feat(launcher): launch the privileged daemon from the image's own digest

[leinardi]

Summary

Adds a launch mode to the daemon image, so the Swarm service can run ghcr.io/leinardi/swarm-device-access:1 launch … -- <daemon flags> unprivileged with only the Docker socket. It replaces the docker:29 sh wrapper.

• Same digest. The launcher finds its own container ID in /proc/self/mountinfo, inspects itself and creates the daemon from its own sha256: image ID. Launcher and daemon therefore always run the same digest, and gantry, rolling updates and docker service rollback act on the daemon as well.

• One privileged set. daemonSpec (internal/launcher/spec.go) is the single source of truth for the daemon's privileges: privileged, host cgroup, PID and user namespaces, network none (-host-network opts into host), AutoRemove, a 10 s stop timeout, and bind Mounts (no Binds) for the Docker socket, /sys at /host/sys and /dev. -dbus and -config-dir (read-only) are opt-in.

• Stale-daemon cleanup. Before creating a daemon, the launcher removes an existing swarm-device-access container only in these cases:

  • its owning launcher is confirmed gone or stopped;
  • it was left by an earlier run of this same launcher container;
  • it was started by the old sh wrapper.

  A live owner, a transient inspect error or a foreign container aborts with an error, and Swarm retries the launcher.

• Supervision.

  • The launcher follows the docker run order: create, attach (the copy goroutine starts before start), ContainerWait(removed), start.
  • The attach and wait streams have their own contexts, detached from the signal. Only their establishment is time-bounded.
  • SIGTERM, a broken wait stream or a lost log stream stop the daemon by ID. The stop, the removal wait and the log drain share one 20 s shutdown budget, which fits inside stop_grace_period: 30s.

• Tests.

  • Unit tests with a fake Docker API cover:
    • the spec table;
    • mountinfo parsing, including the TrueNAS data-root;
    • the stale-daemon policy;
    • call order;
    • establishment bounds;
    • final-log drain;
    • log-stream and wait-stream loss;
    • cancellation;
    • the shared shutdown budget.
  • TestLauncher_RunsDaemonFromItsOwnImage is an integration test in the enforcement group, so it runs only in CI. It covers:
    • the spec of the daemon container that actually gets created;
    • a graceful stop that exits 0;
    • replacement of a daemon orphaned by a killed launcher.
  • sweep-test-leaks also removes daemons whose launcher no longer exists.

• Docs.

  • The README, the compose files, the five examples, SECURITY.md, the architecture and testing docs, AGENTS.md and the trust-boundary skill all describe the launcher.
  • The README keeps a note retiring the sh wrapper.

Local verification:

• go test -race ./..., golangci-lint run (including -tags integration) and make check pass.
• make go-test-integration passes. It ran dry-run only: the launcher and enforcement tests skip without SDA_IT_ENFORCE=1.
• make docker-build works. Inside the built image, launch -help exits 0 and launch -config-dir relative fails with a named error. A bare launch identified its own container and then failed only because it had no socket.

Pull request checklist

• I am targeting the master branch
• I have rebased this branch on top of the destination branch
• I have executed make check locally before creating the commit and it has run successfully
• I have performed a self-review of my own code
• There are no WIP commits in this PR

Type of changes

• 🐛 Bug fix
• ✨ New feature
• 🔧 Refactoring
• 📜 Docs
• 🧰 CI / tooling / infra
• Other (describe in Summary)