fix(shell): make isolated controller fallback self-contained

Author: skulidropek

docker-compose.api.isolated.yml

@@ -1,5 +1,6 @@
 services:
   api:
+    privileged: ${DOCKER_GIT_CONTROLLER_PRIVILEGED:-true}
     environment:
       DOCKER_GIT_PROJECT_DOCKER_HOST: ${DOCKER_GIT_PROJECT_DOCKER_HOST:-tcp://host.docker.internal:2375}
     volumes: !override

docker-compose.isolated.yml

@@ -1,5 +1,6 @@
 services:
   api:
+    privileged: ${DOCKER_GIT_CONTROLLER_PRIVILEGED:-true}
     environment:
       DOCKER_GIT_PROJECT_DOCKER_HOST: ${DOCKER_GIT_PROJECT_DOCKER_HOST:-tcp://host.docker.internal:2375}
     volumes: !override

packages/api/README.md

@@ -81,7 +81,7 @@ Optional env:
 - `DOCKER_GIT_API_PORT` (default: `3334`)
 - `DOCKER_GIT_DOCKER_RUNTIME` (default: `host`; set to `isolated` as an optional fallback to use an embedded controller daemon)
 - `DOCKER_GIT_CONTROLLER_DOCKER_HOST` (default: `unix:///var/run/docker.sock`; socket path inside the controller)
-- `DOCKER_GIT_CONTROLLER_PRIVILEGED` (default: `false`; set to `true` only when using `DOCKER_GIT_DOCKER_RUNTIME=isolated`)
+- `DOCKER_GIT_CONTROLLER_PRIVILEGED` (default: `false` in host mode; isolated overlays default it to `true` for the embedded Docker daemon)
 - `DOCKER_GIT_DOCKERD_TCP_HOST` (default: `tcp://0.0.0.0:2375`; reachable only inside Docker networks unless explicitly published)
 - `DOCKER_GIT_DOCKERD_DEFAULT_CGROUPNS_MODE` (default: `host`; keeps nested project containers compatible with cgroup v2 DinD)
 - `DOCKER_GIT_PROJECT_DOCKER_HOST` (default: empty in host mode; isolated mode defaults to `tcp://host.docker.internal:2375`)

packages/app/tests/docker-git/controller-resource-limits.test.ts

@@ -69,6 +69,12 @@ describe("controller compose resource limits", () => {
             "DOCKER_GIT_PROJECT_DOCKER_HOST: ${DOCKER_GIT_PROJECT_DOCKER_HOST:-tcp://host.docker.internal:2375}"
           )
         }))
+
+      it.effect("enables privileged controller mode for the embedded Docker daemon", () =>
+        Effect.gen(function*(_) {
+          const contents = yield* _(readComposeFile(composeFile))
+          expect(contents).toContain("privileged: ${DOCKER_GIT_CONTROLLER_PRIVILEGED:-true}")
+        }))
     })
   }
 })

scripts/e2e/_lib.sh

@@ -417,7 +417,31 @@ dg_project_ssh_to_container() {
   shift 2
 
   if ! dg_has_project_docker_access; then
-    "$local_ssh_command" "$@"
+    local local_ssh_exit=0
+    if "$local_ssh_command" "$@"; then
+      return 0
+    else
+      local_ssh_exit=$?
+    fi
+
+    if [[ "$local_ssh_exit" != "255" ]]; then
+      return "$local_ssh_exit"
+    fi
+
+    local local_container_ip
+    local_container_ip="$(dg_project_container_ip "$container")"
+    if [[ -z "$local_container_ip" ]]; then
+      return "$local_ssh_exit"
+    fi
+
+    local local_identity_arg=""
+    local_identity_arg="$(dg_find_ssh_identity_arg "$@" || true)"
+    local local_rewritten=()
+    while IFS= read -r -d '' arg; do
+      local_rewritten+=("$arg")
+    done < <(dg_rewrite_ssh_args_for_project_container "$local_container_ip" "$local_identity_arg" "$@")
+
+    "$local_ssh_command" "${local_rewritten[@]}"
     return
   fi