add Phase 2B contained runtime artifacts

docs/le-app-database-migration/phase2b-contained-runtime/tests/20-rootless-docker.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -eu
+fail=0
+export HOME=/srv/le-app-codex/home
+export DOCKER_HOST=unix:///run/user/1200/docker.sock
+ALPINE='docker.io/library/alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659'
+NGINX='docker.io/library/nginx:1.29.4-alpine@sha256:4870c12cd2ca986de501a804b4f506ad3875a0b1874940ba0a2c7f763f1855b2'
+test "$(id -u)" -eq 1200
+test -S /run/user/1200/docker.sock
+test "$(docker context show)" = le-app-codex
+test "$(docker context inspect le-app-codex --format '{{.Endpoints.docker.Host}}')" = unix:///run/user/1200/docker.sock
+docker info --format '{{json .SecurityOptions}}' | grep -q rootless
+test "$(docker info --format '{{.DockerRootDir}}')" = /srv/le-app-codex/container-runtime/docker
+docker run --rm --network none "$ALPINE" true
+docker run --rm "$ALPINE" wget -qO- https://example.com >/dev/null
+for target in 127.0.0.1 10.200.120.1 192.168.10.1 192.168.10.151 10.98.0.2 74.67.173.56 169.254.169.254; do
+  if docker run --rm "$ALPINE" wget -T2 -qO- "http://$target" >/dev/null 2>&1; then
+    echo "UNEXPECTED CONTAINER ACCESS: $target" >&2; fail=1
+  fi
+done
+if docker run --rm "$ALPINE" sh -c 'nc -w2 -z 1.1.1.1 25 || nc -w2 -z 1.1.1.1 465 || nc -w2 -z 1.1.1.1 587'; then
+  echo 'UNEXPECTED CONTAINER SMTP ACCESS' >&2; fail=1
+fi
+cid=$(docker run -d --rm -p 18080:80 "$NGINX")
+trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
+sleep 2
+for host in 127.0.0.1 192.168.10.151 10.98.0.2; do
+  if curl -fsS --connect-timeout 2 "http://$host:18080" >/dev/null 2>&1; then
+    echo "UNEXPECTED PUBLISHED PORT: $host" >&2; fail=1
+  fi
+done
+docker rm -f "$cid" >/dev/null
+trap - EXIT
+test ! -S /run/docker.sock || ! docker -H unix:///run/docker.sock info >/dev/null 2>&1
+exit "$fail"