working again! with various improvements listed in README.md; renamed to shocker (shell docker)

[traceypooh]

renaming to shocker is optional. i did that in case the work doesnt get merged back :)

2026 Modernization

What broke in bocker and what shocker fixes

• shocker_pull → full rewrite for Registry v2
  • The original used Docker's v1 registry API (index.docker.io/v1/), which was shut down in 2023. Shocker uses the v2 API with proper OAuth2 Bearer token auth, fetches the manifest (accepting both Docker schema v2 and OCI formats), extracts layer digests, and pulls blobs by digest.
• cgroups v1 → v2 support
  • Most modern distros (Ubuntu 22.04+, Fedora 31+, etc.) ship with cgroups v2 unified hierarchy. The original's cgcreate/cgset/cgexec/cgdelete commands only work with v1. Shocker detects the version at startup and uses either:
  • v2: writes directly to /sys/fs/cgroup/, maps cpu.shares → cpu.weight, memory.limit_in_bytes → memory.max
  • v1: falls back to the original cgroup-tools commands
• UUID space expansion
  • bocker used shuf -i 42002-42254 — only 252 possible values, almost guaranteed collision if you run a few containers. shocker uses 5 hex digits ($RANDOM * $RANDOM % 0xFFFFF) = ~1 million values.
• MAC address generation
  • The original's 02:42:ac:11:00$mac was only a 2-octet suffix from 3 decimal digits, producing malformed MACs. shocker derives a proper 6-octet MAC from 4 hex chars of the UUID.
• shocker_exec PID lookup
  • The original's nested ps | grep | awk | grep pipeline was fragile and often broke. Replaced with a single ps -eo pid,args | awk that matches the unshare process for the container UUID.

Second pass of fixes/improvements

• IP derivation — now uses the full 5-hex-digit UUID value (16#${uuid} % 253) rather than just the last 2 hex digits, significantly reducing the chance of two containers getting the same IP
• MAC address — zero-pads the UUID to 8 hex digits with printf '%08x' then slices into 4 clean xx octets; fixes potential truncation with short UUID values and removes fragile sed regex
• shocker_pull — manifest list handling — now accepts manifest list / OCI image index media types, detects which type was returned, then resolves to the correct platform digest (matching uname -m normalized to OCI arch names: amd64, arm64, arm) before fetching the actual image manifest; fixes accidentally pulling layers for the wrong architecture
• shocker_pull — config blob fix — switched from grep on raw JSON to python3 parsing layers[] explicitly; the config blob lives under config not layers, so the old grep was incorrectly including it and causing tar to fail on a non-tarball

Third pass of fixes

• Default tag to :latest when omitted
• Registry v2 API with multi-arch manifest list support
• SHOCKER_REGISTRY env var for Nexus/mirror pull-through (see below)
• Two-step CDN blob download to work around proxy allowlists
• btrfs check with setup instructions (see below)
• bridge0 + NAT auto-created on first run
• cgroups v2 support with proper quoting in _cg_exec
• --mount-proc= fix for proc inside chroot

Fourth pass of fixes/improvements

• run --rm and run -it new optional CLI flags features working
• switch DNS resolver from google to cloudflare
• check btrfs for non-help screens
• all commands working 🎉🚀

Fifth pass of fixes/improvements

• add iptables network forwarding so networking out inside containers works
• use host /etc/resolv.conf since may have specific DNS resolving setup