
-              "Docker build produced no output for 30 minutes. This usually means the remote server cannot reach the package registry, has broken DNS, or the Docker daemon stalled during the build."
-            )
+    const timeoutMs = getDockerBuildIdleTimeoutMs();
+    const diagnosticContext = options.diagnosticContext ?? {};
+    const buildContainerTracker = options.legacyBuilder ? this.legacyBuildContainerTracker(
+      options.legacyBuilder.expectedMemoryBytes,
+      options.legacyBuilder.ownershipHost
+    ) : null;
+    let inactivityTimedOut = false;
+    try {
+      await new Promise((resolve, reject) => {
+        let settled = false;
+        let idleMonitor = null;
+        let cancellationTimer = null;
+        const clearTimers = () => {
+          idleMonitor?.stop();
+          if (cancellationTimer) clearTimeout(cancellationTimer);
+          options.cancelSignal?.removeEventListener("abort", requestCancellation);
+        };
+        const fail = (error) => {
+          if (settled) return;
+          settled = true;
+          clearTimers();
+          stream.destroy?.(error);
+          reject(error);
+        };
+        const abortCancelledBuild = () => {
+          if (settled) return;
+          buildContainerTracker?.flush();
+          if (buildContainerTracker) void buildContainerTracker.terminateActive();
+          const error = new BuildCancelledError();
+          fail(error);
+          options.abortBuild?.(error);
+        };
+        const requestCancellation = () => {
+          if (settled || cancellationTimer) return;
+          idleMonitor?.stop();
+          cancellationTimer = setTimeout(
+            abortCancelledBuild,
+            buildContainerTracker ? BUILD_CONTAINER_IDENTIFICATION_GRACE_MS : 0
           );
-        }, DOCKER_BUILD_IDLE_TIMEOUT_MS);
-        if (idleTimer.unref) idleTimer.unref();
-      };
-      resetIdleTimer();
-      this.docker.modem.followProgress(
-        stream,
-        (err) => {
-          if (err) {
-            fail(err);
+          cancellationTimer.unref?.();
+        };
+        const succeed = () => {
+          if (settled) return;
+          if (options.cancelSignal?.aborted) {
+            abortCancelledBuild();
             return;
           }
-          succeed();
-        },
-        (event) => {
-          resetIdleTimer();
-          fatalBuildError ??= this.handleBuildEvent(event, log, trace);
-        }
+          settled = true;
+          clearTimers();
+          resolve();
+        };
+        idleMonitor = startDockerBuildIdleMonitor({
+          timeoutMs,
+          onIdle: (idleMs) => {
+            log.log(`Still building... (no output for ${Math.floor(idleMs / 6e4)}m)`);
+          },
+          onTimeout: () => {
+            const error = dockerBuildIdleTimeoutError(timeoutMs, diagnosticContext);
+            inactivityTimedOut = true;
+            if (buildContainerTracker) {
+              void buildContainerTracker.terminateActive();
+            }
+            fail(error);
+            options.abortBuild?.(error);
+          }
+        });
+        if (options.cancelSignal?.aborted) requestCancellation();
+        else options.cancelSignal?.addEventListener("abort", requestCancellation, { once: true });
+        this.docker.modem.followProgress(
+          stream,
+          (err) => {
+            if (err) {
+              fail(err);
+              return;
+            }
+            succeed();
+          },
+          (event) => {
+            idleMonitor?.progress();
+            buildContainerTracker?.observe(event.stream);
+            fatalBuildError = chooseDockerBuildFailureHint(
+              fatalBuildError,
+              this.handleBuildEvent(event, log, options.trace, diagnosticContext)
+            );
+          }
+        );
+      });
+    } catch (error) {
+      await stopTrackedBuildContainer(
+        buildContainerTracker,
+        log,
+        inactivityTimedOut ? "timed-out" : "interrupted"
       );
-    });
+      throw error;
+    }
+    if (options.cancelSignal?.aborted) {
+      await stopTrackedBuildContainer(buildContainerTracker, log, "interrupted");
+      throw new BuildCancelledError();
+    }
     if (fatalBuildError) {
       throw new Error(fatalBuildError);
     }
@@ -7338,13 +7904,19 @@ var DockerRuntime = class _DockerRuntime {
               { signal, requiresBuildKit }
             );
           } else {
-            const { body, abortSignal, takeError } = packBuildContext(
+            const { body, abortSignal, abort, detachCancellation, takeError } = packBuildContext(
               buildContextDir ?? tree.contextDir,
               contextEntries ?? [],
               signal,
               ignoreContextPath
             );
             const builder = this.selectDockerodeBuilder(spec.config, requiresBuildKit, spec.logger);
+            const buildLimits = dockerBuildResourceLimits(spec.config.resources);
+            const ownershipHost = builder.options.version !== "2" ? newBuildOwnershipHost() : null;
+            const diagnosticContext = {
+              configuredMemoryMb: spec.config.resources.memoryMb,
+              memoryLimitApplied: builder.options.version !== "2" && buildLimits.memory !== void 0
+            };
             try {
               const stream = await this.docker.buildImage(body, {
                 t: tag,
@@ -7354,18 +7926,30 @@ var DockerRuntime = class _DockerRuntime {
                   sessionId: spec.config.sessionId
                 }),
                 buildargs: resolveDockerBuildArgs(spec.config),
-                ...dockerBuildResourceLimits(spec.config.resources),
+                ...buildLimits,
+                ...ownershipHost && { extrahosts: `${ownershipHost}:127.0.0.1` },
                 forcerm: true,
                 ...builder.options,
                 abortSignal
               });
-              await this.streamDockerodeBuild(stream, spec.logger, builder.trace);
+              detachCancellation();
+              await this.streamDockerodeBuild(stream, spec.logger, {
+                trace: builder.trace,
+                diagnosticContext,
+                abortBuild: abort,
+                cancelSignal: signal,
+                ...ownershipHost && {
+                  legacyBuilder: { expectedMemoryBytes: buildLimits.memory, ownershipHost }
+                }
+              });
             } catch (err) {
               const contextErr = takeError();
               throw contextErr ? new Error(
                 `Failed to read Docker build context: ${safeErrorMessage(contextErr)}`,
                 { cause: contextErr }
               ) : err;
+            } finally {
+              detachCancellation();
             }
           }
           if (isCancelled(spec.config.sessionId)) {
@@ -7685,6 +8269,56 @@ var DockerRuntime = class _DockerRuntime {
     } catch {
     }
   }
+  /**
+   * Reclaim BuildKit/classic-builder cache through Docker Engine's native API.
+   *
+   * Build cache belongs to the DAEMON, not to a project: intermediate records
+   * do not reliably retain OpenShip's final-image labels. Callers therefore own
+   * the host-wide policy (bounded automatic retention vs an explicit full
+   * clear). Docker itself excludes records leased by an active build.
+   *
+   * dockerode 4.0.9's `pruneBuilder(opts)` silently discards `opts`, so use its
+   * modem directly until upstream forwards the query parameters.
+   */
+  async pruneBuildCache(options = {}) {
+    const keepStorageBytes = options.keepStorageBytes;
+    if (keepStorageBytes !== void 0 && (!Number.isSafeInteger(keepStorageBytes) || keepStorageBytes < 0)) {
+      throw new RangeError("keepStorageBytes must be a non-negative safe integer");
+    }
+    const query = {
+      all: options.all ?? false
+    };
+    if (keepStorageBytes !== void 0) query["keep-storage"] = keepStorageBytes;
+    if (options.filters && Object.keys(options.filters).length > 0) {
+      query.filters = options.filters;
+    }
+    const raw = await new Promise((resolve, reject) => {
+      this.docker.modem.dial(
+        {
+          path: "/build/prune?",
+          method: "POST",
+          // `_body: {}` prevents docker-modem from serializing the query object
+          // into an irrelevant POST body while preserving its normal query
+          // encoding (including JSON-encoded filter maps).
+          options: { _query: query, _body: {} },
+          abortSignal: options.abortSignal,
+          statusCodes: {
+            200: true,
+            500: "server error"
+          }
+        },
+        (err, data) => {
+          if (err) reject(err);
+          else resolve(data);
+        }
+      );
+    });
+    const response = raw ?? {};
+    return {
+      cachesDeleted: Array.isArray(response.CachesDeleted) ? response.CachesDeleted.filter((id) => typeof id === "string") : [],
+      spaceReclaimed: typeof response.SpaceReclaimed === "number" && Number.isFinite(response.SpaceReclaimed) && response.SpaceReclaimed >= 0 ? response.SpaceReclaimed : 0
+    };
+  }
   /**
    * Containers labeled for this deployment, with live state — the reconcile
    * read-back. `State` is dockerode's `running | exited | paused | ...`; map it
@@ -8725,12 +9359,6 @@ var DockerRuntime = class _DockerRuntime {
     const log = onLog ?? (() => {
     });
     const containerName = `openship-${config.slug}-${config.serviceName}`;
-    try {
-      const existing = this.docker.getContainer(containerName);
-      await gracefulStopForGrace(existing);
-      await existing.remove({ force: true });
-    } catch {
-    }
     const serviceEnv = splitRuntimeEnv(config.environment);
     if (serviceEnv.dropped.length > 0) {
       log({
@@ -8758,6 +9386,31 @@ var DockerRuntime = class _DockerRuntime {
     const restartPolicy = resolveRestartPolicy(config.restart);
     const healthcheck = toDockerHealthcheck(config.advanced?.healthcheck);
     const stopConfig = toStopConfig(config.advanced);
+    if (!config.imageAlreadyPrepared) {
+      try {
+        log({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          message: `Pulling image ${config.image}...
+`,
+          level: "info"
+        });
+        await this.pullImage(config.image, { force: config.forcePull });
+      } catch (err) {
+        log({
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          message: `Failed to pull ${config.image}: ${err}
+`,
+          level: "error"
+        });
+        throw err;
+      }
+    }
+    try {
+      const existing = this.docker.getContainer(containerName);
+      await gracefulStopForGrace(existing);
+      await existing.remove({ force: true });
+    } catch {
+    }
     log({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       message: `Creating service container ${containerName} from ${config.image}...
@@ -8787,25 +9440,6 @@ var DockerRuntime = class _DockerRuntime {
         level: "info"
       });
     }
-    if (!config.image.startsWith("openship/")) {
-      try {
-        log({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          message: `Pulling image ${config.image}...
-`,
-          level: "info"
-        });
-        await this.pullImage(config.image, { force: config.forcePull });
-      } catch (err) {
-        log({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          message: `Failed to pull ${config.image}: ${err}
-`,
-          level: "error"
-        });
-        throw err;
-      }
-    }
     const container = await this.docker.createContainer({
       name: containerName,
       Image: config.image,