Fix the docker channel's negative-control and token-interop CI steps

[kixelated]

Background

The scheduled smoke job's docker runner had a chain of latent bugs in its later steps that never surfaced before, because an earlier step always failed first and the rest were skipped. Now that #10 fixed the docker Smoke step (the old Catalog.fetch API), those steps run for the first time. This PR fixes the two that were broken.

1. Relay container leaks across steps (Negative control)

The docker relay wrapper (clients/docker/moq-relay) does exec docker run --rm -i --network host …. smoke.sh tears the relay down with kill_tree (SIGKILL), which kills the docker client but leaves the container running — still bound to port 4443 via --network host. The Smoke and Negative control steps run consecutively in the same job, so the second run's port preflight saw the leftover container and aborted with something is already listening on 127.0.0.1:4443.

Fix — reap the container at the source:

• clients/docker/moq-relay: run with a stable --name, and docker rm -f any leftover before binding (covers a crashed run whose cleanup never fired).
• smoke.sh cleanup(): export the shared container name and docker rm -f it after kill_tree — gated on the docker wrapper actually being the relay (RELAY ends in clients/docker/moq-relay), so a non-docker run on a host that happens to have docker can't delete an unrelated container of that name. Honors the SMOKE_DOCKER=podman override.
• smoke.sh preflight: briefly wait for the host-network socket to release after the container is reaped, instead of failing instantly.

2. rust token impl unavailable on the docker channel (Token interop)

Token interop ran the rust impl (which needs moq-token-cli on PATH) on every channel, but the docker channel installs no such binary — it covers the Rust verifier via the moqdev/moq-token-cli image (rust-docker). So every rust generator/verifier combo failed with "generator/verifier unavailable".

Fix: drop plain rust from the impl set on the docker channel (.github/workflows/smoke.yml), keeping js-node, js-bun, and rust-docker — which the CI run log shows already cross-verify. Other channels are unchanged.

Verification

• Negative control fix: confirmed on CI — the docker job's Smoke and Negative control both passed (Negative control passed on docker for the first time). Also exercised the shared smoke.sh changes locally (non-docker channel) running Smoke then Negative control back-to-back with no manual port clearing: both pass.
• Token interop fix: the same CI run showed js-node/js-bun/rust-docker token combos all PASS; only the rust combos failed (the bug this commit removes). --network host and the docker token image are Linux-only, so the docker path is validated by CI.

Notes for reviewers

• Container name defaults to moq-relay-smoke, overridable via MOQ_RELAY_CONTAINER.
• No change to any client-under-test or to the media path — purely harness/CI lifecycle.

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

The changes introduce a stable container name (moq-relay-smoke by default, configurable via MOQ_RELAY_CONTAINER) shared between the relay wrapper and the smoke test harness. The relay wrapper (clients/docker/moq-relay) removes any pre-existing container with that name before starting and passes --name "$name" to the container runtime. In smoke.sh, the variable is exported, cleanup() is extended to forcibly remove the named container when using the docker channel, and a retry loop polling /certificate.sha256 is added before the stale-relay readiness check to allow the port to fully release between runs.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately describes the main changes: fixing CI steps for the docker channel's negative-control and token-interop tests that were previously blocked by an earlier failing step.
Description check	✅ Passed	The description is directly related to the changeset, providing detailed background on the bugs fixed, the specific changes made to relay container lifecycle management and token configuration, and verification of the fixes.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/docker-relay-container-leak

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@smoke.sh`:
- Around line 134-136: The cleanup condition in the RELAY_CONTAINER removal
block currently only checks if the RELAY_CONTAINER variable is set and if
docker/podman exists on PATH, but does not verify that docker was actually
selected as the relay channel for the current test run. Modify the conditional
to additionally check that the relay channel was actually set to docker before
attempting to remove the container, preventing accidental deletion of unrelated
containers when docker exists on the system but was not used for the relay in
this particular test execution.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8f815c8f-0f9a-49e9-bd2d-bde7bfebd1b1

📥 Commits

Reviewing files that changed from the base of the PR and between ff9bd39 and e7f2497.

📒 Files selected for processing (2)

• clients/docker/moq-relay
• smoke.sh