Initial phase 1 baseline implementation

scripts/smoke-image.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+set -eu
+
+image="${1:-drive-v2:dev}"
+suffix="$$"
+network="drive-v2-smoke-${suffix}"
+database_container="drive-v2-smoke-db-${suffix}"
+application_container="drive-v2-smoke-app-${suffix}"
+
+cleanup() {
+  docker rm -f "$application_container" "$database_container" >/dev/null 2>&1 || true
+  docker network rm "$network" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT INT TERM
+
+docker network create "$network" >/dev/null
+docker run -d --name "$database_container" --network "$network" \
+  -e POSTGRES_DB=drive \
+  -e POSTGRES_USER=drive \
+  -e POSTGRES_PASSWORD=drive-smoke-only \
+  --tmpfs /var/lib/postgresql \
+  postgres:18.4-bookworm >/dev/null
+
+attempt=0
+until docker exec "$database_container" pg_isready -U drive -d drive >/dev/null 2>&1; do
+  attempt=$((attempt + 1))
+  if [ "$attempt" -ge 30 ]; then
+    docker logs "$database_container"
+    exit 1
+  fi
+  sleep 1
+done
+
+docker run -d --name "$application_container" --network "$network" \
+  --read-only --tmpfs /tmp:size=64m,mode=1777 \
+  --cap-drop ALL --security-opt no-new-privileges:true \
+  -e DRIVE_DATABASE_URL="postgres://drive:drive-smoke-only@${database_container}:5432/drive?sslmode=disable" \
+  -p 127.0.0.1::8080 \
+  "$image" >/dev/null
+
+published="$(docker port "$application_container" 8080/tcp)"
+port="${published##*:}"
+attempt=0
+until curl --fail --silent "http://127.0.0.1:${port}/health/ready" | grep -q '"status":"ready"'; do
+  attempt=$((attempt + 1))
+  if [ "$attempt" -ge 30 ]; then
+    docker logs "$application_container"
+    exit 1
+  fi
+  sleep 1
+done
+
+curl --fail --silent "http://127.0.0.1:${port}/api/v1/setup/status" \
+  | grep -q '"initialized":false'
+test "$(docker inspect --format '{{.Config.User}}' "$application_container")" = "65532:65532"