Problem
setup_ssh_proxy_container() (dclaude:959-1009) has two silent failure modes that both end in the documented "Connection refused" troubleshooting scenario:
1. Runtime package install with discarded output. The proxy container runs apk add --no-cache socat at startup, with all output sent to /dev/null. Offline, or behind the very corporate SSL-inspection proxy the CA_CERT feature exists for, apk add fails, socat never starts, and SSH auth inside dclaude just breaks with no error. The 0.5s sleep + "is the container still running" check doesn't catch it because the container is still alive while apk fails/retries.
2. Hardcoded /run/host-services/ssh-auth.sock. This is a Docker Desktop convention. OrbStack and Colima emulate it, but Rancher Desktop and other VMs may not; mounting a nonexistent path succeeds (Docker creates an empty dir) and socat then bridges to nothing.
Fix
- Eliminate the network dependency: use an image that already contains socat —
alanbem/dclaude itself ships socat, or bake a tiny dedicated proxy image. (alpine/socat exists but adds a third-party supply-chain dependency.)
- Verify the magic socket path exists as a socket before starting the proxy (
docker run --rm -v ...: alpine test -S ... or check provider from the Docker context) and emit a clear warning naming the provider limitation instead of failing silently
- Surface proxy container failure: after startup, check that the socket appears in the shared volume, not just that the container is running
Found during a full-project code review.
Problem
setup_ssh_proxy_container()(dclaude:959-1009) has two silent failure modes that both end in the documented "Connection refused" troubleshooting scenario:1. Runtime package install with discarded output. The proxy container runs
apk add --no-cache socatat startup, with all output sent to /dev/null. Offline, or behind the very corporate SSL-inspection proxy theCA_CERTfeature exists for,apk addfails, socat never starts, and SSH auth inside dclaude just breaks with no error. The 0.5s sleep + "is the container still running" check doesn't catch it because the container is still alive while apk fails/retries.2. Hardcoded
/run/host-services/ssh-auth.sock. This is a Docker Desktop convention. OrbStack and Colima emulate it, but Rancher Desktop and other VMs may not; mounting a nonexistent path succeeds (Docker creates an empty dir) and socat then bridges to nothing.Fix
alanbem/dclaudeitself ships socat, or bake a tiny dedicated proxy image. (alpine/socatexists but adds a third-party supply-chain dependency.)docker run --rm -v ...: alpine test -S ...or check provider from the Docker context) and emit a clear warning naming the provider limitation instead of failing silentlyFound during a full-project code review.