test: migrate Docker orchestration to testcontainers-go

[ethanndickson]

Replaces the hand-rolled Docker SDK container lifecycle in integration/integration.go with testcontainers-go. StartCoder's signature and all its options are unchanged, so the acceptance and integration test callsites are untouched.

testcontainers handles image pulls, the mapped host port, readiness waiting, and cleanup, which lets us delete the pullImage and randomPort helpers and drop docker/docker as a direct dependency.

Closes PLAT-367.

[ethanndickson]

• feat: add experimental coderd_default_agents_model resource #378
• test: migrate Docker orchestration to testcontainers-go #374 👈 (View in Graphite)
• feat(coderd_ai_provider): add Bedrock role_arn for STS assume-role #372
• feat: add experimental coderd_agents_model resource #371
• docs: add AGENTS.md contributor guide for AI agents #369
• feat: add experimental coderd_ai_provider resource #368
• ci: run acceptance tests against an external Postgres sidecar #370
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[linear-code]

PLAT-367

[ethanndickson]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a754e2e19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ethanndickson]

@codex review

re: Bind the Coder test port to loopback

Thanks — I dug into this. You're right that the old hand-rolled Docker setup explicitly bound the published Coder port to 127.0.0.1, while the testcontainers ExposedPorts path leaves the host bind address to Docker/testcontainers defaults.

I don't think we should take the loopback binding change as part of this migration, though. The idiomatic testcontainers API here is ExposedPorts plus wait.ForHTTP, and forcing a loopback bind requires dropping down into HostConfigModifier and importing the Moby API types directly. It also makes readiness less straightforward in some Docker environments because testcontainers may resolve the Docker host to a bridge/gateway address, while a loopback-bound published port is only reachable via 127.0.0.1.

The practical risk seems acceptable for this test harness: the instance is ephemeral, uses a random host port, is short-lived, and runs inside the test runner environment. If we want localhost-only published ports as a hard security requirement, I think that should be a separate hardening change with explicit handling for testcontainers host resolution across Docker environments.

I did keep the other fix from this review: cleanup and failure log collection are now registered immediately after GenericContainer returns and before asserting startup success, so a start/wait timeout won't leak the container or lose the logs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1503379828

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ethanndickson]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 734112b862

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ethanndickson]

Merge activity

• Jul 1, 5:55 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 1, 6:01 AM UTC: Graphite couldn't merge this pull request because a downstack PR feat(coderd_ai_provider): add Bedrock role_arn for STS assume-role #372 failed to merge.
• Jul 1, 6:17 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 1, 6:19 AM UTC: Graphite rebased this pull request as part of a merge.
• Jul 1, 6:19 AM UTC: @ethanndickson merged this pull request with Graphite.