@@ -29,12 +29,21 @@
fn health_check_cmd(image: &str, container: &str) -> Option<Vec<String>> {
    let lower = image.to_lowercase();
    if lower.contains("postgres") {
        // Probe over TCP (-h 127.0.0.1), NOT the default Unix socket. During
        // first-boot initdb the postgres image runs a temporary server that
        // listens ONLY on the socket (listen_addresses=''), so a socket
        // pg_isready reports ready before the real TCP listener is up — the
        // job then connects to localhost:5432 over TCP and gets econnrefused.
        // Checking TCP makes readiness honest: it only passes once the real
        // server is accepting the connections the job will actually make.
        Some(vec![
            "docker".into(),
            "exec".into(),
            container.into(),
            "pg_isready".into(),
            "-q".into(),
            "-h".into(),
            "127.0.0.1".into(),
        ])
    } else if lower.contains("redis") {
        Some(vec![
@@ -124,9 +133,17 @@
        containers.push(container_name.clone());
        // Wait for health check (up to 30s)
        // Wait for the service to become ready before starting the job. A
        // service that never becomes healthy is a hard failure — proceeding
        // would surface later as a confusing econnrefused mid-job.
        if let Some(check_cmd) = health_check_cmd(image, &container_name) {
            if !wait_for_health(&check_cmd, 60).await {
            wait_for_health(&check_cmd, 30).await;
                cleanup_services(&containers, &network);
                return Err(format!(
                    "service '{svc_name}' ({image}) did not become healthy within 60s"
                )
                .into());
            }
        } else {
            // Brief pause for unknown services
            tokio::time::sleep(std::time::Duration::from_secs(2)).await;
@@ -171,19 +188,22 @@
    })
}
/// Wait for a health check command to succeed. Returns `true` once it passes,
/// or `false` if it never succeeds within `timeout_secs` (the caller treats a
/// `false` as a hard failure rather than proceeding against a service that
/// Wait for a health check command to succeed.
async fn wait_for_health(cmd: &[String], timeout_secs: u64) {
/// isn't ready).
async fn wait_for_health(cmd: &[String], timeout_secs: u64) -> bool {
    let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(timeout_secs);
    while tokio::time::Instant::now() < deadline {
        if let Ok(output) = Command::new(&cmd[0]).args(&cmd[1..]).output() {
            if output.status.success() {
                return true;
                return;
            }
        }
        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
    }
    eprintln!("warning: health check timed out after {timeout_secs}s");
    false
}
/// Build the `docker run` argument list for one service. Pure function —
@@ -322,5 +342,20 @@
        let args = build_run_args("alias-name", &svc, "c", "net").unwrap();
        let alias_pos = args.iter().position(|a| a == "--network-alias").unwrap();
        assert_eq!(args.get(alias_pos + 1), Some(&"alias-name".to_string()));
    }
    #[test]
    fn postgres_health_check_probes_tcp_not_socket() {
        // Regression: `pg_isready` with no -h checks the Unix socket, which is
        // up during initdb's temporary server before the real TCP listener is
        // — so the job connects over TCP and gets econnrefused. The probe must
        // force TCP (-h 127.0.0.1).
        let cmd = health_check_cmd("postgres:18", "anvil-ci-svc-X-postgres").unwrap();
        assert!(cmd.contains(&"pg_isready".to_string()));
        let h_pos = cmd
            .iter()
            .position(|a| a == "-h")
            .expect("postgres health check must pass -h for a TCP probe");
        assert_eq!(cmd.get(h_pos + 1), Some(&"127.0.0.1".to_string()));
    }
}