fix(ci): support ipset sockets and deployed image smoke checks

scripts/bench/fixture.mjs

@@ -3,6 +3,10 @@ import { createRequire } from 'node:module'
 import { createHash } from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { resolve } from 'node:path'
+import { realpathSync } from 'node:fs'
+export function fixtureDatabaseConstructor() {
+  return createRequire(realpathSync(resolve('node_modules/@evofw/db/package.json')))('better-sqlite3')
+}
 export const benchmarkPrefix = (i, first = 10) => `${first}.${i >>> 16}.${(i >>> 8) & 255}.${i & 255}/32`
 export function seedFixture(db) {
   db.pragma('foreign_keys = ON')
@@ -26,8 +30,7 @@ export function seedFixture(db) {
   return { fixture: { agents: 100, prefixes: 50_000 }, integrity: db.pragma('integrity_check', { simple: true }) }
 }
 if (!process.argv[1] || resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  const require = createRequire('/app/node_modules/@evofw/db/package.json')
-  const Database = require('better-sqlite3')
+  const Database = fixtureDatabaseConstructor()
   const db = new Database('/data/app.db')
   try { console.log(JSON.stringify(seedFixture(db))) } finally { db.close() }
 }

scripts/bench/runtime.sh

@@ -7,9 +7,11 @@ out="${2:?OUTPUT_DIR required}"
 mkdir -p "$out"
 id="evofw-bench-$(date +%s)-$$"
 volume="$id-data"
+load_id="$id-load"
 cleanup() {
   docker logs "$id" >"$out/container.log" 2>&1 || true
   [ -z "${sampler:-}" ] || { kill "$sampler" 2>/dev/null || true; wait "$sampler" 2>/dev/null || true; }
+  docker rm -fv "$load_id" >/dev/null 2>&1 || true
   docker rm -f "$id" >/dev/null 2>&1 || true
   docker volume rm "$volume" >/dev/null 2>&1 || true
 }
@@ -20,7 +22,7 @@ docker image inspect "$image" >"$out/image.json"
 if docker volume inspect "$volume" >/dev/null 2>&1; then echo 'Refusing reused benchmark volume' >&2; exit 1; fi
 docker volume create "$volume" >/dev/null
 started="$(date +%s)"
-docker run -d --name "$id" --cpus 2 --memory 4g --publish 127.0.0.1::8080 \
+docker run -d --name "$id" --cpus 2 --memory 4g --network none \
   --mount "type=volume,src=$volume,dst=/data" -e EVOFW_ALLOW_UNSAFE=true -e AUTH_REQUIRED=false "$image" >/dev/null
 attempts=0
 until docker exec "$id" node -e "fetch('http://127.0.0.1:8080/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))" >/dev/null 2>&1; do
@@ -31,8 +33,24 @@ docker exec -i "$id" node --input-type=module <scripts/bench/fixture.mjs >"$out/
 # Includes CPU, memory, block IO and PIDs. Metrics are raw observations, no claimed gains.
 (while docker inspect -f '{{.State.Running}}' "$id" 2>/dev/null | grep -q true; do docker stats --no-stream --format '{{json .}}' "$id"; sleep 1; done) >"$out/stats.jsonl" &
 sampler=$!
-port="$(docker port "$id" 8080/tcp | sed 's/.*://')"
-BENCH_P95_LIMIT_MS="${BENCH_P95_LIMIT_MS:-500}" BENCH_URL="http://127.0.0.1:$port" node scripts/bench/load.mjs >"$out/load.json" || load_failed=true
+# The daemon can be remote or reached from a Gitea job container: runner
+# localhost is not the API container. A separate nonroot driver joins only the
+# API network namespace, so its CPU work is outside the app's 2-CPU quota.
+docker create --name "$load_id" --network "container:$id" \
+  --user 65534:65534 --cap-drop ALL --security-opt no-new-privileges:true \
+  --pids-limit 128 --cpus 2 --memory 1g --entrypoint node \
+  -e BENCH_URL=http://127.0.0.1:8080 \
+  -e "BENCH_P95_LIMIT_MS=${BENCH_P95_LIMIT_MS:-500}" \
+  -e "BENCH_CONCURRENCY=${BENCH_CONCURRENCY:-10}" \
+  -e "BENCH_STEADY_CONCURRENCY=${BENCH_STEADY_CONCURRENCY:-2}" \
+  -e "BENCH_STEADY_INTERVAL_MS=${BENCH_STEADY_INTERVAL_MS:-1200}" \
+  "$image" /tmp/load.mjs >/dev/null
+# docker cp transfers bytes through the Docker API; no runner bind mount or
+# container Docker socket is needed. Both modules are readable by the driver UID.
+docker cp scripts/bench/load.mjs "$load_id:/tmp/load.mjs"
+docker cp scripts/bench/fixture.mjs "$load_id:/tmp/fixture.mjs"
+docker start --attach "$load_id" >"$out/load.json" || load_failed=true
+[ "$(docker wait "$load_id")" = 0 ] || load_failed=true
 cat "$out/load.json"
 docker exec "$id" sh -c 'ls -ln /data/app.db*; cat /proc/1/status; cat /proc/1/io' >"$out/db-process.txt"
 sh deploy/docker/backup.sh "$id" "$out/backup.db"

scripts/bench/runtime.test.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env sh
+# Remote-daemon wiring regression; no Docker daemon, app, or network load.
+set -eu
+wrapper="$(pwd)/scripts/bench/runtime.sh"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+mkdir "$tmp/bin"
+cat >"$tmp/bin/docker" <<'DOCKER'
+#!/usr/bin/env sh
+set -eu
+printf '%s\n' "$*" >>"$FAKE_LOG"
+case "$1" in
+  version|info) printf 'fake remote daemon\n' ;;
+  image) printf '{}\n' ;;
+  volume) case "$2" in inspect) exit 1;; *) exit 0;; esac ;;
+  run|create) printf 'fake-container-id\n' ;;
+  exec)
+    case "$*" in
+      *--input-type=module*) cat >/dev/null; printf '{"fixture":true}\n' ;;
+      *) exit 0 ;;
+    esac ;;
+  inspect) printf 'false\n' ;;
+  stats) printf '{}\n' ;;
+  start) printf '{"assertions":{"passed":true}}\n' ;;
+  wait) printf '%s\n' "$FAKE_LOAD_EXIT" ;;
+  cp) case "$2" in *:/tmp/*) printf 'fake-db' >"$3";; *) exit 0;; esac ;;
+  logs|rm) exit 0 ;;
+  *) echo 'Unexpected Docker operation' >&2; exit 99 ;;
+esac
+DOCKER
+cat >"$tmp/bin/node" <<'NODE'
+#!/usr/bin/env sh
+echo 'Benchmark must never execute runner-host Node' >&2
+exit 97
+NODE
+chmod +x "$tmp/bin/docker" "$tmp/bin/node"
+for expected in 0 23; do
+  log="$tmp/docker-$expected.log"
+  if PATH="$tmp/bin:$PATH" FAKE_LOG="$log" FAKE_LOAD_EXIT="$expected" BENCH_P95_LIMIT_MS=321 BENCH_CONCURRENCY=7 BENCH_STEADY_CONCURRENCY=3 BENCH_STEADY_INTERVAL_MS=1350 sh "$wrapper" fixture:immutable "$tmp/out-$expected" >/dev/null; then actual=0; else actual=$?; fi
+  if [ "$expected" = 0 ]; then [ "$actual" = 0 ]; else [ "$actual" != 0 ]; fi
+  grep -E '^run -d --name evofw-bench-[^ ]+ --cpus 2 --memory 4g --network none ' "$log" >/dev/null
+  grep -E '^create --name evofw-bench-[^ ]+-load --network container:evofw-bench-[^ ]+ --user 65534:65534 --cap-drop ALL --security-opt no-new-privileges:true ' "$log" >/dev/null
+  grep -F -- ' --entrypoint node -e BENCH_URL=http://127.0.0.1:8080 -e BENCH_P95_LIMIT_MS=321 -e BENCH_CONCURRENCY=7 -e BENCH_STEADY_CONCURRENCY=3 -e BENCH_STEADY_INTERVAL_MS=1350 fixture:immutable /tmp/load.mjs' "$log" >/dev/null
+  grep -E '^cp scripts/bench/load.mjs evofw-bench-[^ ]+-load:/tmp/load.mjs$' "$log" >/dev/null
+  grep -E '^cp scripts/bench/fixture.mjs evofw-bench-[^ ]+-load:/tmp/fixture.mjs$' "$log" >/dev/null
+  grep -E '^start --attach evofw-bench-[^ ]+-load$' "$log" >/dev/null
+  grep -E '^wait evofw-bench-[^ ]+-load$' "$log" >/dev/null
+  grep -E '^rm -fv evofw-bench-[^ ]+-load$' "$log" >/dev/null
+  grep -E '^volume rm evofw-bench-[^ ]+-data$' "$log" >/dev/null
+  if grep -E -- '(--publish|--privileged|--network host|--pid host|type=bind|docker.sock|^port )' "$log" >/dev/null; then echo 'Unsafe or daemon-local benchmark wiring' >&2; exit 1; fi
+  [ -f "$tmp/out-$expected/backup.db" ]
+done
+echo 'Runtime benchmark wrapper regression passed (remote daemon, separate driver, failure, cleanup)'