feat(dev-container): map the paths of docker compose to the host

`docker compose` and `docker-compose` passed the compose file through
unchanged, so every bind mount in it named a path in the dev-container that
the daemon then looked up on the host. For up, create, run, watch and scale
the file is now rendered with `config --format json`, bind sources, secret
and config files and bind-driver volume devices are mapped with
cuos-host-path, and compose runs on the result. `docker-compose` hands over
to the docker wrapper.

Two defects in the same wrapper fixed on the way:

- A short option with an attached value was split letter by letter:
  `-p8080:80` became `-p -8 -0 ...`, `-eFOO=bar` and `-w/srv` likewise,
  and so did options of the command inside the container (`find -name`).
  Only a cluster of boolean flags ending in -v is expanded now.
- cuos-host-path printed its usage text on stdout for a path that did not
  exist yet, and the wrapper mounted that text as the source. It now
  resolves with `realpath -m` and reports errors on stderr.

Verified with docker.test.sh (15 passed) and shellcheck, against mocks only:
not run against a real daemon or the compose version in the image.

Signed-off-by: Simon Walz <contact@simonwalz.de>

Author: simonwalz

dev-container/Dockerfile

@@ -40,4 +40,4 @@ COPY entrypoint.sh /
 COPY sshd_config_local.conf /etc/ssh/sshd_config.d/
 COPY vimrc.local /etc/vim/
 COPY gitconfig /etc/
-COPY cuos cuos-* docker /usr/local/bin/
+COPY cuos cuos-* docker docker-compose /usr/local/bin/

dev-container/cuos-host-path

@@ -4,14 +4,14 @@
 # Path to the real docker binary (avoid recursion, see ./docker script)
 DOCKER_REAL="${DOCKER_REAL:-/usr/bin/docker}"
 
-# Usage: ./resolve_host_path.sh /path/inside/container
-container_path="$(realpath "$1")"
-
-if [ -z "$container_path" ]; then
-  echo "Usage: $0 <path-inside-container>"
+if [ -z "${1:-}" ]; then
+  echo "Usage: $0 <path-inside-container>" >&2
   exit 1
 fi
 
+# -m: a bind source need not exist yet, docker creates it on the host.
+container_path="$(realpath -m -- "$1")"
+
 # exclusions:
 case "$1" in
   "/root/.docker/config.json") echo "$1";exit;;
@@ -44,7 +44,7 @@ for id in $container_ids; do
 done
 
 [ -z "$my_container_id" ] && {
-  echo "Could not identify current container."
+  echo "Could not identify current container." >&2
   exit 1
 }
 

dev-container/docker

@@ -52,7 +52,7 @@ map_path_or_keep() {
     return 0
   fi
 
-  if ! out="$("$HOST_MAP_BIN" "$in2" 2>/dev/null || true)"; then
+  if ! out="$("$HOST_MAP_BIN" "$in2" 2>/dev/null)"; then
     out=""
   fi
   if [ -n "$out" ]; then
@@ -177,7 +177,6 @@ rewrite_mount_spec() {
 }
 
 # Expand combined short options like -itv/... into -i -t -v<spec>
-# For non-`v` flags, we split to separate tokens (e.g., -p80:80 => "-p" "80:80")
 expand_short_cluster() {
   local arg="$1"
   local rest="${arg#-}"
@@ -203,6 +202,99 @@ expand_short_cluster() {
   printf '%s\0' "${tokens[@]}"
 }
 
+# --- docker compose ---
+# The paths in a compose file are paths in this container, and the daemon
+# resolves them on the host. For the commands that create containers the file
+# is rendered, the sources the daemon mounts are mapped, and compose runs on the
+# result. The build context, env_file and the like are read by compose itself
+# and stay as they are.
+COMPOSE_CREATING=" up create run watch scale "
+
+compose_map_sources() {
+  local config="$1"
+  local updates="[]" line path src
+  while IFS= read -r line; do
+    path="$(jq -c '.[0]' <<<"$line")"
+    src="$(jq -r '.[1]' <<<"$line")"
+    looks_like_path "$src" || continue
+    updates="$(jq -c --argjson p "$path" --arg v "$(map_path_or_keep "$src")" \
+      '. + [[$p, $v]]' <<<"$updates")"
+  done < <(jq -c '
+    (.services // {} | to_entries[] | .key as $s
+      | (.value.volumes // []) | to_entries[]
+      | select(.value.type == "bind")
+      | [["services", $s, "volumes", .key, "source"], .value.source]),
+    (("secrets", "configs") as $k | (.[$k] // {}) | to_entries[]
+      | select(.value.file)
+      | [[$k, .key, "file"], .value.file]),
+    (.volumes // {} | to_entries[]
+      | select((.value.driver_opts.o // "") | split(",") | index("bind"))
+      | select(.value.driver_opts.device)
+      | [["volumes", .key, "driver_opts", "device"], .value.driver_opts.device])
+  ' <<<"$config")
+
+  # The rendering already holds only the active services; their profiles go, so
+  # that a COMPOSE_PROFILES from the project's .env still counts.
+  jq --argjson u "$updates" '
+    reduce $u[] as $x (.; setpath($x[0]; $x[1]))
+    | if has("services") then .services |= map_values(del(.profiles)) else . end
+  ' <<<"$config"
+}
+
+COMPOSE_RENDERED=""
+
+run_compose() {
+  local -a global=() rest=()
+  local sub="" from_stdin=0
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      -f|--file|-p|--project-name|--project-directory|--env-file|--profile|--parallel|--ansi|--progress)
+        if [[ "$1" == -f || "$1" == --file ]] && [ "${2:-}" = "-" ]; then
+          from_stdin=1
+        fi
+        global+=("$1"); shift
+        if [ "$#" -gt 0 ]; then global+=("$1"); shift; fi
+        ;;
+      -f-|-f=-|--file=-)
+        from_stdin=1; global+=("$1"); shift ;;
+      -*)
+        global+=("$1"); shift ;;
+      *)
+        sub="$1"; rest=("$@"); break ;;
+    esac
+  done
+
+  if [ "$from_stdin" = 1 ] || [[ "$COMPOSE_CREATING" != *" $sub "* ]]; then
+    "$DOCKER_REAL" compose "${global[@]}" "${rest[@]}"
+    return
+  fi
+
+  # Without a valid project, compose's own error comes from the command as given.
+  local config
+  if ! config="$("$DOCKER_REAL" compose "${global[@]}" config --format json 2>/dev/null)"; then
+    "$DOCKER_REAL" compose "${global[@]}" "${rest[@]}"
+    return
+  fi
+
+  local -a keep=()
+  local i=0
+  while [ "$i" -lt "${#global[@]}" ]; do
+    case "${global[i]}" in
+      -f|--file) i=$((i + 2)); continue ;;
+      -f*|--file=*) i=$((i + 1)); continue ;;
+    esac
+    keep+=("${global[i]}"); i=$((i + 1))
+  done
+
+  # A file, not stdin: `compose run -it` needs the terminal.
+  COMPOSE_RENDERED="$(mktemp --suffix=.json)" || return 1
+  trap 'rm -f "$COMPOSE_RENDERED"' EXIT
+  compose_map_sources "$config" >"$COMPOSE_RENDERED" || return 1
+  log_debug "Compose file rendered to $COMPOSE_RENDERED"
+
+  "$DOCKER_REAL" compose "${keep[@]}" -f "$COMPOSE_RENDERED" "${rest[@]}"
+}
+
 # --- Parse args and rewrite ---
 OUT_ARGS=()
 END_OF_OPTS=0
@@ -264,11 +356,17 @@ while [ "$#" -gt 0 ]; do
       OUT_ARGS+=("--mount=$(rewrite_mount_spec "$mspec")")
       ;;
 
-    # Combined short options: e.g., -itv/home:/mnt:ro
-    -[!-][!-]*)
-      mapfile -d '' -t expanded < <(expand_short_cluster "$arg")
-      # Prepend expanded tokens back to the input stream, then continue
-      set -- "${expanded[@]}" "$@"
+    # Boolean flags combined with -v: -itv/home:/mnt:ro, rm -fv.
+    # Any other letter takes a value (-p8080:80, -eFOO=bar, -w/srv) or is not
+    # docker's at all (find -name), and the argument stays as it is.
+    -[dfiPqt]*v*)
+      if [[ "$arg" =~ ^-[dfiPqt]+v ]]; then
+        mapfile -d '' -t expanded < <(expand_short_cluster "$arg")
+        # Prepend expanded tokens back to the input stream, then continue
+        set -- "${expanded[@]}" "$@"
+      else
+        OUT_ARGS+=("$arg")
+      fi
       ;;
 
     *)
@@ -289,5 +387,10 @@ if [ "$DEBUG" = "1" ]; then
   printf '\n' >&2
 fi
 
+if [ "${OUT_ARGS[0]:-}" = "compose" ]; then
+  run_compose "${OUT_ARGS[@]:1}"
+  exit "$?"
+fi
+
 "$DOCKER_REAL" "${OUT_ARGS[@]}"
 exit "$?"

dev-container/docker-compose

@@ -0,0 +1,5 @@
+#!/bin/bash
+# SPDX-License-Identifier: Apache-2.0
+
+# The path mapping lives in the docker wrapper next to this script.
+exec docker compose "$@"

dev-container/docker.test.sh

@@ -45,13 +45,29 @@ export -f cuos_host_path
 
 # docker: mock of the real docker CLI (captured by DOCKER_REAL)
 # Behavior: simply echoes the final argv the wrapper execs.
+# `compose ... config` prints COMPOSE_CONFIG, or fails when it is empty, and a
+# rendered compose file is printed as "@" and its content.
 docker() {
-  # Print arguments space-separated in a single line
-  if [ "$#" -gt 0 ]; then
-    printf '%s' "$1"; shift
-    for a in "$@"; do printf ' %s' "$a"; done
+  if [ "${1:-}" = "compose" ]; then
+    local a
+    for a in "$@"; do
+      if [ "$a" = "config" ]; then
+        [ -n "${COMPOSE_CONFIG:-}" ] || return 1
+        printf '%s\n' "$COMPOSE_CONFIG"
+        return 0
+      fi
+    done
   fi
-  printf '\n'
+  local out=() prev=""
+  for a in "$@"; do
+    if [ "$prev" = "-f" ] && [[ "$a" == *.json ]] && [ -f "$a" ]; then
+      out+=("@$(jq -c . "$a")")
+    else
+      out+=("$a")
+    fi
+    prev="$a"
+  done
+  printf '%s\n' "${out[*]}"
 }
 export -f docker
 
@@ -136,6 +152,41 @@ expect "-- passthrough" \
   "run -- -v /x:/y weird -args" \
   run -- -v /x:/y weird -args
 
+# 10) Short options with an attached value are not split
+expect "attached values untouched" \
+  "run -p8080:80 -eFOO=/a:/b -w/srv alpine" \
+  run -p8080:80 -eFOO=/a:/b -w/srv alpine
+
+# 11) Options of the command inside the container are not split
+expect "find -name untouched" \
+  "run alpine find / -name foo" \
+  run alpine find / -name foo
+
+# 12) compose: bind sources, secret files and bind-driver volumes are mapped;
+#     named volumes, build context and profiles of active services are not
+export COMPOSE_CONFIG='{"name":"p","services":{"s":{"build":{"context":"/src"},"profiles":["dev"],"volumes":[{"type":"bind","source":"/data/x","target":"/x"},{"type":"volume","source":"v","target":"/v"}]}},"secrets":{"k":{"file":"/data/k"}},"volumes":{"v":{},"b":{"driver_opts":{"type":"none","o":"bind","device":"/data/b"}}}}'
+expect "compose up renders mapped file" \
+  'compose -p p -f @{"name":"p","services":{"s":{"build":{"context":"/src"},"volumes":[{"type":"bind","source":"/HOST/data/x","target":"/x"},{"type":"volume","source":"v","target":"/v"}]}},"secrets":{"k":{"file":"/HOST/data/k"}},"volumes":{"v":{},"b":{"driver_opts":{"type":"none","o":"bind","device":"/HOST/data/b"}}}} up -d' \
+  compose -p p -f compose.yml up -d
+
+# 13) compose: commands that create no container pass through
+expect "compose ps passthrough" \
+  "compose -f compose.yml ps" \
+  compose -f compose.yml ps
+
+# 14) compose: -v of `compose run` is mapped like docker's
+export COMPOSE_CONFIG='{"name":"p","services":{"s":{}}}'
+expect "compose run -v" \
+  'compose -f @{"name":"p","services":{"s":{}}} run -v /HOST/data/w:/w s' \
+  compose run -v /data/w:/w s
+
+# 15) compose: without a project the command runs as given
+export COMPOSE_CONFIG=""
+expect "compose without project" \
+  "compose up" \
+  compose up
+unset COMPOSE_CONFIG
+
 printf '\nSummary: %d passed, %d failed\n' "$pass" "$fail"
 [ "$fail" -eq 0 ] || exit 1