`deno task check` and the unit tests cannot see the defects that matter most
in the docker module — a progress bar that walks backwards, a spinner that
never stops, a compose file rewritten wrongly. Those need a real engine, real
compose files and a real pull.

This is one privileged throwaway container running its own dockerd, with
OpsDeck nested inside it using the production mounts. The nesting is the
point: only then does `chroot /host/root` land somewhere that is not our own
mount namespace, and only then is the compose path taken at all — otherwise
hostexec's probe refuses every strategy and the engine-API fallback runs
instead, leaving `--progress json` and the pin route untested.

Two consequences of standing a container up as a host, both handled in the
entrypoint: `/` is remounted rshared so the nested bind has something to
propagate from, and the container markers are deleted so the probe believes
the chroot left the container.

Includes a hardcoded OIDC provider, because OPSDECK_AUTH=disabled injects a
static admin and leaves every role-dependent path untestable.

@@ -0,0 +15,4 @@
+  && curl -fsSL https://download.docker.com/linux/debian/gpg \
+       -o /etc/apt/keyrings/docker.asc \
+  && chmod a+r /etc/apt/keyrings/docker.asc \
+  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" \

@@ -0,0 +31,4 @@
+# HOST_ROOT is "/" because this container IS the host it manages: the chroot
+# strategy in hostexec.ts then runs against a real root that has docker, git
+# and the compose files where a real deployment would put them.
+ENV OPSDECK_ENV=development \

@@ -0,0 +23,4 @@
+```
+
+Restart the rig, never the app inside it:
+`docker exec opsdeck-rig docker

@@ -0,0 +13,4 @@
+
+# rslave on the nested mount needs a shared or slave root to propagate from,
+# and a container root is private by default
+mount --make-rshared / 2>/dev/null || log "WARNING: could not make / rshared"

@@ -0,0 +34,4 @@
+# Compose files live in a git work tree, because the pin route's whole point
+# is committing the line it rewrites — an untracked directory exercises only
+# half of it.
+if [ ! -d /srv/stacks/.git ]; then

@@ -0,0 +46,4 @@
+fi
+
+log "pulling seed images (once)"
+for img in nginx:1.27-alpine nginx:1.25-alpine redis:7.2-alpine alpine:3.20; do

@@ -0,0 +86,4 @@
+  openssl x509 -req -in /certs/idp.csr -CA /certs/ca.pem -CAkey /certs/ca-key.pem \
+    -CAcreateserial -days 3650 -extfile /certs/idp.ext -out /certs/idp.pem \
+    >/dev/null 2>&1
+  chmod 644 /certs/idp-key.pem

@@ -0,0 +93,4 @@
+    /srv/idp/stub.ts >/var/log/idp.log 2>&1 &
+  for i in $(seq 1 30); do
+    curl -ksS https://localhost:9443/jwks >/dev/null 2>&1 && break
+    [ "$i" = 30 ] && { log "IdP did not start:"; tail -20 /var/log/idp.log >&2; }

@@ -0,0 +101,4 @@
+  # OpsDeck trust the self-signed certificate, which openid-client requires
+  # because it refuses a plain-http issuer outright
+  IDP_ARGS="--add-host idp:host-gateway \
+    -v /certs:/certs:ro \

@@ -0,0 +121,4 @@
+docker run -d --name opsdeck \
+  -p 8080:8080 \
+  -e OPSDECK_ENV=development \
+  -e OPSDECK_AUTH=disabled \

@@ -0,0 +125,4 @@
+  -e OPSDECK_MODULES=docker \
+  -e OPSDECK_LOG_LEVEL=debug \
+  -e OPSDECK_DATA_DIR=/data \
+  -e OPSDECK_HOST_PROC=/host/root/proc \

@@ -0,0 +135,4 @@
+
+log "opsdeck container: $(docker inspect -f '{{.State.Status}}' opsdeck)"
+log "following its log"
+exec docker logs -f opsdeck

@@ -0,0 +93,4 @@
+      id_token_signing_alg_values_supported: ["RS256"],
+      code_challenge_methods_supported: ["S256"],
+      scopes_supported: ["openid", "profile", "email"],
+      token_endpoint_auth_methods_supported: [

@@ -0,0 +107,4 @@
+  // which role the next login gets: the whole point of the stub
+  if (url.pathname === "/role") {
+    const value = url.searchParams.get("value");
+    if (value) role = value;

@@ -0,0 +3,4 @@
+# session in the cookie jar $2. The browser leg is done here with curl: the
+# stub approves immediately, so the flow is redirect -> redirect -> cookie.
+set -euo pipefail
+ROLE=$1; JAR=$2

@@ -0,0 +8,4 @@
+curl -ksS -X POST "https://localhost:9443/role?value=${ROLE}" >/dev/null
+
+# 1. OpsDeck hands us the authorize URL (and sets the flow cookie)
+AUTH=$(curl -sS -c "$JAR" -o /dev/null -D - http://localhost:8080/auth/login \

@@ -0,0 +18,4 @@
+  | awk 'tolower($1)=="location:"{print $2}' | tr -d '\r')
+
+# 3. OpsDeck exchanges the code server-side and sets the session cookie
+curl -sS -b "$JAR" -c "$JAR" -o /dev/null -w '' "$BACK"

@@ -0,0 +11,4 @@
+RIG=$(cd "$(dirname "$0")" && pwd)
+NAME=opsdeck-rig
+
+if [ "${1:-}" != "--rerun" ]; then

@@ -0,0 +17,4 @@
+fi
+
+echo "[up] exporting the app image for the nested engine"
+docker save -o "$RIG/opsdeck.tar" opsdeck:rig-base

@@ -0,0 +29,4 @@
+# container only and grants nothing on the developer's own daemon.
+docker run -d --name "$NAME" --privileged \
+  -p 8080:8080 \
+  -p 9443:9443 \

@@ -0,0 +32,4 @@
+  -p 9443:9443 \
+  -e RIG_OIDC="${RIG_OIDC:-0}" \
+  -v "$NAME-data:/data" \
+  -v "$NAME-docker:/var/lib/docker" \