supabase · Coly010 · Jul 28, 2026 · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026
@@ -53,14 +53,13 @@ validation is performed on the discovered URLs, also matching the Go CLI.
 
 ## Exit Codes
 
-| Code | Condition                                                              |
-| ---- | ---------------------------------------------------------------------- |
-| `0`  | clean shutdown after `SIGINT`, `SIGTERM`, or stdin close               |
-| `1`  | Docker unavailable / `docker info` fails                               |
-| `1`  | local DB container is not running                                      |
-| `1`  | invalid inspect flag combination or invalid project/auth config        |
-| `1`  | env file, signing key, import map, or function bind resolution failure |
-| `1`  | edge-runtime container startup, log streaming, or restart loop failure |
+| Code | Condition                                                                                                                                                                          |
+| ---- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `0`  | clean shutdown after `SIGINT`, `SIGTERM`, or stdin close                                                                                                                           |
+| `1`  | local DB container is not running, or the Docker daemon is unreachable (surfaces from the DB inspect as `failed to inspect service: …` plus the Docker Desktop install suggestion) |
+| `1`  | invalid inspect flag combination or invalid project/auth config                                                                                                                    |
+| `1`  | env file, signing key, import map, or function bind resolution failure                                                                                                             |
+| `1`  | edge-runtime container startup, log streaming, or restart loop failure                                                                                                             |
 
 ## Telemetry Events Fired
 

@@ -93,9 +93,11 @@ export interface LegacyEdgeRuntimeBringUpInput {
   /** `config.edge_runtime.inspector_port` — only published when `inspectMode` is set, which `start` never does (Go's `serve.RuntimeOption{}` zero value). */
   readonly edgeRuntimeInspectorPort: number;
   /**
-   * `config.edge_runtime.secrets`, already unwrapped/uppercased — build via
-   * `shared/functions/serve.ts`'s exported `toPlainEdgeRuntimeConfig(config.edge_runtime).secrets`
-   * rather than re-deriving the `Redacted`-unwrap/uppercase logic here.
+   * `config.edge_runtime.secrets`, already unwrapped — keys verbatim, empty
+   * and unresolved-`env()` values filtered out (Go's `SHA256 > 0` gate).
+   * Build via `shared/functions/serve.ts`'s exported
+   * `toPlainEdgeRuntimeConfig(config.edge_runtime).secrets` rather than
+   * re-deriving the `Redacted`-unwrap/zero-hash-filter logic here.
    */
   readonly edgeRuntimeSecrets: Readonly<Record<string, string>>;
   /**

@@ -4515,7 +4515,7 @@ content_path = "./templates/custom_notice.html"
       () => {
         const { layer, child } = setup({
           configContents:
-            'project_id = "demo"\n[edge_runtime.secrets]\nMY_SECRET = "shh-do-not-tell"\n',
+            'project_id = "demo"\n[edge_runtime.secrets]\nMY_SECRET = "shh-do-not-tell"\nmy_lower_secret = "keep-me"\nEMPTY_SECRET = ""\n',
         });
         return Effect.gen(function* () {
           yield* legacyStart(flags());
@@ -4528,6 +4528,14 @@ content_path = "./templates/custom_notice.html"
           expect(envFilePath).toBeDefined();
           const envFileContent = readFileSync(envFilePath ?? "", "utf-8");
           expect(envFileContent).toContain("MY_SECRET=shh-do-not-tell");
+          // Names reach the container UPPERCASED — Go's config loader applies
+          // `strings.ToUpper` to every secret key (`pkg/config/config.go:766-771`)
+          // — and empty values are skipped — Go's `set.ListSecrets` SHA256>0
+          // gate (`internal/secrets/set/set.go:48-52`), shared with
+          // `functions serve` via `toPlainEdgeRuntimeConfig`.
+          expect(envFileContent).toContain("MY_LOWER_SECRET=keep-me");
+          expect(envFileContent).not.toContain("my_lower_secret=");
+          expect(envFileContent).not.toContain("EMPTY_SECRET=");
         }).pipe(Effect.provide(layer));
       },
     );

@@ -12,10 +12,34 @@ export const LEGACY_SUGGEST_DOCKER_INSTALL =
  * subprocess-stderr equivalent of Go's `client.IsErrConnectionFailed` (which
  * inspects the Docker API client error). The docker / podman CLIs print
  * "Cannot connect to the Docker daemon …" / "Cannot connect to Podman …" (often
- * followed by "Is the docker daemon running?") when the socket is down.
+ * followed by "Is the docker daemon running?") when the socket is down, and
+ * "permission denied while trying to connect to the Docker daemon socket …"
+ * when the socket exists but the user can't open it — the pinned Docker SDK
+ * classifies that permission error as a connection failure too
+ * (`client/request.go:144-152`, docker/docker v28.5.2: `os.IsPermission` →
+ * `errConnectionFailed`), so Go surfaces the install hint for it as well.
+ *
+ * Also matches `spawnContainerCli`'s runtime-not-found message
+ * ("docker: command not found …", `legacy-container-cli.ts`): a missing
+ * container-CLI binary is the shell-out equivalent of Go's missing daemon
+ * socket — on a machine with no Docker installed, Go's socket dial fails,
+ * `client.IsErrConnectionFailed` fires, and the install hint is exactly the
+ * guidance that case needs (`misc.go:155-166`).
+ *
+ * "error during connect" is the pinned SDK's uniform outer wrap for every
+ * transport-level failure (`client/request.go:175-185`, docker/docker
+ * v28.5.2) and therefore the closest 1:1 stderr equivalent of
+ * `errConnectionFailed`'s breadth. It notably covers Windows daemon-down,
+ * where a failed npipe open is wrapped as "error during connect: this error
+ * may indicate that the docker daemon is not running: …" (elevated,
+ * `request.go:181`) or "… the docker client must be run with elevated
+ * privileges …" (non-elevated, `request.go:178`) — word orders none of the
+ * Unix-socket phrases match. The inner OS text ("The system cannot find the
+ * file specified") is localized per the SDK's own comment
+ * (`request.go:172-174`), so it is deliberately not matched.
  */
 export function legacyIsDockerDaemonUnreachable(stderr: string): boolean {
-  return /cannot connect to the docker daemon|cannot connect to podman|is the docker daemon running/iu.test(
+  return /cannot connect to the docker daemon|cannot connect to podman|is the docker daemon running|permission denied while trying to connect|docker: command not found|error during connect/iu.test(
     stderr,
   );
 }
@@ -15,12 +15,39 @@ describe("legacyIsDockerDaemonUnreachable", () => {
     // Case-insensitive + the podman phrasing.
     expect(legacyIsDockerDaemonUnreachable("cannot connect to podman")).toBe(true);
     expect(legacyIsDockerDaemonUnreachable("Is the docker daemon running?")).toBe(true);
+    // Socket permission errors are connection failures in the pinned Docker
+    // SDK (`client/request.go:144-152`, v28.5.2: `os.IsPermission` →
+    // `errConnectionFailed`), so Go attaches the install hint for them too.
+    expect(
+      legacyIsDockerDaemonUnreachable(
+        "permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock",
+      ),
+    ).toBe(true);
+    // No container runtime installed at all (`spawnContainerCli`'s
+    // runtime-not-found message) — the shell-out equivalent of Go's missing
+    // daemon socket, which `IsErrConnectionFailed` also classifies as a
+    // connection failure, so the install hint applies.
+    expect(
+      legacyIsDockerDaemonUnreachable(
+        "docker: command not found (podman also not found) — install Docker Desktop or Podman and ensure it is on PATH",
+      ),
+    ).toBe(true);
+    // Windows daemon-down: a failed npipe open is wrapped "error during
+    // connect" by the pinned SDK (`client/request.go:175-185`, v28.5.2) —
+    // both the elevated and the non-elevated variants.
+    expect(
+      legacyIsDockerDaemonUnreachable(
+        'error during connect: this error may indicate that the docker daemon is not running: Get "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/supabase_db_test/json": open //./pipe/docker_engine: The system cannot find the file specified.',
+      ),
+    ).toBe(true);
+    expect(
+      legacyIsDockerDaemonUnreachable(
+        "error during connect: in the default daemon configuration on Windows, the docker client must be run with elevated privileges to connect: open //./pipe/docker_engine: Access is denied.",
+      ),
+    ).toBe(true);
   });
 
-  it("does not flag an unrelated inspect failure (e.g. a permission error)", () => {
-    expect(legacyIsDockerDaemonUnreachable("permission denied while trying to connect")).toBe(
-      false,
-    );
+  it("does not flag an unrelated inspect failure", () => {
     expect(legacyIsDockerDaemonUnreachable("Error: No such container: supabase_db_x")).toBe(false);
     expect(legacyIsDockerDaemonUnreachable("")).toBe(false);
   });

@@ -2984,8 +2984,9 @@ export function legacyResolveLocalConfigValues(
  * JWKS fetch) there would tax two commands that never render a JWKS. This is a standalone sibling
  * `start`-only callers invoke separately, alongside (not instead of) `legacyResolveLocalConfigValues`.
  *
- * Divergences from the structurally similar (but functionally unrelated) `resolveAuthArtifacts` in
- * `shared/functions/serve.ts` (Go's equivalent call site for THAT function is
+ * Divergences from the structurally similar (but functionally unrelated)
+ * `resolveLocalAuthArtifacts`/`finalizeAuthArtifacts` pair in
+ * `shared/functions/serve.ts` (Go's equivalent call site for THAT pair is
  * `internal/functions/serve/`, out of scope for this port) — deliberately NOT copied here:
  *  - a remote-JWKS fetch failure is a hard, propagating error here (matching `start.go:274-277`
  *    returning the error outright); `serve.ts` instead swallows the failure and continues with

@@ -3018,7 +3018,7 @@ describe("legacyResolveLocalJwks", () => {
     });
 
     // The key divergence from `shared/functions/serve.ts`'s own (unrelated)
-    // `resolveAuthArtifacts`: Go's `start` treats a remote-JWKS fetch failure as a hard,
+    // `finalizeAuthArtifacts`: Go's `start` treats a remote-JWKS fetch failure as a hard,
     // command-failing error (`internal/start/start.go:274-277`) — `legacyResolveLocalJwks`
     // must propagate it too, not swallow it and continue with zero remote keys.
     it("fails the whole resolution when the remote JWKS fetch fails, unlike functions serve's leniency", async () => {

@@ -1327,7 +1327,7 @@ export const runChildProcess = Effect.fnUntraced(function* (
   return { exitCode, stdout, stderr };
 });
 
-export const isDockerRunning = Effect.fnUntraced(function* () {
+const isDockerRunning = Effect.fnUntraced(function* () {
   const result = yield* runChildProcess("docker", ["info"], {
     stdout: "ignore",
     stderr: "ignore",