From 52fd847ac6a19761760cf30e6b2a3128bce6ea09 Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Wed, 27 May 2026 22:12:17 +0100
Subject: [PATCH] Let install.sh smoke harness opt past Docker-environment
 refusal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

install.sh refuses to run inside Docker (correct behavior for end
users), but the install-sh-smoke gate runs the documented systemd
install path inside a privileged systemd-in-Docker container — the
one legitimate bypass case. Added PULSE_INSTALL_ALLOW_DOCKER=1
escape hatch in check_docker_environment() and set it on the docker
exec in the smoke workflow. Takes effect on the next RC; v6.0.0-rc.6's
published install.sh predates this and is signed-frozen, so its
post-publish smoke gate will remain red until the next prerelease.
---
 .github/workflows/install-sh-smoke.yml | 8 ++++++--
 install.sh                             | 7 +++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/install-sh-smoke.yml b/.github/workflows/install-sh-smoke.yml
index e0149c951..6fb1fbbfb 100644
--- a/.github/workflows/install-sh-smoke.yml
+++ b/.github/workflows/install-sh-smoke.yml
@@ -229,8 +229,12 @@ jobs:
           echo "Running install.sh --archive against the published tarball..."
           # docker exec without -t leaves stdin without a TTY, which install.sh's
           # safe_read helper detects and falls through to defaults on every prompt.
-          docker exec "${container_name}" \
-            bash -lc "cd /smoke && bash install.sh --archive /smoke/${tarball} --disable-auto-updates"
+          # PULSE_INSTALL_ALLOW_DOCKER=1 opts the smoke harness past install.sh's
+          # Docker-environment refusal — install.sh treats the test container as
+          # a normal systemd host, which is the exact contract this gate exists
+          # to validate.
+          docker exec -e PULSE_INSTALL_ALLOW_DOCKER=1 "${container_name}" \
+            bash -lc "cd /smoke && PULSE_INSTALL_ALLOW_DOCKER=1 bash install.sh --archive /smoke/${tarball} --disable-auto-updates"
 
           echo "Waiting for pulse.service to become active..."
           for i in $(seq 1 60); do
diff --git a/install.sh b/install.sh
index 84e9640ea..8010e1182 100755
--- a/install.sh
+++ b/install.sh
@@ -780,6 +780,13 @@ check_docker_environment() {
        grep -q docker /proc/self/cgroup 2>/dev/null || \
        [[ -f /run/.containerenv ]] || \
        [[ "${container:-}" == "docker" ]]; then
+        # The install.sh smoke gate exercises the documented systemd install
+        # path inside a privileged systemd-in-Docker test container. That is
+        # the one legitimate case for bypassing this guard.
+        if [[ "${PULSE_INSTALL_ALLOW_DOCKER:-}" == "1" ]]; then
+            print_warn "Docker environment detected but PULSE_INSTALL_ALLOW_DOCKER=1 set; continuing."
+            return 0
+        fi
         print_error "Docker environment detected"
         echo "Please use the Docker image directly: docker run -d -p 7655:7655 $(repo_docker_image_ref latest)"
         echo "See: $(repo_docker_docs_url)"