socketduct 0.1.24 → 0.1.26

package/test/unit/config/docker-gateway-files.test.js

@@ -1,9 +1,8 @@
-import assert from "node:assert/strict"
+import {describe, expect, it} from "@velocious/testing"
 import {spawnSync} from "node:child_process"
 import {copyFile, mkdtemp, readFile, readdir, rm} from "node:fs/promises"
 import {tmpdir} from "node:os"
 import {delimiter, join} from "node:path"
-import test from "node:test"
 
 const composePath = new URL("../../../docker-compose.yml", import.meta.url)
 const developmentComposePath = new URL("../../../docker-compose.dev.yml", import.meta.url)
@@ -27,252 +26,253 @@ async function githubWorkflowNames() {
   }
 }
 
-test("TensorBuzz exclusively owns verification and container build validation", async () => {
-  const [packageJson, tensorbuzz, workflowNames] = await Promise.all([
-    readFile(packagePath, "utf8"),
-    readFile(tensorbuzzPath, "utf8"),
-    githubWorkflowNames()
-  ])
-  const packageMetadata = JSON.parse(packageJson)
+describe("docker gateway files", () => {
+  it("TensorBuzz exclusively owns verification and container build validation", async () => {
+    const [packageJson, tensorbuzz, workflowNames] = await Promise.all([
+      readFile(packagePath, "utf8"),
+      readFile(tensorbuzzPath, "utf8"),
+      githubWorkflowNames()
+    ])
+    const packageMetadata = JSON.parse(packageJson)
 
-  assert.deepEqual(workflowNames, [])
-  assert.match(tensorbuzz, /^dependency_roots:\n {2}- path: \.$/m)
-  assert.doesNotMatch(tensorbuzz, /^\s*- npm ci$/m)
-  assert.match(tensorbuzz, /DOCKER_HOST: "tcp:\/\/docker_server:2375"/)
-  assert.match(tensorbuzz, /docker_server:\n\s+image: "docker:[^"]+-dind"/)
-  assert.match(tensorbuzz, /privileged: true/)
-  assert.match(tensorbuzz, /docker build --tag socketduct-ci \./)
-  assert.doesNotMatch(tensorbuzz, /docker (?:login|push)/)
-  // release-patch refuses to publish a package marked "private": true, so the
-  // published UNLICENSED npm release requires the flag to be absent or false.
-  assert.notEqual(packageMetadata.private, true)
-  assert.equal(packageMetadata.license, "UNLICENSED")
-})
-
-test("Docker gateway files define a private Docker socket shim target", async () => {
-  const [compose, envExample, docs] = await Promise.all([
-    readFile(composePath, "utf8"),
-    readFile(envExamplePath, "utf8"),
-    readFile(docsPath, "utf8")
-  ])
-
-  assert.match(compose, /docker-socket-shim:/)
-  assert.match(compose, /profiles:\n\s+- docker-host/)
-  assert.match(compose, /\/var\/run\/docker\.sock:\/var\/run\/docker\.sock/)
-  assert.match(compose, /expose:\n\s+- "2375"/)
-  assert.doesNotMatch(compose, /2375:2375/)
-  assert.match(envExample, /SOCKETDUCT_TARGET_ALLOWLIST=docker-socket-shim:2375/)
-  assert.match(docs, /Docker socket shim/)
-})
+    expect(workflowNames).toEqual([])
+    expect(tensorbuzz).toMatch(/^dependency_roots:\n {2}- path: \.$/m)
+    expect(tensorbuzz).not.toMatch(/^\s*- npm ci$/m)
+    expect(tensorbuzz).toMatch(/DOCKER_HOST: "tcp:\/\/docker_server:2375"/)
+    expect(tensorbuzz).toMatch(/docker_server:\n\s+image: "docker:[^"]+-dind"/)
+    expect(tensorbuzz).toMatch(/privileged: true/)
+    expect(tensorbuzz).toMatch(/docker build --tag socketduct-ci \./)
+    expect(tensorbuzz).not.toMatch(/docker (?:login|push)/)
+    // release-patch refuses to publish a package marked "private": true, so the
+    // published UNLICENSED npm release requires the flag to be absent or false.
+    expect(packageMetadata.private).not.toBe(true)
+    expect(packageMetadata.license).toBe("UNLICENSED")
+  })
 
-test("native reverse gateway Compose has outbound-only private Docker access", async () => {
-  const compose = await readFile(reverseComposePath, "utf8")
-  assert.match(compose, /SOCKETDUCT_MODE: reverse-gateway/)
-  assert.match(compose, /SOCKETDUCT_TARGET_ALLOWLIST: docker-server:2375/)
-  assert.match(compose, /docker-control:/)
-  assert.match(compose, /wan-egress:/)
-  assert.doesNotMatch(compose, /\bports:/)
-  assert.doesNotMatch(compose, /socat|socket-shim|2375:2375/)
-})
+  it("Docker gateway files define a private Docker socket shim target", async () => {
+    const [compose, envExample, docs] = await Promise.all([
+      readFile(composePath, "utf8"),
+      readFile(envExamplePath, "utf8"),
+      readFile(docsPath, "utf8")
+    ])
 
-test("production Compose roles expose the opt-in persistent log mount contract", async () => {
-  const [compose, reverseCompose, envExample, docs] = await Promise.all([
-    readFile(composePath, "utf8"),
-    readFile(reverseComposePath, "utf8"),
-    readFile(envExamplePath, "utf8"),
-    readFile(docsPath, "utf8")
-  ])
+    expect(compose).toMatch(/docker-socket-shim:/)
+    expect(compose).toMatch(/profiles:\n\s+- docker-host/)
+    expect(compose).toMatch(/\/var\/run\/docker\.sock:\/var\/run\/docker\.sock/)
+    expect(compose).toMatch(/expose:\n\s+- "2375"/)
+    expect(compose).not.toMatch(/2375:2375/)
+    expect(envExample).toMatch(/SOCKETDUCT_TARGET_ALLOWLIST=docker-socket-shim:2375/)
+    expect(docs).toMatch(/Docker socket shim/)
+  })
 
-  for (const model of [compose, reverseCompose]) {
-    assert.match(model, /\$\{SOCKETDUCT_LOG_HOST_DIRECTORY:-\.\/logs\}:\/var\/log\/socketduct/)
-  }
-  assert.match(envExample, /SOCKETDUCT_LOG_DIRECTORY=\/var\/log\/socketduct/)
-  assert.match(envExample, /SOCKETDUCT_LOG_HOST_DIRECTORY=\/srv\/socketduct\/logs/)
-  assert.match(docs, /SOCKETDUCT_LOG_HOST_DIRECTORY/)
-  assert.match(docs, /\/var\/log\/socketduct/)
-})
+  it("native reverse gateway Compose has outbound-only private Docker access", async () => {
+    const compose = await readFile(reverseComposePath, "utf8")
+    expect(compose).toMatch(/SOCKETDUCT_MODE: reverse-gateway/)
+    expect(compose).toMatch(/SOCKETDUCT_TARGET_ALLOWLIST: docker-server:2375/)
+    expect(compose).toMatch(/docker-control:/)
+    expect(compose).toMatch(/wan-egress:/)
+    expect(compose).not.toMatch(/\bports:/)
+    expect(compose).not.toMatch(/socat|socket-shim|2375:2375/)
+  })
 
-test("production gateway Compose requires an immutable Socketduct GHCR image", async () => {
-  const [compose, developmentCompose, envExample] = await Promise.all([
-    readFile(composePath, "utf8"),
-    readFile(developmentComposePath, "utf8"),
-    readFile(envExamplePath, "utf8")
-  ])
+  it("production Compose roles expose the opt-in persistent log mount contract", async () => {
+    const [compose, reverseCompose, envExample, docs] = await Promise.all([
+      readFile(composePath, "utf8"),
+      readFile(reverseComposePath, "utf8"),
+      readFile(envExamplePath, "utf8"),
+      readFile(docsPath, "utf8")
+    ])
 
-  assert.match(compose, /image: \$\{SOCKETDUCT_IMAGE:\?[^}]+\}/)
-  assert.doesNotMatch(compose, /\bbuild:/)
-  assert.doesNotMatch(compose, /socketduct:latest/)
-  assert.match(developmentCompose, /\bbuild:/)
-  assert.match(envExample, /SOCKETDUCT_IMAGE=ghcr\.io\/kaspernj\/socketduct@sha256:/)
-})
+    for (const model of [compose, reverseCompose]) {
+      expect(model).toMatch(/\$\{SOCKETDUCT_LOG_HOST_DIRECTORY:-\.\/logs\}:\/var\/log\/socketduct/)
+    }
+    expect(envExample).toMatch(/SOCKETDUCT_LOG_DIRECTORY=\/var\/log\/socketduct/)
+    expect(envExample).toMatch(/SOCKETDUCT_LOG_HOST_DIRECTORY=\/srv\/socketduct\/logs/)
+    expect(docs).toMatch(/SOCKETDUCT_LOG_HOST_DIRECTORY/)
+    expect(docs).toMatch(/\/var\/log\/socketduct/)
+  })
 
-test("gateway deployment rejects mutable images before running Docker", async () => {
-  const {deployGateway} = await import("../../../scripts/deploy-gateway.js")
-  /** @type {Array<[string, string[]]>} */
-  const calls = []
+  it("production gateway Compose requires an immutable Socketduct GHCR image", async () => {
+    const [compose, developmentCompose, envExample] = await Promise.all([
+      readFile(composePath, "utf8"),
+      readFile(developmentComposePath, "utf8"),
+      readFile(envExamplePath, "utf8")
+    ])
 
-  for (const image of [
-    undefined,
-    "",
-    "socketduct:latest",
-    "ghcr.io/kaspernj/socketduct:latest",
-    "ghcr.io/kaspernj/socketduct:main",
-    "ghcr.io/kaspernj/socketduct:40cc261",
-    `ghcr.io/kaspernj/socketduct:release@sha256:${"a".repeat(64)}`,
-    `ghcr.io/kaspernj/socketduct@sha256:${"A".repeat(64)}`
-  ]) {
-    await assert.rejects(
-      deployGateway({image, run: (command, args) => { calls.push([command, args]); return "" }}),
-      /immutable GHCR image/
-    )
-  }
-  assert.deepEqual(calls, [])
-})
+    expect(compose).toMatch(/image: \$\{SOCKETDUCT_IMAGE:\?[^}]+\}/)
+    expect(compose).not.toMatch(/\bbuild:/)
+    expect(compose).not.toMatch(/socketduct:latest/)
+    expect(developmentCompose).toMatch(/\bbuild:/)
+    expect(envExample).toMatch(/SOCKETDUCT_IMAGE=ghcr\.io\/kaspernj\/socketduct@sha256:/)
+  })
 
-test("gateway deployment fixes Compose inputs, neutralizes ambient selectors, then verifies and applies", async () => {
-  const {deployGateway} = await import("../../../scripts/deploy-gateway.js")
-  /** @type {Array<[string, string[], {captureStdout?: boolean, env: Record<string, string | undefined>}]>} */
-  const calls = []
-  const digest = "a".repeat(64)
-  const image = `ghcr.io/kaspernj/socketduct@sha256:${digest}`
-  const environment = {
-    PATH: "/usr/bin",
-    DOCKER_HOST: "ssh://gateway.example.test",
-    DOCKER_CONTEXT: "production-gateway",
-    COMPOSE_FILE: "/tmp/mutable-compose.yml",
-    COMPOSE_ENV_FILES: "/tmp/mutable.env",
-    COMPOSE_DISABLE_ENV_FILE: "1",
-    COMPOSE_IGNORE_ORPHANS: "1",
-    COMPOSE_REMOVE_ORPHANS: "1",
-    COMPOSE_PATH_SEPARATOR: ";",
-    COMPOSE_PROFILES: "docker-host",
-    COMPOSE_PROJECT_NAME: "ambient-project"
-  }
+  it("gateway deployment rejects mutable images before running Docker", async () => {
+    const {deployGateway} = await import("../../../scripts/deploy-gateway.js")
+    /** @type {Array<[string, string[]]>} */
+    const calls = []
 
-  await deployGateway({
-    environment,
-    image,
-    projectDirectory: "/srv/socketduct release #1",
-    run: (command, args, options) => {
-      calls.push([command, args, options])
-      return args.includes("config")
-        ? JSON.stringify({services: {"socketduct-relay": {image}}})
-        : ""
+    for (const image of [
+      undefined,
+      "",
+      "socketduct:latest",
+      "ghcr.io/kaspernj/socketduct:latest",
+      "ghcr.io/kaspernj/socketduct:main",
+      "ghcr.io/kaspernj/socketduct:40cc261",
+      `ghcr.io/kaspernj/socketduct:release@sha256:${"a".repeat(64)}`,
+      `ghcr.io/kaspernj/socketduct@sha256:${"A".repeat(64)}`
+    ]) {
+      await expect(
+        deployGateway({image, run: (command, args) => { calls.push([command, args]); return "" }})
+      ).rejects.toThrow(/immutable GHCR image/)
     }
+    expect(calls).toEqual([])
   })
 
-  const compose = [
-    "compose",
-    "--file", "/srv/socketduct release #1/docker-compose.yml",
-    "--env-file", "/srv/socketduct release #1/.env",
-    "--project-directory", "/srv/socketduct release #1",
-    "--project-name", "socketduct-gateway"
-  ]
-  assert.deepEqual(calls.map(([command, args, options]) => [command, args, options.captureStdout]), [
-    ["docker", [...compose, "config", "--format", "json"], true],
-    ["docker", [...compose, "pull"], undefined],
-    ["docker", [...compose, "up", "-d", "--wait", "--no-build"], undefined]
-  ])
-  for (const [, , options] of calls) {
-    assert.equal(options.env.DOCKER_HOST, environment.DOCKER_HOST)
-    assert.equal(options.env.DOCKER_CONTEXT, environment.DOCKER_CONTEXT)
-    assert.equal(options.env.COMPOSE_FILE, "/srv/socketduct release #1/docker-compose.yml")
-    assert.equal(options.env.COMPOSE_ENV_FILES, "/srv/socketduct release #1/.env")
-    assert.equal(options.env.COMPOSE_PATH_SEPARATOR, delimiter)
-    assert.equal(options.env.COMPOSE_DISABLE_ENV_FILE, "false")
-    assert.equal(options.env.COMPOSE_IGNORE_ORPHANS, "false")
-    assert.equal(options.env.COMPOSE_REMOVE_ORPHANS, "false")
-    assert.equal(options.env.COMPOSE_PROFILES, "")
-    assert.equal(options.env.COMPOSE_PROJECT_NAME, "socketduct-gateway")
-    assert.equal(options.env.SOCKETDUCT_IMAGE, image)
-  }
-})
+  it("gateway deployment fixes Compose inputs, neutralizes ambient selectors, then verifies and applies", async () => {
+    const {deployGateway} = await import("../../../scripts/deploy-gateway.js")
+    /** @type {Array<[string, string[], {captureStdout?: boolean, env: Record<string, string | undefined>}]>} */
+    const calls = []
+    const digest = "a".repeat(64)
+    const image = `ghcr.io/kaspernj/socketduct@sha256:${digest}`
+    const environment = {
+      PATH: "/usr/bin",
+      DOCKER_HOST: "ssh://gateway.example.test",
+      DOCKER_CONTEXT: "production-gateway",
+      COMPOSE_FILE: "/tmp/mutable-compose.yml",
+      COMPOSE_ENV_FILES: "/tmp/mutable.env",
+      COMPOSE_DISABLE_ENV_FILE: "1",
+      COMPOSE_IGNORE_ORPHANS: "1",
+      COMPOSE_REMOVE_ORPHANS: "1",
+      COMPOSE_PATH_SEPARATOR: ";",
+      COMPOSE_PROFILES: "docker-host",
+      COMPOSE_PROJECT_NAME: "ambient-project"
+    }
 
-test("gateway deployment enables only the explicit docker-host profile", async () => {
-  const {deployGateway} = await import("../../../scripts/deploy-gateway.js")
-  /** @type {Array<{args: string[], environment: Record<string, string | undefined>}>} */
-  const calls = []
-  const image = `ghcr.io/kaspernj/socketduct@sha256:${"b".repeat(64)}`
+    await deployGateway({
+      environment,
+      image,
+      projectDirectory: "/srv/socketduct release #1",
+      run: (command, args, options) => {
+        calls.push([command, args, options])
+        return args.includes("config")
+          ? JSON.stringify({services: {"socketduct-relay": {image}}})
+          : ""
+      }
+    })
 
-  await deployGateway({
-    dockerHost: true,
-    environment: {COMPOSE_PROFILES: "unexpected"},
-    image,
-    projectDirectory: "/srv/socketduct",
-    run: (_command, args, options) => {
-      calls.push({args, environment: options.env})
-      return args.includes("config")
-        ? JSON.stringify({services: {"socketduct-relay": {image}}})
-        : ""
+    const compose = [
+      "compose",
+      "--file", "/srv/socketduct release #1/docker-compose.yml",
+      "--env-file", "/srv/socketduct release #1/.env",
+      "--project-directory", "/srv/socketduct release #1",
+      "--project-name", "socketduct-gateway"
+    ]
+    expect(calls.map(([command, args, options]) => [command, args, options.captureStdout])).toEqual([
+      ["docker", [...compose, "config", "--format", "json"], true],
+      ["docker", [...compose, "pull"], undefined],
+      ["docker", [...compose, "up", "-d", "--wait", "--no-build"], undefined]
+    ])
+    for (const [, , options] of calls) {
+      expect(options.env.DOCKER_HOST).toBe(environment.DOCKER_HOST)
+      expect(options.env.DOCKER_CONTEXT).toBe(environment.DOCKER_CONTEXT)
+      expect(options.env.COMPOSE_FILE).toBe("/srv/socketduct release #1/docker-compose.yml")
+      expect(options.env.COMPOSE_ENV_FILES).toBe("/srv/socketduct release #1/.env")
+      expect(options.env.COMPOSE_PATH_SEPARATOR).toBe(delimiter)
+      expect(options.env.COMPOSE_DISABLE_ENV_FILE).toBe("false")
+      expect(options.env.COMPOSE_IGNORE_ORPHANS).toBe("false")
+      expect(options.env.COMPOSE_REMOVE_ORPHANS).toBe("false")
+      expect(options.env.COMPOSE_PROFILES).toBe("")
+      expect(options.env.COMPOSE_PROJECT_NAME).toBe("socketduct-gateway")
+      expect(options.env.SOCKETDUCT_IMAGE).toBe(image)
     }
   })
 
-  assert.equal(calls.length, 3)
-  for (const {args, environment: childEnvironment} of calls) {
-    assert.equal(args.filter((argument) => argument === "--profile").length, 1)
-    assert.equal(args[args.indexOf("--profile") + 1], "docker-host")
-    assert.equal(childEnvironment.COMPOSE_PROFILES, "")
-  }
-})
-
-test("gateway deployment fails closed on a rendered image mismatch or build source", async () => {
-  const {deployGateway} = await import("../../../scripts/deploy-gateway.js")
-  const image = `ghcr.io/kaspernj/socketduct@sha256:${"c".repeat(64)}`
-  const renderedModels = [
-    {services: {"socketduct-relay": {image: "ghcr.io/kaspernj/socketduct:latest"}}},
-    {services: {"socketduct-relay": {build: {context: "."}, image}}},
-    {services: {}}
-  ]
+  it("gateway deployment enables only the explicit docker-host profile", async () => {
+    const {deployGateway} = await import("../../../scripts/deploy-gateway.js")
+    /** @type {Array<{args: string[], environment: Record<string, string | undefined>}>} */
+    const calls = []
+    const image = `ghcr.io/kaspernj/socketduct@sha256:${"b".repeat(64)}`
 
-  for (const rendered of renderedModels) {
-    let calls = 0
-    await assert.rejects(deployGateway({
-      environment: {},
+    await deployGateway({
+      dockerHost: true,
+      environment: {COMPOSE_PROFILES: "unexpected"},
       image,
       projectDirectory: "/srv/socketduct",
-      run: () => {
-        calls += 1
-        return JSON.stringify(rendered)
+      run: (_command, args, options) => {
+        calls.push({args, environment: options.env})
+        return args.includes("config")
+          ? JSON.stringify({services: {"socketduct-relay": {image}}})
+          : ""
       }
-    }), /rendered.*socketduct-relay|build source/i)
-    assert.equal(calls, 1)
-  }
-})
-
-test("gateway deployment CLI runs from paths containing spaces and hash characters", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct gateway #"))
-  const escapedScriptPath = join(root, "deploy gateway #.mjs")
-  try {
-    await copyFile(scriptPath, escapedScriptPath)
-    const result = spawnSync(process.execPath, [escapedScriptPath], {
-      encoding: "utf8",
-      env: {...process.env, SOCKETDUCT_IMAGE: "ghcr.io/kaspernj/socketduct:latest"}
     })
 
-    assert.equal(result.status, 1)
-    assert.match(result.stderr, /immutable GHCR image/)
-  } finally {
-    await rm(root, {recursive: true, force: true})
-  }
-})
+    expect(calls.length).toBe(3)
+    for (const {args, environment: childEnvironment} of calls) {
+      expect(args.filter((argument) => argument === "--profile").length).toBe(1)
+      expect(args[args.indexOf("--profile") + 1]).toBe("docker-host")
+      expect(childEnvironment.COMPOSE_PROFILES).toBe("")
+    }
+  })
+
+  it("gateway deployment fails closed on a rendered image mismatch or build source", async () => {
+    const {deployGateway} = await import("../../../scripts/deploy-gateway.js")
+    const image = `ghcr.io/kaspernj/socketduct@sha256:${"c".repeat(64)}`
+    const renderedModels = [
+      {services: {"socketduct-relay": {image: "ghcr.io/kaspernj/socketduct:latest"}}},
+      {services: {"socketduct-relay": {build: {context: "."}, image}}},
+      {services: {}}
+    ]
+
+    for (const rendered of renderedModels) {
+      let calls = 0
+      await expect(deployGateway({
+        environment: {},
+        image,
+        projectDirectory: "/srv/socketduct",
+        run: () => {
+          calls += 1
+          return JSON.stringify(rendered)
+        }
+      })).rejects.toThrow(/rendered.*socketduct-relay|build source/i)
+      expect(calls).toBe(1)
+    }
+  })
 
-test("gateway documentation describes pinning, private GHCR login, and digest rollback", async () => {
-  const [dockerDocs, packageJson, runningDocs, securityDocs] = await Promise.all([
-    readFile(docsPath, "utf8"),
-    readFile(packagePath, "utf8"),
-    readFile(runningDocsPath, "utf8"),
-    readFile(securityDocsPath, "utf8")
-  ])
-  const publicDocs = `${dockerDocs}\n${runningDocs}\n${securityDocs}`
+  it("gateway deployment CLI runs from paths containing spaces and hash characters", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct gateway #"))
+    const escapedScriptPath = join(root, "deploy gateway #.mjs")
+    try {
+      await copyFile(scriptPath, escapedScriptPath)
+      const result = spawnSync(process.execPath, [escapedScriptPath], {
+        encoding: "utf8",
+        env: {...process.env, SOCKETDUCT_IMAGE: "ghcr.io/kaspernj/socketduct:latest"}
+      })
 
-  assert.equal(JSON.parse(packageJson).scripts["gateway:deploy"], "node scripts/deploy-gateway.js")
-  assert.match(dockerDocs, /Node\.js 24/i)
-  assert.match(dockerDocs, /node --version/)
-  assert.match(dockerDocs, /npm --version/)
-  assert.match(dockerDocs, /npm run gateway:deploy/)
-  assert.match(dockerDocs, /--project-name socketduct-gateway/)
-  assert.match(dockerDocs, /docker login ghcr\.io/)
-  assert.match(dockerDocs, /rollback/i)
-  assert.match(dockerDocs, /change.*digest/i)
-  assert.doesNotMatch(publicDocs, /docker compose[^\n]*up[^\n]*--build/)
+      expect(result.status).toBe(1)
+      expect(result.stderr).toMatch(/immutable GHCR image/)
+    } finally {
+      await rm(root, {recursive: true, force: true})
+    }
+  })
+
+  it("gateway documentation describes pinning, private GHCR login, and digest rollback", async () => {
+    const [dockerDocs, packageJson, runningDocs, securityDocs] = await Promise.all([
+      readFile(docsPath, "utf8"),
+      readFile(packagePath, "utf8"),
+      readFile(runningDocsPath, "utf8"),
+      readFile(securityDocsPath, "utf8")
+    ])
+    const publicDocs = `${dockerDocs}\n${runningDocs}\n${securityDocs}`
+
+    expect(JSON.parse(packageJson).scripts["gateway:deploy"]).toBe("node scripts/deploy-gateway.js")
+    expect(dockerDocs).toMatch(/Node\.js 24/i)
+    expect(dockerDocs).toMatch(/node --version/)
+    expect(dockerDocs).toMatch(/npm --version/)
+    expect(dockerDocs).toMatch(/npm run gateway:deploy/)
+    expect(dockerDocs).toMatch(/--project-name socketduct-gateway/)
+    expect(dockerDocs).toMatch(/docker login ghcr\.io/)
+    expect(dockerDocs).toMatch(/rollback/i)
+    expect(dockerDocs).toMatch(/change.*digest/i)
+    expect(publicDocs).not.toMatch(/docker compose[^\n]*up[^\n]*--build/)
+  })
 })