start-command 0.28.0 → 0.29.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # start-command
 
+## 0.29.0
+
+### Minor Changes
+
+- Add Docker isolation runtime controls: `--volume`/`-v`, `--mount`, `--env`/`-e`, and `--privileged`. These are threaded into the underlying `docker run` invocation and recorded in `--status`/`--list` metadata, allowing callers to mount tool credentials, pass environment variables, and run Docker-in-Docker images without wrapping `docker run` themselves.
+
+  Add `--isolation` as an alias for `--isolated` and fail fast on unknown wrapper options.
+
 ## 0.28.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "start-command",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "Gamification of coding, execute any command with ability to auto-report issues on GitHub",
   "main": "src/bin/cli.js",
   "exports": {

package/src/bin/cli.js

@@ -22,6 +22,8 @@ const {
   appendLogFile,
   createLogPath,
   getDefaultDockerImage,
+  buildDockerRuntimeStatusLines,
+  buildDockerRuntimeMetadata,
 } = require('../lib/isolation');
 const {
   createIsolatedUser,
@@ -470,6 +472,7 @@ async function runWithIsolation(
   if (effectiveImage) {
     extraLines.push(`[Isolation] Image: ${effectiveImage}`);
   }
+  extraLines.push(...buildDockerRuntimeStatusLines(options));
   if (options.endpoint) {
     extraLines.push(`[Isolation] Endpoint: ${options.endpoint}`);
   }
@@ -496,6 +499,7 @@ async function runWithIsolation(
         isolationMode: mode,
         sessionName,
         image: effectiveImage,
+        ...buildDockerRuntimeMetadata(options),
         endpoint: options.endpoint,
         user: options.user,
         keepAlive: options.keepAlive,
@@ -570,6 +574,10 @@ async function runWithIsolation(
       user: createdUser,
       keepAlive: options.keepAlive,
       autoRemoveDockerContainer: options.autoRemoveDockerContainer,
+      volumes: options.volumes,
+      mounts: options.mounts,
+      env: options.env,
+      privileged: options.privileged,
       shell: options.shell,
       logPath: logFilePath,
     });

package/src/lib/args-parser.js

@@ -6,11 +6,15 @@
  * 2. $ [wrapper-options] command [command-options]
  *
  * Wrapper Options:
- * --isolated, -i <backend>         Run in isolated environment (screen, tmux, docker, ssh)
+ * --isolated, --isolation, -i <backend> Run in isolated environment (screen, tmux, docker, ssh)
  * --attached, -a                   Run in attached mode (foreground)
  * --detached, -d                   Run in detached mode (background)
  * --session, -s <name>             Session name for isolation
  * --image <image>                  Docker image (optional, defaults to OS-matched image)
+ * --volume, -v <host:container[:mode]> Docker bind mount/volume (repeatable, docker only)
+ * --mount <mount-spec>             Docker --mount spec (repeatable, docker only)
+ * --env, -e <KEY=VALUE>            Environment variable for docker container (repeatable, docker only)
+ * --privileged                     Run docker container in privileged mode (docker only)
  * --endpoint <endpoint>            SSH endpoint (required for ssh isolation, e.g., user@host)
  * --isolated-user, -u [username]   Create isolated user with same permissions (auto-generated name if not specified)
  * --keep-user                      Keep isolated user after command completes (don't delete)
@@ -167,6 +171,10 @@ function parseArgs(args) {
     sessionId: null, // Session ID (UUID) for tracking - auto-generated if not provided
     image: null, // Docker image (current level)
     imageStack: null, // Docker images for each level (with nulls for non-docker levels)
+    volumes: [], // Docker bind mounts/volumes (-v/--volume), applied to docker levels
+    mounts: [], // Docker --mount specs, applied to docker levels
+    env: [], // Docker environment variables (-e/--env, KEY=VALUE), applied to docker levels
+    privileged: false, // Run docker container in privileged mode
     endpoint: null, // SSH endpoint (current level, e.g., user@host)
     endpointStack: null, // SSH endpoints for each level (with nulls for non-ssh levels)
     user: false, // Create isolated user
@@ -206,9 +214,7 @@ function parseArgs(args) {
       if (arg.startsWith('-')) {
         const consumed = parseOption(args, i, wrapperOptions);
         if (consumed === 0) {
-          // Unknown option, treat rest as command
-          commandArgs = args.slice(i);
-          break;
+          throw new Error(`Unknown wrapper option: ${arg}`);
         }
         i += consumed;
       } else {
@@ -239,6 +245,9 @@ function parseWrapperArgs(args, options) {
   while (i < args.length) {
     const consumed = parseOption(args, i, options);
     if (consumed === 0) {
+      if (args[i].startsWith('-')) {
+        throw new Error(`Unknown wrapper option: ${args[i]}`);
+      }
       if (DEBUG) {
         console.warn(`Unknown wrapper option: ${args[i]}`);
       }
@@ -259,8 +268,8 @@ function parseWrapperArgs(args, options) {
 function parseOption(args, index, options) {
   const arg = args[index];
 
-  // --isolated or -i
-  if (arg === '--isolated' || arg === '-i') {
+  // --isolated, --isolation, or -i
+  if (arg === '--isolated' || arg === '--isolation' || arg === '-i') {
     if (index + 1 < args.length && !args[index + 1].startsWith('-')) {
       const value = args[index + 1];
       parseIsolatedValue(value, options);
@@ -272,8 +281,8 @@ function parseOption(args, index, options) {
     }
   }
 
-  // --isolated=<value>
-  if (arg.startsWith('--isolated=')) {
+  // --isolated=<value> or --isolation=<value>
+  if (arg.startsWith('--isolated=') || arg.startsWith('--isolation=')) {
     const value = arg.split('=')[1];
     parseIsolatedValue(value, options);
     return 1;
@@ -325,6 +334,62 @@ function parseOption(args, index, options) {
     return 1;
   }
 
+  // --volume or -v (for docker) - repeatable bind mount / volume
+  if (arg === '--volume' || arg === '-v') {
+    if (index + 1 < args.length && !args[index + 1].startsWith('-')) {
+      options.volumes.push(args[index + 1]);
+      return 2;
+    } else {
+      throw new Error(
+        `Option ${arg} requires a volume argument (host:container[:mode])`
+      );
+    }
+  }
+
+  // --volume=<value> or -v=<value>
+  if (arg.startsWith('--volume=') || arg.startsWith('-v=')) {
+    options.volumes.push(arg.slice(arg.indexOf('=') + 1));
+    return 1;
+  }
+
+  // --mount (for docker) - repeatable mount spec
+  if (arg === '--mount') {
+    if (index + 1 < args.length && !args[index + 1].startsWith('-')) {
+      options.mounts.push(args[index + 1]);
+      return 2;
+    } else {
+      throw new Error(`Option ${arg} requires a mount spec argument`);
+    }
+  }
+
+  // --mount=<value>
+  if (arg.startsWith('--mount=')) {
+    options.mounts.push(arg.slice('--mount='.length));
+    return 1;
+  }
+
+  // --env or -e (for docker) - repeatable environment variable
+  if (arg === '--env' || arg === '-e') {
+    if (index + 1 < args.length && !args[index + 1].startsWith('-')) {
+      options.env.push(args[index + 1]);
+      return 2;
+    } else {
+      throw new Error(`Option ${arg} requires a KEY=VALUE argument`);
+    }
+  }
+
+  // --env=<value> or -e=<value>
+  if (arg.startsWith('--env=') || arg.startsWith('-e=')) {
+    options.env.push(arg.slice(arg.indexOf('=') + 1));
+    return 1;
+  }
+
+  // --privileged (for docker)
+  if (arg === '--privileged') {
+    options.privileged = true;
+    return 1;
+  }
+
   // --endpoint (for ssh) - supports sequence for stacked isolation
   if (arg === '--endpoint') {
     if (index + 1 < args.length && !args[index + 1].startsWith('-')) {
@@ -555,6 +620,35 @@ function parseOption(args, index, options) {
   return 0;
 }
 
+/**
+ * Throw if docker runtime options (--volume, --mount, --env, --privileged)
+ * are present but the isolation configuration does not include docker.
+ * @param {object} options - Parsed options
+ * @throws {Error} If a docker-only option is set without docker isolation
+ */
+function validateDockerRuntimeOptionsRequireDocker(options) {
+  if (options.volumes && options.volumes.length > 0) {
+    throw new Error(
+      '--volume option is only valid when isolation stack includes docker'
+    );
+  }
+  if (options.mounts && options.mounts.length > 0) {
+    throw new Error(
+      '--mount option is only valid when isolation stack includes docker'
+    );
+  }
+  if (options.env && options.env.length > 0) {
+    throw new Error(
+      '--env option is only valid when isolation stack includes docker'
+    );
+  }
+  if (options.privileged) {
+    throw new Error(
+      '--privileged option is only valid when isolation stack includes docker'
+    );
+  }
+}
+
 /**
  * Validate parsed options
  * @param {object} options - Parsed options
@@ -677,6 +771,11 @@ function validateOptions(options) {
       );
     }
 
+    // Docker runtime options (--volume, --mount, --env, --privileged) require docker
+    if (!stack.includes('docker')) {
+      validateDockerRuntimeOptionsRequireDocker(options);
+    }
+
     // User isolation is not supported with Docker as first level
     if (options.user && currentBackend === 'docker') {
       throw new Error(
@@ -701,6 +800,7 @@ function validateOptions(options) {
         '--endpoint option is only valid when isolation stack includes ssh'
       );
     }
+    validateDockerRuntimeOptionsRequireDocker(options);
   }
 
   // Session name is only valid with isolation

package/src/lib/command-builder.js

@@ -54,6 +54,23 @@ function buildNextLevelCommand(options, command) {
     }
   }
 
+  // Docker runtime options are flat (not per-level); forward them only when a
+  // remaining level still uses docker so the nested $ invocation can apply them.
+  if (remainingStack.includes('docker')) {
+    for (const volume of options.volumes || []) {
+      parts.push(`--volume "${volume}"`);
+    }
+    for (const mount of options.mounts || []) {
+      parts.push(`--mount "${mount}"`);
+    }
+    for (const envVar of options.env || []) {
+      parts.push(`--env "${envVar}"`);
+    }
+    if (options.privileged) {
+      parts.push('--privileged');
+    }
+  }
+
   // Pass through global flags
   if (options.detached) {
     parts.push('--detached');

package/src/lib/isolation.js

@@ -486,10 +486,75 @@ const {
   canRunLinuxDockerImages,
 } = require('./docker-utils');
 
+/**
+ * Build the docker run runtime argument list contributed by configurable
+ * container options: privileged mode, environment variables, volumes/bind
+ * mounts, and --mount specs. Returned in a stable order so they can be spliced
+ * into the `docker run` argv before the image name.
+ * @param {object} options - Options (privileged, env, volumes, mounts)
+ * @returns {string[]} Docker CLI arguments
+ */
+function buildDockerRuntimeArgs(options = {}) {
+  const args = [];
+  if (options.privileged) {
+    args.push('--privileged');
+  }
+  for (const envVar of options.env || []) {
+    args.push('-e', envVar);
+  }
+  for (const volume of options.volumes || []) {
+    args.push('-v', volume);
+  }
+  for (const mount of options.mounts || []) {
+    args.push('--mount', mount);
+  }
+  return args;
+}
+
+/**
+ * Build the human-readable `[Isolation]` status lines for docker runtime
+ * options (volumes, mounts, env, privileged). Empty collections and a falsy
+ * privileged flag contribute no lines.
+ * @param {object} options - Options (volumes, mounts, env, privileged)
+ * @returns {string[]} Status lines for the start block / log header
+ */
+function buildDockerRuntimeStatusLines(options = {}) {
+  const lines = [];
+  if (options.volumes && options.volumes.length > 0) {
+    lines.push(`[Isolation] Volumes: ${options.volumes.join(', ')}`);
+  }
+  if (options.mounts && options.mounts.length > 0) {
+    lines.push(`[Isolation] Mounts: ${options.mounts.join(', ')}`);
+  }
+  if (options.env && options.env.length > 0) {
+    lines.push(`[Isolation] Env: ${options.env.join(', ')}`);
+  }
+  if (options.privileged) {
+    lines.push(`[Isolation] Privileged: true`);
+  }
+  return lines;
+}
+
+/**
+ * Build the execution-record metadata for docker runtime options, normalizing
+ * empty collections and a falsy privileged flag to `null`.
+ * @param {object} options - Options (volumes, mounts, env, privileged)
+ * @returns {{volumes: ?string[], mounts: ?string[], env: ?string[], privileged: ?boolean}}
+ */
+function buildDockerRuntimeMetadata(options = {}) {
+  return {
+    volumes:
+      options.volumes && options.volumes.length > 0 ? options.volumes : null,
+    mounts: options.mounts && options.mounts.length > 0 ? options.mounts : null,
+    env: options.env && options.env.length > 0 ? options.env : null,
+    privileged: options.privileged || null,
+  };
+}
+
 /**
  * Run command in Docker container
  * @param {string} command - Command to execute
- * @param {object} options - Options (image, session/name, detached, user, keepAlive, autoRemoveDockerContainer)
+ * @param {object} options - Options (image, session/name, detached, user, keepAlive, autoRemoveDockerContainer, volumes, mounts, env, privileged)
  * @returns {Promise<{success: boolean, containerName: string, message: string}>}
  */
 function runInDocker(command, options = {}) {
@@ -558,6 +623,8 @@ function runInDocker(command, options = {}) {
         dockerArgs.push('--user', options.user);
       }
 
+      dockerArgs.push(...buildDockerRuntimeArgs(options));
+
       const effectiveCommand = options.keepAlive
         ? `${command}; exec ${shellToUse}`
         : command;
@@ -640,6 +707,7 @@ function runInDocker(command, options = {}) {
       if (options.user) {
         dockerArgs.push('--user', options.user);
       }
+      dockerArgs.push(...buildDockerRuntimeArgs(options));
       if (DEBUG) {
         console.log(`[DEBUG] shell: ${shellToUse}`);
       }
@@ -784,6 +852,9 @@ module.exports = {
   runInScreen,
   runInTmux,
   runInDocker,
+  buildDockerRuntimeArgs,
+  buildDockerRuntimeStatusLines,
+  buildDockerRuntimeMetadata,
   runInSsh,
   runIsolated,
   runAsIsolatedUser,

package/src/lib/usage.js

@@ -3,13 +3,17 @@ function printUsage() {
   console.log(`Usage: $ [options] [--] <command> | $ --status <uuid> [--output-format <fmt>] | $ --list [--output-format <fmt>] | $ --upload-log <id> | $ --stop <id> | $ --terminate <id>
 
 Options:
-  --isolated, -i <env>  Run in isolated environment (screen, tmux, docker, ssh)
+  --isolated, --isolation, -i <env>  Run in isolated environment (screen, tmux, docker, ssh)
   --attached, -a        Run in attached mode (foreground)
   --detached, -d        Run in detached mode (background)
   --session, -s <name>  Session name for isolation
   --session-id <uuid>   Session UUID for tracking (auto-generated if not provided)
   --session-name <uuid> Alias for --session-id
   --image <image>       Docker image (optional, defaults to OS-matched image)
+  --volume, -v <spec>   Docker bind mount/volume host:container[:mode] (repeatable, docker only)
+  --mount <spec>        Docker --mount spec (repeatable, docker only)
+  --env, -e <KEY=VALUE> Environment variable for docker container (repeatable, docker only)
+  --privileged          Run docker container in privileged mode (docker only)
   --endpoint <endpoint> SSH endpoint (required for ssh isolation, e.g., user@host)
   --isolated-user, -u [name]  Create isolated user with same permissions
   --keep-user           Keep isolated user after command completes
@@ -33,6 +37,8 @@ Examples:
   $ -i screen -d bun start
   $ --isolated docker -- echo "hi"       # uses OS-matched default image
   $ --isolated docker --image ghcr.io/link-foundation/box-js:latest -- bun --version
+  $ -i docker -v ~/.config/gh:/root/.config/gh -e TOKEN=abc -- gh repo list
+  $ -i docker --image konard/hive-mind-dind:latest --privileged -- solve ...
   $ --isolated ssh --endpoint user@remote.server -- ls -la
   $ --isolated-user -- npm test            # Create isolated user
   $ -u myuser -- npm start                 # Custom username

package/test/args-parser-isolation-alias.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env bun
+/**
+ * Regression tests for --isolation alias handling and unknown wrapper options.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('assert');
+const { parseArgs } = require('../src/lib/args-parser');
+
+describe('parseArgs --isolation alias', () => {
+  it('should parse --isolation alias with value', () => {
+    const result = parseArgs(['--isolation', 'docker', '--', 'echo', 'hi']);
+    assert.strictEqual(result.wrapperOptions.isolated, 'docker');
+    assert.strictEqual(result.command, 'echo hi');
+  });
+
+  it('should parse --isolation=value alias format', () => {
+    const result = parseArgs(['--isolation=screen', '--', 'ls', '-la']);
+    assert.strictEqual(result.wrapperOptions.isolated, 'screen');
+  });
+
+  it('should parse --isolation alias before command without separator', () => {
+    const result = parseArgs(['--isolation', 'docker', 'echo', 'hi']);
+    assert.strictEqual(result.wrapperOptions.isolated, 'docker');
+    assert.strictEqual(result.command, 'echo hi');
+  });
+});
+
+describe('parseArgs unknown wrapper options', () => {
+  it('should throw for unknown wrapper option before separator', () => {
+    assert.throws(() => {
+      parseArgs(['--unknown-wrapper', 'value', '--', 'echo', 'hi']);
+    }, /Unknown wrapper option: --unknown-wrapper/);
+  });
+
+  it('should throw for unknown wrapper option without separator', () => {
+    assert.throws(() => {
+      parseArgs(['--unknown-wrapper', 'value', 'echo', 'hi']);
+    }, /Unknown wrapper option: --unknown-wrapper/);
+  });
+});

package/test/docker-runtime-options.js

@@ -0,0 +1,245 @@
+#!/usr/bin/env bun
+/**
+ * Tests for Docker runtime options: --volume/-v, --mount, --env/-e, --privileged
+ *
+ * Reproduces issue #132: callers need to configure bind mounts, volumes,
+ * environment variables, and privileged mode for the docker isolation backend
+ * so they can mount tool credentials and run Docker-in-Docker images without
+ * wrapping `docker run` themselves.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('assert');
+const { parseArgs } = require('../src/lib/args-parser');
+const {
+  buildDockerRuntimeArgs,
+  buildDockerRuntimeStatusLines,
+  buildDockerRuntimeMetadata,
+} = require('../src/lib/isolation');
+
+describe('Docker runtime options parsing', () => {
+  it('should parse repeatable --volume and -v', () => {
+    const result = parseArgs([
+      '--isolated',
+      'docker',
+      '--volume',
+      '/host/a:/container/a',
+      '-v',
+      '/host/b:/container/b:ro',
+      '--',
+      'ls',
+    ]);
+    assert.deepStrictEqual(result.wrapperOptions.volumes, [
+      '/host/a:/container/a',
+      '/host/b:/container/b:ro',
+    ]);
+  });
+
+  it('should parse --volume=value and -v=value', () => {
+    const result = parseArgs([
+      '-i',
+      'docker',
+      '--volume=/host/a:/c/a',
+      '-v=/host/b:/c/b',
+      '--',
+      'ls',
+    ]);
+    assert.deepStrictEqual(result.wrapperOptions.volumes, [
+      '/host/a:/c/a',
+      '/host/b:/c/b',
+    ]);
+  });
+
+  it('should parse repeatable --mount', () => {
+    const result = parseArgs([
+      '-i',
+      'docker',
+      '--mount',
+      'type=bind,src=/h,dst=/c',
+      '--mount=type=volume,src=vol,dst=/data',
+      '--',
+      'ls',
+    ]);
+    assert.deepStrictEqual(result.wrapperOptions.mounts, [
+      'type=bind,src=/h,dst=/c',
+      'type=volume,src=vol,dst=/data',
+    ]);
+  });
+
+  it('should parse repeatable --env and -e', () => {
+    const result = parseArgs([
+      '-i',
+      'docker',
+      '--env',
+      'FOO=bar',
+      '-e',
+      'GH_TOKEN=secret',
+      '--env=BAZ=qux',
+      '--',
+      'env',
+    ]);
+    assert.deepStrictEqual(result.wrapperOptions.env, [
+      'FOO=bar',
+      'GH_TOKEN=secret',
+      'BAZ=qux',
+    ]);
+  });
+
+  it('should parse --privileged', () => {
+    const result = parseArgs(['-i', 'docker', '--privileged', '--', 'ls']);
+    assert.strictEqual(result.wrapperOptions.privileged, true);
+  });
+
+  it('should default runtime options to empty/false', () => {
+    const result = parseArgs(['-i', 'docker', '--', 'ls']);
+    assert.deepStrictEqual(result.wrapperOptions.volumes, []);
+    assert.deepStrictEqual(result.wrapperOptions.mounts, []);
+    assert.deepStrictEqual(result.wrapperOptions.env, []);
+    assert.strictEqual(result.wrapperOptions.privileged, false);
+  });
+
+  it('should throw when --volume requires an argument', () => {
+    assert.throws(() => {
+      parseArgs(['-i', 'docker', '--volume', '--', 'ls']);
+    }, /requires a volume argument/);
+  });
+
+  it('should throw when --env requires an argument', () => {
+    assert.throws(() => {
+      parseArgs(['-i', 'docker', '--env', '--', 'ls']);
+    }, /requires a KEY=VALUE argument/);
+  });
+});
+
+describe('Docker runtime options validation', () => {
+  it('should reject --volume with non-docker backend', () => {
+    assert.throws(() => {
+      parseArgs(['-i', 'tmux', '-v', '/a:/b', '--', 'ls']);
+    }, /--volume option is only valid when isolation stack includes docker/);
+  });
+
+  it('should reject --mount without isolation', () => {
+    assert.throws(() => {
+      parseArgs(['--mount', 'type=bind,src=/a,dst=/b', '--', 'ls']);
+    }, /--mount option is only valid when isolation stack includes docker/);
+  });
+
+  it('should reject --env with non-docker backend', () => {
+    assert.throws(() => {
+      parseArgs(['-i', 'ssh', '--endpoint', 'u@h', '-e', 'A=1', '--', 'ls']);
+    }, /--env option is only valid when isolation stack includes docker/);
+  });
+
+  it('should reject --privileged without docker', () => {
+    assert.throws(() => {
+      parseArgs(['--privileged', '--', 'ls']);
+    }, /--privileged option is only valid when isolation stack includes docker/);
+  });
+
+  it('should accept runtime options when stack includes docker', () => {
+    const result = parseArgs([
+      '-i',
+      'screen docker',
+      '-v',
+      '/a:/b',
+      '-e',
+      'A=1',
+      '--privileged',
+      '--',
+      'ls',
+    ]);
+    assert.deepStrictEqual(result.wrapperOptions.volumes, ['/a:/b']);
+    assert.deepStrictEqual(result.wrapperOptions.env, ['A=1']);
+    assert.strictEqual(result.wrapperOptions.privileged, true);
+  });
+});
+
+describe('buildDockerRuntimeArgs', () => {
+  it('should build empty args by default', () => {
+    assert.deepStrictEqual(buildDockerRuntimeArgs({}), []);
+  });
+
+  it('should add --privileged first', () => {
+    assert.deepStrictEqual(buildDockerRuntimeArgs({ privileged: true }), [
+      '--privileged',
+    ]);
+  });
+
+  it('should expand env, volumes, and mounts in order', () => {
+    const args = buildDockerRuntimeArgs({
+      privileged: true,
+      env: ['FOO=bar', 'GH_TOKEN=secret'],
+      volumes: ['/h/a:/c/a', '/h/b:/c/b:ro'],
+      mounts: ['type=bind,src=/h,dst=/c'],
+    });
+    assert.deepStrictEqual(args, [
+      '--privileged',
+      '-e',
+      'FOO=bar',
+      '-e',
+      'GH_TOKEN=secret',
+      '-v',
+      '/h/a:/c/a',
+      '-v',
+      '/h/b:/c/b:ro',
+      '--mount',
+      'type=bind,src=/h,dst=/c',
+    ]);
+  });
+});
+
+describe('buildDockerRuntimeStatusLines', () => {
+  it('should return no lines for empty options', () => {
+    assert.deepStrictEqual(buildDockerRuntimeStatusLines({}), []);
+  });
+
+  it('should format volumes, mounts, env, and privileged lines', () => {
+    const lines = buildDockerRuntimeStatusLines({
+      volumes: ['/h:/c:ro'],
+      mounts: ['type=bind,src=/h,dst=/c'],
+      env: ['FOO=bar'],
+      privileged: true,
+    });
+    assert.deepStrictEqual(lines, [
+      '[Isolation] Volumes: /h:/c:ro',
+      '[Isolation] Mounts: type=bind,src=/h,dst=/c',
+      '[Isolation] Env: FOO=bar',
+      '[Isolation] Privileged: true',
+    ]);
+  });
+
+  it('should join multiple volumes with a comma', () => {
+    assert.deepStrictEqual(
+      buildDockerRuntimeStatusLines({ volumes: ['/a:/a', '/b:/b'] }),
+      ['[Isolation] Volumes: /a:/a, /b:/b']
+    );
+  });
+});
+
+describe('buildDockerRuntimeMetadata', () => {
+  it('should null out empty collections and falsy privileged', () => {
+    assert.deepStrictEqual(buildDockerRuntimeMetadata({}), {
+      volumes: null,
+      mounts: null,
+      env: null,
+      privileged: null,
+    });
+  });
+
+  it('should pass through populated collections and privileged', () => {
+    assert.deepStrictEqual(
+      buildDockerRuntimeMetadata({
+        volumes: ['/h:/c'],
+        mounts: ['type=bind,src=/h,dst=/c'],
+        env: ['FOO=bar'],
+        privileged: true,
+      }),
+      {
+        volumes: ['/h:/c'],
+        mounts: ['type=bind,src=/h,dst=/c'],
+        env: ['FOO=bar'],
+        privileged: true,
+      }
+    );
+  });
+});