the-moby-effect 1.51.6 → 1.54.1

package/src/internal/engines/dind.ts

@@ -1,29 +1,31 @@
-import type * as PlatformError from "@effect/platform/Error";
-import type * as ParseResult from "effect/ParseResult";
+import type * as PlatformError from "effect/PlatformError";
 import type * as Schema from "effect/Schema";
 import type * as Scope from "effect/Scope";
-import type * as TarHeader from "eftar/Header";
-import type * as DindEngine from "../../DindEngine.js";
-import type * as BlobConstants from "../blobs/constants.js";
-import type * as IdSchemas from "../schemas/id.js";
 
-import * as FileSystem from "@effect/platform/FileSystem";
-import * as Path from "@effect/platform/Path";
-import * as InternetSchemas from "effect-schemas/Internet";
 import * as Array from "effect/Array";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Function from "effect/Function";
 import * as HashMap from "effect/HashMap";
 import * as HashSet from "effect/HashSet";
 import * as Layer from "effect/Layer";
 import * as Match from "effect/Match";
 import * as Option from "effect/Option";
+import * as Path from "effect/Path";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import * as String from "effect/String";
 import * as Tuple from "effect/Tuple";
+
+import type * as DindEngine from "../../DindEngine.js";
+import type * as BlobConstants from "../blobs/constants.js";
+import type * as IdSchemas from "../schemas/id.js";
+import type * as TarHeader from "eftar/Header";
+
+import * as InternetSchemas from "effect-schemas/Internet";
 import * as Tar from "eftar/Tar";
 import * as Untar from "eftar/Untar";
+
 import * as DockerEngine from "../../DockerEngine.js";
 import * as MobyConnection from "../../MobyConnection.js";
 import * as MobyConvey from "../../MobyConvey.js";
@@ -32,6 +34,7 @@ import * as internalHttpBlob from "../blobs/http.js";
 import * as internalHttpsBlob from "../blobs/https.js";
 import * as internalSocketBlob from "../blobs/socket.js";
 import * as internalSshBlob from "../blobs/ssh.js";
+import * as PortSchemas from "../schemas/port.js";
 
 /** @internal */
 const downloadDindCertificates = (
@@ -42,7 +45,7 @@ const downloadDindCertificates = (
         key: string;
         cert: string;
     },
-    DockerEngine.DockerError | ParseResult.ParseError,
+    DockerEngine.DockerError | Schema.SchemaError,
     MobyEndpoints.Containers
 > =>
     Effect.gen(function* () {
@@ -53,7 +56,7 @@ const downloadDindCertificates = (
                 HashSet.make("certs/server/ca.pem", "certs/server/key.pem", "certs/server/cert.pem")
             ),
             "MissingEntries",
-            () => Effect.dieMessage("Missing dind certificates in container")
+            () => Effect.die("Missing dind certificates in container")
         );
 
         const readAndAssemble = (
@@ -67,7 +70,7 @@ const downloadDindCertificates = (
             Function.flow(
                 HashMap.findFirst((_stream, header) => header.filename === path),
                 Option.getOrThrow,
-                Tuple.getSecond,
+                Tuple.get(1),
                 Stream.decodeText(),
                 Stream.mkString
             );
@@ -109,21 +112,18 @@ const makeDindBinds = <ExposeDindBy extends MobyConnection.MobyConnectionOptions
         const volume1 = yield* acquireScopedVolume;
         const volume2 = yield* acquireScopedVolume;
 
-        const tempSocketDirectory = yield* Effect.if(exposeDindBy === "socket", {
-            onFalse: () => Effect.succeed(""),
-            onTrue: () =>
-                Effect.gen(function* () {
-                    const fs = yield* FileSystem.FileSystem;
-                    const folder = yield* fs.makeTempDirectoryScoped();
-                    yield* fs.chmod(folder, 0o777); // Ew, for github actions where uid != 1000 🤮
-                    return folder;
-                }),
-        });
+        const tempSocketDirectory = yield* exposeDindBy === "socket"
+            ? Effect.gen(function* () {
+                  const fs = yield* FileSystem.FileSystem;
+                  const folder = yield* fs.makeTempDirectoryScoped();
+                  yield* fs.chmod(folder, 0o777); // Ew, for github actions where uid != 1000 🤮
+                  return folder;
+              })
+            : Effect.succeed("");
 
-        const boundDockerSocket = yield* Effect.if(exposeDindBy === "socket", {
-            onFalse: () => Effect.succeed(""),
-            onTrue: () => Effect.map(Path.Path, (path) => path.join(tempSocketDirectory, "docker.sock")),
-        });
+        const boundDockerSocket = yield* exposeDindBy === "socket"
+            ? Effect.map(Path.Path, (path) => path.join(tempSocketDirectory, "docker.sock"))
+            : Effect.succeed("");
 
         const mountBinds = exposeDindBy === "socket" ? [`${tempSocketDirectory}:/run/user/1000`] : [];
         const volumeBinds = Tuple.make(
@@ -150,7 +150,7 @@ const waitForDindContainerToBeReady = (
     dindContainerId: IdSchemas.ContainerIdentifier
 ): Effect.Effect<void, DockerEngine.DockerError, MobyEndpoints.Containers> =>
     Function.pipe(
-        MobyEndpoints.Containers.use((containers) =>
+        Effect.map(MobyEndpoints.Containers, (containers) =>
             containers.logs(dindContainerId, {
                 follow: true,
                 stdout: true,
@@ -173,10 +173,10 @@ export const makeDindLayerFromPlatformConstructor =
     <
         PlatformLayerConstructor extends (
             connectionOptions: any
-        ) => Layer.Layer<Layer.Layer.Success<DockerEngine.DockerLayer>, unknown, unknown>,
+        ) => Layer.Layer<Layer.Success<DockerEngine.DockerLayer>, unknown, unknown>,
         SupportedConnectionOptions extends MobyConnection.MobyConnectionOptions = PlatformLayerConstructor extends (
             connectionOptions: infer C
-        ) => Layer.Layer<Layer.Layer.Success<DockerEngine.DockerLayer>, infer _E, infer _R>
+        ) => Layer.Layer<Layer.Success<DockerEngine.DockerLayer>, infer _E, infer _R>
             ? C
             : never,
     >(
@@ -186,14 +186,14 @@ export const makeDindLayerFromPlatformConstructor =
         ConnectionOptionsToHost extends SupportedConnectionOptions,
         ConnectionOptionsToDind extends SupportedConnectionOptions["_tag"],
         PlatformLayerConstructorError = ReturnType<PlatformLayerConstructor> extends Layer.Layer<
-            Layer.Layer.Success<DockerEngine.DockerLayer>,
+            Layer.Success<DockerEngine.DockerLayer>,
             infer E,
             infer _R
         >
             ? E
             : never,
         PlatformLayerConstructorContext = ReturnType<PlatformLayerConstructor> extends Layer.Layer<
-            Layer.Layer.Success<DockerEngine.DockerLayer>,
+            Layer.Success<DockerEngine.DockerLayer>,
             infer _E,
             infer R
         >
@@ -204,9 +204,9 @@ export const makeDindLayerFromPlatformConstructor =
         connectionOptionsToHost: ConnectionOptionsToHost;
         dindBaseImage: BlobConstants.RecommendedDindBaseImages;
     }): Layer.Layer<
-        Layer.Layer.Success<DockerEngine.DockerLayer>,
+        Layer.Success<DockerEngine.DockerLayer>,
         | DockerEngine.DockerError
-        | ParseResult.ParseError
+        | Schema.SchemaError
         | PlatformLayerConstructorError
         | (ConnectionOptionsToDind extends "socket" ? PlatformError.PlatformError : never),
         | PlatformLayerConstructorContext
@@ -218,7 +218,7 @@ export const makeDindLayerFromPlatformConstructor =
             const platformLayerConstructorCasted = platformLayerConstructor as (
                 connectionOptions: SupportedConnectionOptions
             ) => Layer.Layer<
-                Layer.Layer.Success<DockerEngine.DockerLayer>,
+                Layer.Success<DockerEngine.DockerLayer>,
                 PlatformLayerConstructorError,
                 PlatformLayerConstructorContext
             >;
@@ -232,7 +232,7 @@ export const makeDindLayerFromPlatformConstructor =
             // Test that the host docker is reachable
             yield* Function.pipe(
                 DockerEngine.pingHead(),
-                Effect.retry(Schedule.recurs(5).pipe(Schedule.addDelay(() => "3 seconds"))),
+                Effect.retry(Schedule.recurs(5).pipe(Schedule.addDelay(() => Effect.succeed("3 seconds")))),
                 effectWithHostDocker
             );
 
@@ -257,6 +257,8 @@ export const makeDindLayerFromPlatformConstructor =
             );
 
             // Create the dind container
+            const zeroHostPort = yield* InternetSchemas.Port.makeEffect(0);
+            const zeroHostPortBinding = yield* PortSchemas.PortBinding.makeEffect({ HostPort: zeroHostPort });
             const containerInspectResponse = yield* effectWithHostDocker(
                 DockerEngine.runScoped({
                     Image: `the-moby-effect-${options.exposeDindContainerBy}-${dindTag}:latest`,
@@ -270,16 +272,16 @@ export const makeDindLayerFromPlatformConstructor =
                         Privileged: true,
                         Binds: binds,
                         PortBindings: {
-                            "22/tcp": [{ HostPort: InternetSchemas.Port.make(0) }],
-                            "2375/tcp": [{ HostPort: InternetSchemas.Port.make(0) }],
-                            "2376/tcp": [{ HostPort: InternetSchemas.Port.make(0) }],
+                            "22/tcp": [zeroHostPortBinding],
+                            "2375/tcp": [zeroHostPortBinding],
+                            "2376/tcp": [zeroHostPortBinding],
                         },
                     },
                 })
             );
 
             // Extract the ports from the container inspect response
-            const tryGetPort = Function.flow(Option.fromNullable<number | undefined>, Option.getOrThrow);
+            const tryGetPort = Function.flow(Option.fromNullishOr<number | undefined>, Option.getOrThrow);
             const sshPort = tryGetPort(containerInspectResponse.NetworkSettings?.Ports?.["22/tcp"]?.[0]?.HostPort);
             const httpPort = tryGetPort(containerInspectResponse.NetworkSettings?.Ports?.["2375/tcp"]?.[0]?.HostPort);
             const httpsPort = tryGetPort(containerInspectResponse.NetworkSettings?.Ports?.["2376/tcp"]?.[0]?.HostPort);
@@ -295,10 +297,9 @@ export const makeDindLayerFromPlatformConstructor =
             yield* effectWithHostDocker(waitForDindContainerToBeReady(containerInspectResponse.Id));
 
             // Get the engine certificates if we are exposing the dind container by https
-            const { ca, cert, key } = yield* Effect.if(options.exposeDindContainerBy === "https", {
-                onFalse: () => Effect.succeed({ ca: "", cert: "", key: "" } as const),
-                onTrue: () => effectWithHostDocker(downloadDindCertificates(containerInspectResponse.Id)),
-            });
+            const { ca, cert, key } = yield* options.exposeDindContainerBy === "https"
+                ? effectWithHostDocker(downloadDindCertificates(containerInspectResponse.Id))
+                : Effect.succeed({ ca: "", cert: "", key: "" } as const);
 
             // Craft the connection options
             const connectionOptions = Function.pipe(
@@ -341,9 +342,9 @@ export const makeDindLayerFromPlatformConstructor =
             // Test that the dind container is reachable
             yield* Function.pipe(
                 DockerEngine.pingHead(),
-                Effect.retry(Schedule.recurs(5).pipe(Schedule.addDelay(() => "3 seconds"))),
+                Effect.retry(Schedule.recurs(5).pipe(Schedule.addDelay(() => Effect.succeed("3 seconds")))),
                 Effect.provide(layer)
             );
 
             return layer;
-        }).pipe(Layer.unwrapScoped);
+        }).pipe(Layer.unwrap);

package/src/internal/engines/docker.ts

@@ -1,26 +1,25 @@
-import type * as Socket from "@effect/platform/Socket";
-import type * as EffectSchemas from "effect-schemas";
-import type * as ParseResult from "effect/ParseResult";
 import type * as Scope from "effect/Scope";
-import type * as DockerEngine from "../../DockerEngine.js";
-import type * as MobySchemas from "../../MobySchemas.js";
-import type * as IdSchemas from "../schemas/id.js";
 
 import * as Array from "effect/Array";
 import * as Channel from "effect/Channel";
 import * as Effect from "effect/Effect";
 import * as Function from "effect/Function";
-import * as Global from "effect/GlobalValue";
 import * as MutableHashMap from "effect/MutableHashMap";
 import * as Option from "effect/Option";
 import * as Predicate from "effect/Predicate";
 import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
 import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
 import * as Tuple from "effect/Tuple";
+import * as Socket from "effect/unstable/socket/Socket";
+
+import type * as DockerEngine from "../../DockerEngine.js";
+import type * as MobySchemas from "../../MobySchemas.js";
+import type * as IdSchemas from "../schemas/id.js";
+
 import * as MobyDemux from "../../MobyDemux.js";
 import * as MobyEndpoints from "../../MobyEndpoints.js";
-
 import * as internalCircular from "../endpoints/circular.js";
 
 /** @internal */
@@ -31,7 +30,14 @@ export const pull = ({
     image: string;
     platform?: string | undefined;
 }): Stream.Stream<MobySchemas.JSONMessage, DockerEngine.DockerError, MobyEndpoints.Images> =>
-    Stream.unwrap(MobyEndpoints.Images.use((images) => images.create({ fromImage: image, platform })));
+    Stream.unwrap(
+        Effect.map(MobyEndpoints.Images, (images) =>
+            images.create({
+                fromImage: image,
+                platform,
+            })
+        )
+    );
 
 /** @internal */
 export const pullScoped = ({
@@ -73,7 +79,14 @@ export const build = <E1>({
     buildargs?: Record<string, string | undefined> | undefined;
 }): Stream.Stream<MobySchemas.JSONMessage, DockerEngine.DockerError, MobyEndpoints.Images> =>
     Stream.unwrap(
-        MobyEndpoints.Images.use((images) => images.build(context, { buildargs, dockerfile, platform, t: tag }))
+        Effect.map(MobyEndpoints.Images, (images) =>
+            images.build(context, {
+                buildargs,
+                dockerfile,
+                platform,
+                t: tag,
+            })
+        )
     );
 
 /** @internal */
@@ -121,10 +134,10 @@ export const stop = (
 
 /** @internal */
 export const run = (
-    options: Omit<ConstructorParameters<typeof MobySchemas.ContainerCreateRequest>[0], "HostConfig"> & {
+    options: Omit<(typeof MobySchemas.ContainerCreateRequest)["~type.make.in"], "HostConfig"> & {
         readonly name?: string | undefined;
         readonly platform?: string | undefined;
-        readonly HostConfig?: ConstructorParameters<typeof MobySchemas.ContainerHostConfig>[0] | undefined;
+        readonly HostConfig?: (typeof MobySchemas.ContainerHostConfig)["~type.make.in"] | undefined;
     }
 ): Effect.Effect<MobySchemas.ContainerInspectResponse, DockerEngine.DockerError, MobyEndpoints.Containers> =>
     Effect.gen(function* () {
@@ -137,10 +150,10 @@ export const run = (
 
 /** @internal */
 export const runScoped = (
-    options: Omit<ConstructorParameters<typeof MobySchemas.ContainerCreateRequest>[0], "HostConfig"> & {
+    options: Omit<(typeof MobySchemas.ContainerCreateRequest)["~type.make.in"], "HostConfig"> & {
         readonly name?: string | undefined;
         readonly platform?: string | undefined;
-        readonly HostConfig?: ConstructorParameters<typeof MobySchemas.ContainerHostConfig>[0] | undefined;
+        readonly HostConfig?: (typeof MobySchemas.ContainerHostConfig)["~type.make.in"] | undefined;
     }
 ): Effect.Effect<
     MobySchemas.ContainerInspectResponse,
@@ -151,15 +164,14 @@ export const runScoped = (
         MobyEndpoints.Containers.use((containers) => containers.create(options)),
         ({ Id }) => Id
     );
+
     const release = (containerId: IdSchemas.ContainerIdentifier) =>
         Effect.orDie(MobyEndpoints.Containers.use((containers) => containers.delete(containerId, { force: true })));
-    return Effect.acquireRelease(acquire, release)
-        .pipe(Effect.tap((containerId) => start(containerId)))
-        .pipe(
-            Effect.flatMap((containerId) =>
-                MobyEndpoints.Containers.use((containers) => containers.inspect(containerId))
-            )
-        );
+
+    return Effect.acquireRelease(acquire, release).pipe(
+        Effect.tap((containerId) => start(containerId)),
+        Effect.flatMap((containerId) => MobyEndpoints.Containers.use((containers) => containers.inspect(containerId)))
+    );
 };
 
 /** @internal */
@@ -182,6 +194,7 @@ export const execNonBlocking = <const T extends boolean = false>({
             AttachStdin: true,
             AttachStderr: true,
             AttachStdout: true,
+            Detach: false,
             Cmd: Predicate.isString(command) ? command.split(" ") : command,
         });
 
@@ -197,24 +210,52 @@ export const exec = ({
     containerId: IdSchemas.ContainerIdentifier;
     command: string | Array<string>;
 }): Effect.Effect<
-    [exitCode: Schema.Schema.Type<EffectSchemas.Number.I64>, output: string],
-    DockerEngine.DockerError | ParseResult.ParseError | Socket.SocketError,
+    [exitCode: bigint, output: string],
+    DockerEngine.DockerError | Schema.SchemaError | Socket.SocketError,
     MobyEndpoints.Execs
 > =>
     Effect.gen(function* () {
         const [socket, execId] = yield* execNonBlocking({ command, containerId, detach: false });
-        const output = yield* MobyDemux.demuxToSingleSink(socket, Stream.never, Sink.mkString);
+        const output = yield* MobyDemux.demuxToSingleSink(
+            socket,
+            Stream.never,
+            Sink.reduce(
+                () => "",
+                (acc, chunk) => acc + chunk
+            )
+        );
+
         const execInspectResponse = yield* MobyEndpoints.Execs.use((execs) => execs.inspect(execId));
-        if (execInspectResponse.Running === true) return yield* Effect.dieMessage("Exec is still running");
+        if (execInspectResponse.Running === true) return yield* Effect.die("Exec is still running");
         else return Tuple.make(execInspectResponse.ExitCode, output);
     });
 
-/** @internal */
-const execWebsocketsRegistry = Global.globalValue("the-moby-effect/engines/docker/execWebsocketsRegistry", () =>
-    MutableHashMap.empty<string, Effect.Semaphore>()
-);
+/**
+ * Serializes websocket execs per container. Attach websockets talk to the
+ * container's single stdio (there is no exec-create over websockets), so
+ * concurrent execs against the same container would interleave their input
+ * and output. Entries are reference counted and evicted once the last
+ * in-flight exec for a container releases.
+ *
+ * @internal
+ */
+const execWebsocketsRegistry = MutableHashMap.empty<
+    string,
+    { readonly semaphore: Semaphore.Semaphore; pending: number }
+>();
 
-/** @internal */
+/**
+ * Runs a command in a container by typing it into the container's own
+ * stdin-attached shell over attach websockets - the websocket transport has
+ * no exec-create endpoint, attach only talks to the container's main process.
+ * This shapes everything unusual about this function: the container's
+ * entrypoint must be a known shell (the command text is fed to it on stdin),
+ * the command is suffixed with `; exit` so the shell terminates and the
+ * daemon flushes and closes the attach streams, and afterwards the container
+ * is restarted to return it to a usable state for subsequent execs.
+ *
+ * @internal
+ */
 export const execWebsocketsNonBlocking = ({
     command,
     containerId,
@@ -231,22 +272,15 @@ export const execWebsocketsNonBlocking = ({
     Effect.gen(function* () {
         const containers = yield* MobyEndpoints.Containers;
 
-        const mutex = MutableHashMap.get(execWebsocketsRegistry, containerId).pipe(
-            Option.getOrElse(() => {
-                const semaphore = Effect.unsafeMakeSemaphore(1);
-                MutableHashMap.set(execWebsocketsRegistry, containerId, semaphore);
-                return semaphore;
-            })
-        );
-
         const acquire = Effect.gen(function* () {
             const inspect = yield* containers.inspect(containerId);
             const command = inspect.Config?.Cmd;
-            const entrypoint = Option.fromNullable(inspect.Config?.Entrypoint)
-                .pipe(Option.flatMap(Array.head))
-                .pipe(Option.getOrUndefined);
+            const entrypoint = Option.fromNullishOr(inspect.Config?.Entrypoint).pipe(
+                Option.flatMap(Array.head),
+                Option.getOrUndefined
+            );
 
-            yield* Schema.decodeUnknown(Schema.Union(Schema.Undefined, Schema.Null))(command).pipe(
+            yield* Schema.decodeUnknownEffect(Schema.Union([Schema.Undefined, Schema.Null]))(command).pipe(
                 Effect.mapError(
                     (cause) =>
                         new internalCircular.DockerError({
@@ -256,8 +290,8 @@ export const execWebsocketsNonBlocking = ({
                         })
                 )
             );
-            yield* Schema.decodeUnknown(
-                Schema.Literal(
+            yield* Schema.decodeUnknownEffect(
+                Schema.Literals([
                     "/bin/sh", // Basic shell available in most containers
                     "/bin/bash", // Bash shell (common in many Linux distributions)
                     "/usr/bin/bash", // Alternative location for bash
@@ -271,8 +305,8 @@ export const execWebsocketsNonBlocking = ({
                     "/usr/bin/fish", // Friendly interactive shell
                     "/usr/local/bin/bash", // Alternative location for bash
                     "/usr/local/bin/sh", // Alternative location for sh
-                    "/busybox/sh" // Busybox shell
-                )
+                    "/busybox/sh", // Busybox shell
+                ])
             )(entrypoint).pipe(
                 Effect.mapError(
                     (cause) =>
@@ -283,35 +317,78 @@ export const execWebsocketsNonBlocking = ({
                         })
                 )
             );
-            yield* mutex.take(1);
+
+            // The registry lookup, insert, and reference count increment must
+            // stay in one synchronous step so concurrent execs cannot observe
+            // a half-registered entry. The increment happens only after the
+            // validations above so a failed acquire never leaks a reference.
+            const entry = MutableHashMap.get(execWebsocketsRegistry, containerId).pipe(
+                Option.getOrElse(() => {
+                    const fresh = { semaphore: Semaphore.makeUnsafe(1), pending: 0 };
+                    MutableHashMap.set(execWebsocketsRegistry, containerId, fresh);
+                    return fresh;
+                })
+            );
+
+            entry.pending += 1;
+            yield* entry.semaphore.take(1);
+            return entry;
         });
 
         // TODO: should this be un-interuptible?
-        const release = Effect.fnUntraced(function* () {
-            yield* mutex.release(1);
-            yield* containers.wait(containerId, { condition: "not-running" });
-            yield* containers.start(containerId);
-        }, Effect.orDie);
+        const release = (entry: { readonly semaphore: Semaphore.Semaphore; pending: number }) =>
+            entry.semaphore.release(1).pipe(
+                Effect.andThen(containers.wait(containerId, { condition: "not-running" })),
+                Effect.andThen(containers.start(containerId)),
+                Effect.orDie,
+                Effect.ensuring(
+                    Effect.sync(() => {
+                        entry.pending -= 1;
+                        if (entry.pending === 0) {
+                            MutableHashMap.remove(execWebsocketsRegistry, containerId);
+                        }
+                    })
+                )
+            );
 
         const use = Effect.gen(function* () {
             const cmd = Predicate.isString(command) ? command : Array.join(command, " ");
             const cwdCommand = Predicate.isUndefined(cwd) ? cmd : `cd ${cwd} && ${cmd}`;
-            const input = Stream.succeed(`${cwdCommand}; exit\n`);
-            const stdinSocket = yield* containers.attachWebsocket(containerId, { stdin: true, stream: true });
+
+            // The attaches connect eagerly, so ordering here is meaningful:
+            // attach the output sockets before either stdin socket so no
+            // output can be produced (and discarded by the daemon) before the
+            // output attaches are complete. The command gets its own attach
+            // because every raw socket is a single-use connection.
             const stdoutSocket = yield* containers.attachWebsocket(containerId, { stdout: true, stream: true });
             const stderrSocket = yield* containers.attachWebsocket(containerId, { stderr: true, stream: true });
+            const stdinSocket = yield* containers.attachWebsocket(containerId, { stdin: true, stream: true });
+            const commandSocket = yield* containers.attachWebsocket(containerId, { stdin: true, stream: true });
+
             const sockets = { stdin: stdinSocket, stdout: stdoutSocket, stderr: stderrSocket } as const;
             const multiplexedSocket = yield* MobyDemux.pack(sockets, { requestedCapacity: 16 });
-            const producer = Channel.fromEffect(MobyDemux.demuxRawToSingleSink(stdinSocket, input, Sink.drain));
-            const consumer = multiplexedSocket.underlying;
-            const zipped = Channel.zipLeft(producer, consumer, { concurrent: true });
-            return zipped;
+
+            // Write the command and half-close its attach BEFORE exposing the
+            // channel. The command and any downstream input travel on separate
+            // attaches that the daemon merges into the container's stdin, so
+            // writing concurrently would let a fast consumer's input reach the
+            // shell before the command does (observed hanging the exec under
+            // ci load). Completing the write first makes the ordering
+            // structural instead of a race.
+            const input = Stream.make<[string, Socket.CloseEvent]>(
+                `${cwdCommand}; exit\n`,
+                new Socket.CloseEvent(1000, "command written")
+            );
+            yield* MobyDemux.demuxRawToSingleSink(commandSocket, input, Sink.drain);
+
+            return multiplexedSocket.underlying;
         });
 
-        const multiplexedChannel = Effect.acquireRelease(acquire, release)
-            .pipe(Effect.map(() => Channel.unwrap(use)))
-            .pipe(Channel.unwrapScoped)
-            .pipe(Channel.provideService(MobyEndpoints.Containers, containers));
+        const multiplexedChannel = Effect.acquireRelease(acquire, release).pipe(
+            Effect.map(() => Channel.unwrap(use)),
+            Channel.unwrap,
+            Channel.provideService(MobyEndpoints.Containers, containers)
+        );
 
         return MobyDemux.makeMultiplexedChannel(multiplexedChannel);
     });
@@ -325,36 +402,48 @@ export const execWebsockets = ({
     containerId: IdSchemas.ContainerIdentifier;
 }): Effect.Effect<
     readonly [stdout: string, stderr: string],
-    DockerEngine.DockerError | ParseResult.ParseError | Socket.SocketError,
+    DockerEngine.DockerError | Schema.SchemaError | Socket.SocketError,
     MobyEndpoints.Containers
 > =>
     Function.pipe(
         execWebsocketsNonBlocking({ command, containerId }),
-        Effect.flatMap(MobyDemux.demuxMultiplexedToSeparateSinks(Stream.empty, Sink.mkString, Sink.mkString))
+        Effect.flatMap(
+            MobyDemux.demuxMultiplexedToSeparateSinks(
+                Stream.empty,
+                Sink.reduce(
+                    () => "",
+                    (acc, chunk) => acc + chunk
+                ),
+                Sink.reduce(
+                    () => "",
+                    (acc, chunk) => acc + chunk
+                )
+            )
+        )
     );
 
 /** @internal */
 export const ps = (
-    options?: Parameters<MobyEndpoints.Containers["list"]>[0]
+    options?: Parameters<MobyEndpoints.Containers["Service"]["list"]>[0]
 ): Effect.Effect<ReadonlyArray<MobySchemas.ContainerSummary>, DockerEngine.DockerError, MobyEndpoints.Containers> =>
     MobyEndpoints.Containers.use((containers) => containers.list(options));
 
 /** @internal */
 export const push = (
     name: string,
-    options?: Parameters<MobyEndpoints.Images["push"]>[1]
+    options?: Parameters<MobyEndpoints.Images["Service"]["push"]>[1]
 ): Stream.Stream<MobySchemas.JSONMessage, DockerEngine.DockerError, MobyEndpoints.Images> =>
-    Stream.unwrap(MobyEndpoints.Images.use((images) => images.push(name, options)));
+    Stream.unwrap(Effect.map(MobyEndpoints.Images, (images) => images.push(name, options)));
 
 /** @internal */
 export const images = (
-    options?: Parameters<MobyEndpoints.Images["list"]>[0]
+    options?: Parameters<MobyEndpoints.Images["Service"]["list"]>[0]
 ): Effect.Effect<ReadonlyArray<MobySchemas.ImageSummary>, DockerEngine.DockerError, MobyEndpoints.Images> =>
     MobyEndpoints.Images.use((images) => images.list(options));
 
 /** @internal */
 export const search = (
-    options: Parameters<MobyEndpoints.Images["search"]>[0]
+    options: Parameters<MobyEndpoints.Images["Service"]["search"]>[0]
 ): Effect.Effect<ReadonlyArray<MobySchemas.RegistrySearchResult>, DockerEngine.DockerError, MobyEndpoints.Images> =>
     MobyEndpoints.Images.use((images) => images.search(options));