Skip to content

feat: auto-detect container runtime, promote Apple container as default - #114

Closed
hermclaw wants to merge 2 commits into
boldblackai:mainfrom
hermclaw:feat/auto-detect-container-runtime
Closed

feat: auto-detect container runtime, promote Apple container as default#114
hermclaw wants to merge 2 commits into
boldblackai:mainfrom
hermclaw:feat/auto-detect-container-runtime

Conversation

@hermclaw

@hermclaw hermclaw commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Summary

Promotes Apple's container CLI as the default container runtime when available. Removes the need for HARNESS_CONTAINER_RUNTIME=apple — harness now auto-detects whether container is on PATH and prefers it over docker. The apple value is no longer accepted; use HARNESS_CONTAINER_RUNTIME=docker to force docker.

What changed

src/harness.ts

  • selectRuntime() now auto-detects: checks if container binary is on PATH via whichSync(), prefers it, falls back to docker
  • HARNESS_CONTAINER_RUNTIME=docker forces docker; auto (or unset) triggers auto-detection
  • HARNESS_CONTAINER_RUNTIME=apple is no longer a valid value
  • Updated AppleContainerRuntime.ensureReady() error message to remove HARNESS_CONTAINER_RUNTIME=apple references
  • Added whichSync() — synchronous which/where cross-platform PATH lookup

Tests

  • Rewrote runtime selection tests to verify auto-detection behavior (PATH-based)
  • Added runtimeArgsAny() helper to helpers.mjs for runtime-agnostic test assertions
  • Updated all non-runtime-specific tests across 4 test files to use runtimeArgsAny() instead of dockerArgs()
  • Only the docker-specific hardening flags test forces docker via env var

Docs

  • README, AGENTS.md, USAGE help text, CHANGELOG all updated

Test plan

Check Status
All 112 e2e tests pass
Build passes (pnpm build)
Lint passes (biome + markdownlint)
CI passes on PR

hermclaw and others added 2 commits June 23, 2026 11:50
- Remove HARNESS_CONTAINER_RUNTIME=apple; instead auto-detect whether
  Apple's container CLI is on PATH, preferring it over docker
- Add whichSync() helper for synchronous PATH lookup
- HARNESS_CONTAINER_RUNTIME=docker still supported to force docker
- Accept 'auto' as explicit no-op value (same as unset)
- Update error messages, USAGE help text, README, AGENTS.md, CHANGELOG
- Update all e2e tests to use runtime-agnostic assertions via
  runtimeArgsAny() helper; only docker-specific tests force docker
  via HARNESS_CONTAINER_RUNTIME=docker
…macOS

Review feedback on the auto-detect change:

- HARNESS_CONTAINER_RUNTIME=apple no longer hard-fails. It is now a
  deprecated explicit alias: still selects the apple runtime, prints a
  one-time deprecation warning, so existing dotfiles keep working across
  the upgrade.
- Auto-detection is gated to process.platform === "darwin". apple/container
  ships for macOS only, so a binary named `container` on a Linux PATH is an
  unrelated tool that must not hijack runtime selection; docker stays the
  default everywhere else.
- ensureReady() error message no longer assumes the auto-detected path.
- Tests: apple-argv tests pin =apple explicitly (deterministic on all
  platforms), new tests for the deprecation alias and the non-macOS
  PATH-collision guard.
- Docs: README/AGENTS.md/CHANGELOG updated; CHANGELOG #TBD replaced with
  boldblackai#114; RFC amended with a superseding note.
@capotej

capotej commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Superseded by #179 — same change rebased onto current main (this branch's fork permissions blocked pushing the rebase), plus two review fixes: HARNESS_CONTAINER_RUNTIME=apple kept as a deprecated alias instead of hard-failing, and auto-detection gated to macOS so an unrelated container binary on a Linux PATH can't hijack runtime selection. Closing in favor of #179.

@capotej capotej closed this Sep 2, 2026
capotej added a commit that referenced this pull request Sep 2, 2026
- Replace the whichSync PATH pre-check with appleContainerAvailable(), which
  reuses the same `container --version` exec probe ensureReady() runs.
  Strictly stronger evidence: proves the binary executes (broken install,
  quarantine attribute, wrong-arch build all fail), which is what selection
  depends on. Deletes whichSync entirely, including its dead win32 branch.
  The probe runs once more in ensureReady() right after — accepted cost,
  bounded by the same 5s timeout.
- docker-only auto-detect test: filter container-containing dirs out of PATH
  instead of merely prepending the docker shim dir, so the test's premise
  holds on macOS dev machines with the real container CLI installed.
- README: drop 'one-time' from the =apple deprecation warning description.
- RFC amendment header: reference both #114 (draft) and #179 (landed).
capotej added a commit that referenced this pull request Sep 2, 2026
…lt (#179)

* feat: auto-detect container runtime, promote Apple container as default

- Remove HARNESS_CONTAINER_RUNTIME=apple; instead auto-detect whether
  Apple's container CLI is on PATH, preferring it over docker
- Add whichSync() helper for synchronous PATH lookup
- HARNESS_CONTAINER_RUNTIME=docker still supported to force docker
- Accept 'auto' as explicit no-op value (same as unset)
- Update error messages, USAGE help text, README, AGENTS.md, CHANGELOG
- Update all e2e tests to use runtime-agnostic assertions via
  runtimeArgsAny() helper; only docker-specific tests force docker
  via HARNESS_CONTAINER_RUNTIME=docker

* fix: keep =apple as deprecated alias and gate runtime auto-detect to macOS

Review feedback on the auto-detect change:

- HARNESS_CONTAINER_RUNTIME=apple no longer hard-fails. It is now a
  deprecated explicit alias: still selects the apple runtime, prints a
  one-time deprecation warning, so existing dotfiles keep working across
  the upgrade.
- Auto-detection is gated to process.platform === "darwin". apple/container
  ships for macOS only, so a binary named `container` on a Linux PATH is an
  unrelated tool that must not hijack runtime selection; docker stays the
  default everywhere else.
- ensureReady() error message no longer assumes the auto-detected path.
- Tests: apple-argv tests pin =apple explicitly (deterministic on all
  platforms), new tests for the deprecation alias and the non-macOS
  PATH-collision guard.
- Docs: README/AGENTS.md/CHANGELOG updated; CHANGELOG #TBD replaced with
  #114; RFC amended with a superseding note.

* refactor: address review feedback on runtime auto-detection

- Replace the whichSync PATH pre-check with appleContainerAvailable(), which
  reuses the same `container --version` exec probe ensureReady() runs.
  Strictly stronger evidence: proves the binary executes (broken install,
  quarantine attribute, wrong-arch build all fail), which is what selection
  depends on. Deletes whichSync entirely, including its dead win32 branch.
  The probe runs once more in ensureReady() right after — accepted cost,
  bounded by the same 5s timeout.
- docker-only auto-detect test: filter container-containing dirs out of PATH
  instead of merely prepending the docker shim dir, so the test's premise
  holds on macOS dev machines with the real container CLI installed.
- README: drop 'one-time' from the =apple deprecation warning description.
- RFC amendment header: reference both #114 (draft) and #179 (landed).

* perf: memoize the container --version probe for the process lifetime

selectRuntime() and AppleContainerRuntime.ensureReady() both needed the
same `container --version` evidence; appleContainerAvailable() now caches
its result in a module-level memo so the exec runs once per process.
ensureReady() consumes the memo instead of re-probing. The cache lives
only for the process lifetime — never persisted — since the CLI's install
state can change between harness invocations.

---------

Co-authored-by: hermclaw <279150486+hermclaw@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants