`deno task check` and the unit tests cannot see the defects that matter most
in the docker module — a progress bar that walks backwards, a spinner that
never stops, a compose file rewritten wrongly. Those need a real engine, real
compose files and a real pull.

This is one privileged throwaway container running its own dockerd, with
OpsDeck nested inside it using the production mounts. The nesting is the
point: only then does `chroot /host/root` land somewhere that is not our own
mount namespace, and only then is the compose path taken at all — otherwise
hostexec's probe refuses every strategy and the engine-API fallback runs
instead, leaving `--progress json` and the pin route untested.

Two consequences of standing a container up as a host, both handled in the
entrypoint: `/` is remounted rshared so the nested bind has something to
propagate from, and the container markers are deleted so the probe believes
the chroot left the container.

Includes a hardcoded OIDC provider, because OPSDECK_AUTH=disabled injects a
static admin and leaves every role-dependent path untestable.

@@ -12,0 +23,4 @@
+      image: denoland/deno:2.5.6
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6

@@ -0,0 +257,4 @@
+    -e OPSDECK_AUTH=oidc
+    -e OPSDECK_OIDC_ISSUER=https://idp:9443
+    -e OPSDECK_OIDC_CLIENT_ID=opsdeck
+    -e OPSDECK_OIDC_CLIENT_SECRET=rig-secret

@@ -0,0 +158,4 @@
+  // change it, GET to read it — a GET that mutates means pasting the URL into
+  // a browser bar silently decides who the next login is.
+  if (url.pathname === "/role") {
+    if (req.method === "POST") {

@@ -0,0 +15,4 @@
+die() { echo "[login] $*" >&2; exit 1; }
+
+rm -f "$JAR"
+curl -fksS -X POST "https://localhost:9443/role?value=${ROLE}" >/dev/null \

@@ -0,0 +93,4 @@
+            : file;
+          return filePatch(r, original, es);
+        }).join("");
+        await Deno.writeTextFile(`${ctx.paths.hostRoot}${patchPath}`, patch);

@@ -239,0 +557,4 @@
+          r.at = at;
+          r.bytes = p.current;
+          r.speed = 0;
+        }

@@ -247,0 +631,4 @@
+        key: "pull/summary",
+        id: "pull",
+        status: "progress",
+        state: "active",

@@ -1198,10 +1772,14 @@ export default async function register(ctx: ModuleContext): Promise<void> {
           }
         })();
 
+      let ok = true;

@@ -1150,0 +1402,4 @@
+        }
+
+        const hostPath = (p: string) => {
+          if (p.includes("..")) throw new Error("refusing path with ..");

@@ -0,0 +57,4 @@
+}
+
+/** -1, 0, 1 by numeric component, shorter-but-equal sorting first */
+function compare(a: number[], b: number[]): number {

@@ -8,6 +8,7 @@
     open = false,
     service = "",
     dependents = [],
+    busy = false,

@@ -165,0 +186,4 @@
+    if (jobsForbidden) return Promise.resolve();
+    return apiFetch<{ jobs: JobSummary[] }>("docker", "/jobs")
+      .then((r) => (jobs = r.jobs))
+      .catch((e) => {

@@ -12,0 +23,4 @@
+      image: denoland/deno:2.5.6
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6

@@ -0,0 +1,11 @@
+{

@@ -0,0 +74,4 @@
+
+      // inside .git so a failed run cannot litter the work tree, and named per
+      // run so a second pin cannot overwrite or delete this one's patch
+      const patchPath = `${root}/.git/opsdeck-pin-${++patchSeq}.patch`;

@@ -247,0 +634,4 @@
+        // derived, not hard-coded "active": the terminal heartbeat says done.
+        // The client reads `.pull`, not this, but a field that lies is a trap
+        // for whoever reads it next.
+        state: rates.size > 0 &&

@@ -148,0 +183,4 @@
+ * and the parent image. Probed from --help because `--progress` is not
+ * validated by any cheap command, and memoised: it cannot change under us.
+ */
+let jsonProgress: boolean | undefined;

@@ -84,0 +127,4 @@
+   * writes the operator's files goes through here.
+   */
+  const hostPath = (p: string) => {
+    if (!p.startsWith("/") || p.includes("..")) {

@@ -283,0 +388,4 @@
+   * its project at 409 for the life of the process, and with it the health
+   * alerts that jobs.running suppresses. This is the operator's way out.
+   */
+  ctx.router.delete(

@@ -1150,0 +1602,4 @@
+          ).filter(Boolean);
+          let done = false;
+          for (const file of files) {
+            const current = restore.has(file)

@@ -1150,0 +1691,4 @@
+          }, 400);
+        }
+
+        const dir = first?.workingDir ?? "/";

@@ -0,0 +123,4 @@
+    // operator's indirection, and compose validates the result happily.
+    if (value.includes("${")) return INTERPOLATED;
+    // and if it does not name what is running, this is not the line to touch
+    if (currentImage && value !== currentImage) return null;

@@ -0,0 +57,4 @@
+}
+
+/** -1, 0, 1 by numeric component, shorter-but-equal sorting first */
+function compare(a: number[], b: number[]): number {

@@ -92,2 +211,4 @@
 ): Promise<Map<string, UpdateInfo>> {
   const out = new Map<string, UpdateInfo>();
+  // one listing per repository, however many containers share it
+  const listed = new Map<string, { tags: string[]; error: string | null }>();

@@ -91,0 +133,4 @@
+   * changing under a recreate; `starting` covers the window before the job is
+   * registered.
+   */
+  const projectBusy = (project: string) =>

@@ -91,0 +147,4 @@
+    confirmQueue.some((p) => p.id === id) && confirmUpdate?.id !== id;
+  let confirming = $state(false);
+  /** one answer per prompt, whatever the input device, and never two at once */
+  async function answerConfirm(

@@ -165,0 +223,4 @@
+  let jobsForbidden = $state(false);
+  function loadJobs() {
+    if (jobsForbidden) return Promise.resolve();
+    return apiFetch<{ jobs: JobSummary[] }>("docker", "/jobs")

@@ -20,0 +40,4 @@
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+
+      - name: Install, format, lint, typecheck, test
+        run: ./.forgejo/deno.sh task ci