feat: Support kitchen login with the Docker transport

[tas50]

Description

Carries forward the work from #421 that is still relevant against current main.

Most of #421 has landed since it was opened in July 2024 — several parts byte-identically, which suggests they were cherry-picked. Triaging all 19 files against main:

Already landed — .github/CODEOWNERS, .markdownlint.yaml, release-please-config.json, .release-please-manifest.json, the ENV k=v fixes in container_helper.rb and dockerfile_helper.rb, the moby-dangling regex in image_helper.rb, commenting out kitchen_transport_api_version 1, and kitchen.windows.yml → ltsc2022.

Superseded — ci.yml→lint.yml (main is on Ruby 3.4 / actions@v7), release-please v4 (main is on v5), the kitchen.yml platform refresh, and test/Dockerfile (main uses almalinux:latest + dnf, which is what @Stromweld asked for in review).

Obsolete — the inspec / csv / syslog Gemfile pins, since main replaced InSpec with cinc-auditor.

That leaves three things, all of which are in this PR.

1. kitchen login support (the substantive part)

Kitchen::Transport::Base::Connection#login_command raises "Remote login not supported in ..." unless a transport overrides it, and main's Docker transport never did — so kitchen login has never worked for instances using this transport. This implements it as an interactive docker exec against the instance's container.

Two changes from #421's version:

• Reads the connection's own @options instead of container.instance_variable_get(:@config). That reflection was unnecessary: Base::Connection already stores the merged config-plus-state as @options, and it is literally the same hash handed to Container::Linux.new(@options) a few lines up.
• Handles Windows containers. main supports them (there's a windows-2022 platform in kitchen.yml and a Windows job in CI), so a Linux-only /bin/bash would fail confusingly there. Linux gets /bin/bash --login -i, Windows gets powershell, dispatched off @options[:platform] the same way #container already does — which is now deduped into a windows_container? helper.

One deliberate behavioural difference from #421: it forced username to nil (i.e. log in as root). This keeps the configured username, so the shell matches the environment Test Kitchen actually runs the provisioner in. The kitchen user has NOPASSWD sudo, so root is one sudo -i away.

Argv is built as individual tokens rather than packed strings like "-H #{socket}", because instance.rb runs the result through Kernel.exec in its multi-argument form, which bypasses the shell. Values are left unquoted for the same reason — there is no shell to strip the quotes back off.

2. Remove dead disabled/ integration specs

Three files under test/integration/*/disabled/ whose entire contents have been commented out since busser-serverspec was dropped. Not referenced by kitchen.yml or any workflow.

3. .gitignore

bin/* and .idea/*, straight from #421.

Also in here

spec/inspec_helper_spec.rb evaluated defined?(Kitchen::Verifier::CincAuditor) at spec-file load time to pick between two examples. RSpec loads every spec file before running any example, so the new spec's require "kitchen/transport/docker" — which chains to inspec_helper.rb and defines that constant — invalidated the already-selected example. The conditional now happens inside the example, and the helper is loaded explicitly, so it no longer depends on spec load order. This was a latent fragility; the new file only exposed it.

Testing

• bundle exec rspec — 34 examples, 0 failures (was 25 before; 9 new). Confirmed stable across seeds 1/2/999/12345 for the load-order fix.
• bundle exec rake style — 28 files, no offenses.
• TDD: all 9 new examples were watched failing with Kitchen::ActionFailed: Remote login not supported before the implementation existed.
• Generated argv was fed to the real docker CLI for both Linux and Windows configs. Both parse cleanly, reaching the daemon-connect stage — meaning flags, subcommand, container ID and shell were all accepted:

  ["docker", "-H", "unix:///var/run/docker.sock", "exec", "-t", "-i", "-e", "FOO=bar",
   "-u", "kitchen", "-w", "/opt/kitchen", "deadbeef", "/bin/bash", "--login", "-i"]
  ["docker", "-H", "tcp://localhost:2375", "exec", "-t", "-i", "deadbeef", "powershell"]
  

Not verified: no live kitchen login against a running container — there was no Docker daemon available on the machine I built this on. Worth someone doing a quick manual kitchen converge && kitchen login on one Linux and one Windows instance before merge.

Type of Change

feat

Check List

• New functionality includes tests
• All tests pass
• Commit message includes a Conventional Commit Message

Closes #421

🤖 Generated with Claude Code