fix(preflight): trust Docker version identity

[cv]

Summary

Fixes a Docker Engine false positive discovered after #7353 merged. Positive docker version identity now overrides the ambiguous ProductLicense: "Apache-2.0" signal. Ambiguous version output retains the conservative Podman-compatible runtime rejection.

Related Issue

Follow-up to #7353 and #7320.

Changes

• Classify docker version output as Docker, Podman, or unknown.
• Treat positive Docker identity as authoritative over the ambiguous info response.
• Use the ProductLicense backstop when version output does not identify Docker or Podman.
• Add regressions for Docker Engine reporting Apache-2.0 and Podman-compatible info paired with ambiguous version output.
• Use a behavior-oriented regression-test title with the required issue suffix.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: Existing commands, platform-support, and troubleshooting docs already state that Docker is supported and Podman is unsupported. This correction changes no supported surface or procedure.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The correction accepts only positive Docker identity and retains the conservative rejection when version identity is unknown.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Reviewed src/lib/onboard/preflight.ts, src/lib/onboard/preflight-podman-compat.test.ts, docs/reference/commands.mdx, docs/reference/platform-support.mdx, and docs/reference/troubleshooting.mdx. Existing docs already state that Docker is supported and Podman is unsupported; this correction changes no supported surface or procedure.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable — normal pre-commit and commit-msg hooks passed; npm run check:diff passed at 60f8b094a.
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project cli src/lib/onboard/preflight-podman-compat.test.ts src/lib/onboard/preflight.test.ts passed 136 tests; npm run test:titles:check passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable; the correction changes one preflight identity predicate and its regression fixture.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved onboarding runtime detection by more reliably classifying Docker vs Podman from version identity.
  • When Docker compatibility sockets are present but the version probe is empty or unexpected, Podman is still correctly detected and flagged as unsupported.
  • Real Docker installations are now correctly recognized as supported, including when the product license reports Apache-2.0.
• Tests
  • Expanded compatibility preflight coverage for Podman masquerading scenarios and refined the Docker “supported” regression assertions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ee4b136c-4d67-4c2a-b185-4dbefcf6cbaa

📥 Commits

Reviewing files that changed from the base of the PR and between 752b41c and 60f8b09.

📒 Files selected for processing (1)

• src/lib/onboard/preflight-podman-compat.test.ts

---

📝 Walkthrough

Walkthrough

Podman compatibility detection now classifies docker version output as Podman, Docker, or unknown, using docker info only for unknown results. Tests cover ambiguous version output and Docker reporting ProductLicense: "Apache-2.0".

Changes

Podman compatibility detection

Layer / File(s)	Summary
Identity classification and probe precedence src/lib/onboard/preflight.ts	Adds three-state Docker identity classification and makes isDockerCompatPodman fall back to docker info only when the version probe is ambiguous.
Regression coverage src/lib/onboard/preflight-podman-compat.test.ts	Covers empty or unexpected version output for Podman and confirms Apache-2.0 Docker reporting remains supported.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: yimoj

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the core change: preflight now trusts Docker version identity over ambiguous Podman signals.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7353-docker-version-authority

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 60f8b09 in the codex/7353-docker-ve... branch remains at 96%, unchanged from commit b8ec7a9 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 60f8b09 in the codex/7353-docker-ve... branch remains at 80%, unchanged from commit b8ec7a9 in the main branch.

Show a code coverage summary of the most impacted files.

File	main b8ec7a9	codex/7353-docker-ve... 60f8b09	+/-
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/onboard/preflight.ts	79%	80%	+1%
src/lib/platform.ts	84%	89%	+5%
src/lib/domain/.../connect-env.ts	89%	97%	+8%

---

_{Updated July 26, 2026 04:17 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume, cloud-onboard

1 optional E2E recommendation

• onboard-negative-paths

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Addressed the fail-open runtime-identity edge in 752b41c. Docker version evidence is now classified as Podman, positively identified Docker, or unknown; only positive Docker identity suppresses the conservative ProductLicense backstop. Unknown nonempty output such as {} or unexpected text therefore remains fail-closed when the info response has the Podman-compatible Apache-2.0 marker, while the known Docker Engine case remains supported.

Validation on the new commit:

• focused preflight Podman-compat suite: 5 passed
• CLI typecheck: passed
• Biome check for both changed files: passed
• pre-commit and pre-push hooks: passed

The original author commit remains in the branch. No release tag changes were made.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard/preflight-podman-compat.test.ts`:
- Line 77: Update the test title in the parameterized test around “keeps the
Podman info backstop” to describe the externally observable behavior rather than
internal implementation details, and append the required local issue reference
“(`#7320`)” as the final title suffix.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 39a56ebe-f8fe-46c8-b3be-7da978a79d27

📥 Commits

Reviewing files that changed from the base of the PR and between 88a2fad and 752b41c.

📒 Files selected for processing (2)

• src/lib/onboard/preflight-podman-compat.test.ts
• src/lib/onboard/preflight.ts

[apurvvkumaria]

Approved at exact head 60f8b094ad8e20fc6325630e8c00a2c435745768: runtime identity is fail-closed for unknown output, the review-requested behavior title is corrected, all commits are Verified/DCO-compliant, all required CI and selected exact-head E2E pass, both advisor lanes report zero findings, and no unresolved review threads remain.