feat!: release v2 (#6545)

Co-authored-by: Artur <145776561+arturict@users.noreply.github.com>
Co-authored-by: arturict <arturict@users.noreply.github.com>
Co-authored-by: Thomas <thomas@ajnart.fr>
Co-authored-by: Afonso Jorge Ramos <afonsojorgeramos@gmail.com>
Co-authored-by: Danura30082 <danura30082+github@gmail.com>
Co-authored-by: Kushie <122986913+kushiemoon-dev@users.noreply.github.com>
Co-authored-by: ajnart <thomas@ajnart.fr>
Co-authored-by: ajnart <thomas@ajnart.dev>
Co-authored-by: chenjun <chenjun@foxmail.com>
Co-authored-by: Wikibear <wikibear@users.noreply.github.com>
Co-authored-by: Bergasha <bergasha@gmail.com>
Co-authored-by: leafyelin <43306196+leafyelin@users.noreply.github.com>
Co-authored-by: Lucas Araujo <lucas.lra@gmail.com>
Co-authored-by: GreenMonito <86085570+GreenMonito@users.noreply.github.com>
Co-authored-by: Nerdy-Technician <roffo@nerdy-technician.social>
Co-authored-by: Jun <34545896+jcstrong@users.noreply.github.com>
Co-authored-by: Edmond Abraham <54119952+gitedmond@users.noreply.github.com>
Co-authored-by: thrawnx <tight.bulb9384@fastmail.com>
Co-authored-by: Chris <58918656+nordada@users.noreply.github.com>
Co-authored-by: yi111 <153097222+Yi-111-a@users.noreply.github.com>
Co-authored-by: Yanis <naamaneyanis@gmail.com>
Co-authored-by: Wikibear <me@sej.de>
Co-authored-by: alessiottavo <93441886+alessiottavo@users.noreply.github.com>

packages/docker/src/test/endpoint-descriptor.spec.ts

@@ -0,0 +1,71 @@
+import { describe, expect, test } from "vitest";
+
+import { parseDockerEndpointDescriptors } from "../endpoint-descriptor";
+
+describe("parseDockerEndpointDescriptors", () => {
+  test("parses friendly TLS and read-only Podman endpoints", () => {
+    const descriptors = parseDockerEndpointDescriptors(
+      JSON.stringify([
+        {
+          id: "nas",
+          name: "NAS Docker",
+          transport: { type: "tls", host: "nas.internal", port: 2376, caPath: "/run/secrets/docker-ca" },
+        },
+        {
+          id: "podman",
+          name: "Build host",
+          kind: "podman",
+          transport: { type: "socket", path: "/run/podman/podman.sock" },
+          capabilities: ["inventory", "logs"],
+        },
+      ]),
+    );
+
+    expect(descriptors).toEqual([
+      expect.objectContaining({ id: "nas", name: "NAS Docker", kind: "docker", source: "environment" }),
+      expect.objectContaining({ id: "podman", kind: "podman", capabilities: ["inventory", "logs"] }),
+    ]);
+  });
+
+  test("requires an explicit opt-in for plaintext TCP", () => {
+    expect(() =>
+      parseDockerEndpointDescriptors(
+        JSON.stringify([{ id: "nas", name: "NAS", transport: { type: "tcp", host: "nas", port: 2375 } }]),
+      ),
+    ).toThrow("allowInsecure: true");
+  });
+
+  test("rejects duplicate identities and capabilities without inventory", () => {
+    expect(() =>
+      parseDockerEndpointDescriptors(
+        JSON.stringify([
+          { id: "same", name: "A", transport: { type: "socket", path: "/a" } },
+          { id: "same", name: "B", transport: { type: "socket", path: "/b" } },
+        ]),
+      ),
+    ).toThrow("ids must be unique");
+    expect(() =>
+      parseDockerEndpointDescriptors(
+        JSON.stringify([
+          {
+            id: "limited",
+            name: "Limited",
+            transport: { type: "socket", path: "/run/docker.sock" },
+            capabilities: ["logs"],
+          },
+        ]),
+      ),
+    ).toThrow("must include inventory");
+  });
+
+  test("returns independent default capability arrays", () => {
+    const [first, second] = parseDockerEndpointDescriptors(
+      JSON.stringify([
+        { id: "first", name: "First", transport: { type: "socket", path: "/first.sock" } },
+        { id: "second", name: "Second", transport: { type: "socket", path: "/second.sock" } },
+      ]),
+    );
+
+    expect(first?.capabilities).not.toBe(second?.capabilities);
+  });
+});

packages/docker/src/test/singleton.spec.ts

@@ -6,6 +6,7 @@ const mockEnv = vi.hoisted(() => ({
   DOCKER_SOCKET_PATHS: undefined as string | undefined,
   DOCKER_HOSTNAMES: undefined as string | undefined,
   DOCKER_PORTS: undefined as string | undefined,
+  DOCKER_ENDPOINTS: undefined as string | undefined,
   ENABLE_DOCKER: true,
   ENABLE_KUBERNETES: false,
 }));
@@ -32,13 +33,17 @@ describe("DockerSingleton", () => {
     mockEnv.DOCKER_SOCKET_PATHS = undefined;
     mockEnv.DOCKER_HOSTNAMES = undefined;
     mockEnv.DOCKER_PORTS = undefined;
+    mockEnv.DOCKER_ENDPOINTS = undefined;
   });
 
   test("should return default socket when no env vars set", () => {
     const instances = DockerSingleton.getInstances();
 
     expect(instances).toHaveLength(1);
-    expect(instances[0]?.host).toBe("socket");
+    expect(instances[0]?.host).toBe("/var/run/docker.sock");
+    expect(instances[0]).toMatchObject({ endpointId: "socket:default", endpointName: "Local Docker" });
+    const options = (instances[0]?.instance as unknown as { opts: { socketPath: string } } | undefined)?.opts;
+    expect(options?.socketPath).toBe("/var/run/docker.sock");
   });
 
   test("should return TCP instances only when DOCKER_HOSTNAMES and DOCKER_PORTS set", () => {
@@ -60,6 +65,7 @@ describe("DockerSingleton", () => {
     expect(instances).toHaveLength(2);
     expect(instances[0]?.host).toBe("host1:2375");
     expect(instances[1]?.host).toBe("host2:2376");
+    expect(instances.map(({ endpointId }) => endpointId)).toEqual(["tcp:host1:2375", "tcp:host2:2376"]);
   });
 
   test("should throw when hostname and port counts do not match", () => {
@@ -86,6 +92,7 @@ describe("DockerSingleton", () => {
     expect(instances).toHaveLength(2);
     expect(instances[0]?.host).toBe("/var/run/docker.sock");
     expect(instances[1]?.host).toBe("/run/user/1000/podman/podman.sock");
+    expect(DockerSingleton.findInstance("socket:/run/user/1000/podman/podman.sock")).toBe(instances[1]);
   });
 
   test("should combine socket and TCP instances", () => {
@@ -107,4 +114,39 @@ describe("DockerSingleton", () => {
 
     expect(first).toBe(second);
   });
+
+  test("uses the structured endpoint descriptor and exposes scoped capabilities", () => {
+    mockEnv.DOCKER_ENDPOINTS = JSON.stringify([
+      {
+        id: "readonly-podman",
+        name: "Read-only Podman",
+        kind: "podman",
+        transport: { type: "socket", path: "/run/podman/podman.sock" },
+        capabilities: ["inventory", "logs"],
+      },
+    ]);
+
+    const [endpoint] = DockerSingleton.getInstances();
+
+    expect(endpoint).toMatchObject({ endpointId: "readonly-podman", endpointName: "Read-only Podman" });
+    expect(endpoint?.descriptor).toMatchObject({ kind: "podman", source: "environment" });
+    expect(DockerSingleton.hasCapability("readonly-podman", "logs")).toBe(true);
+    expect(DockerSingleton.hasCapability("readonly-podman", "remove")).toBe(false);
+  });
+
+  test("isolates an unreadable TLS endpoint from healthy endpoints", () => {
+    mockEnv.DOCKER_ENDPOINTS = JSON.stringify([
+      { id: "local", name: "Local", transport: { type: "socket", path: "/var/run/docker.sock" } },
+      {
+        id: "broken-tls",
+        name: "Broken TLS",
+        transport: { type: "tls", host: "broken.example", port: 2376, caPath: "/missing/docker-ca.pem" },
+      },
+    ]);
+
+    expect(DockerSingleton.getInstances().map(({ endpointId }) => endpointId)).toEqual(["local"]);
+    expect(DockerSingleton.getInitializationFailures()).toEqual([
+      expect.objectContaining({ descriptor: expect.objectContaining({ id: "broken-tls" }) }),
+    ]);
+  });
 });