[acamarata]

Rows

D-1185 (fixed). Resolver.ensure hardcoded docker for image inspect and pull, and runContainer hardcoded docker run. A Podman-only host with a valid pinned image failed with the generic cannot-pull E645. The resolver now tries docker, then podman (a CLI counts as absent on a start error or the shell's exit 127, which is how the exec funnel reports a missing binary). runContainer picks the same runtime (containerRuntime: docker if installed, else podman) so the pulled image is run by the CLI that pulled it. Tests: TestEnsureFallsBackToPodmanWhenDockerCannotRun, TestBaselineContainerUsesPodmanWhenDockerIsAbsent. Both fail on the old code (E645 "docker: not found"; "E613: docker run: executable file not found").

D-1186 (no change). The validated impact (a forwarded host PATH overriding the image PATH) is already fixed on main by #393 (imageOwnedEnv/containerEnv in free/ci/internal/exec/envallow.go, test TestBaselineContainerKeepsImagePathAndToolchain). The row title (unpinned apt gcc/libc6-dev, Dockerfile:123) is not addressed: pinning needs a dated apt snapshot or version pins, which changes the image contents and requires a rebuild and publish plus a new digest in versions.yaml. That is a release step, so not done here.

D-1188 (fixed). attemptEnded in cmd/logs.go lacked retryable, so ci logs -f waited forever on an attempt parked as retryable after a coordinator crash. retryable is added (it is already terminal in transport/agent/gate.go, and lost, which also precedes retryable, was already listed). Test: TestAttemptEndedForParkedAndLiveStates, which fails on the old code.

Commands run (free/ci, -mod=vendor)

• go build ./..., go vet ./...: clean
• go test ./...: all packages pass except internal/transport/agent TestPullCoordinatorKillResumesWithoutDuplicates, which failed once under load (package untouched) and passes alone (3/3) and in a full package rerun.
• Reverted image.go and container.go temporarily: the two new D-1185 tests fail as above.

🤖 Generated with Claude Code