Add Docker install/upgrade support on Linux and Windows, with a version floor

[ptr727]

Closes the docker gaps tracked in #695: no version floor was declared, and host-setup/linux/install-tools.sh carried no install path for docker at all.

• spec/host-tools.json: docker now carries a target floor of 29.6.2, anchored to the Windows host issue spec/host-tools.json: docker and uv carry no version floor — propose starting points #695 recorded (Docker Desktop 4.85.0, Engine 29.6.2), plus source and remedy for linux, macos and windows.
• host-setup/linux/install-tools.sh: a real docker install/upgrade path, the same apt-repository shape gh and node already use here - removes old conflicting packages, registers download.docker.com's own repo with a verified signing key, installs docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin. Inside a detected WSL distribution it refuses the native install outright, with no override, and points at Docker Desktop's own WSL integration instead.
• host-setup/windows/install-tools.ps1: before installing or upgrading docker, checks that wsl.exe is present and WSL is at or above 2.1.5 (Docker Desktop's own documented floor), and skips with a named remedy otherwise. It never runs wsl --install/wsl --update itself - those stay upgrade-host.ps1 -Wsl and setup-wsl.ps1, a person's own action.
• scripts/test_bootstrap.py, docs/host-setup.md, host-setup/windows/README.md updated to match: the now-stale NOT_MANAGED['linux']['docker'] exception is removed, the floor table and comparison table are brought current.

Verification

On this machine (Linux, docker 29.7.1 already installed): spec/validate.py, scripts/host_gate.py, scripts/test_bootstrap.py all pass; shellcheck and PSScriptAnalyzer via the pinned CI images are clean on both modified scripts; markdownlint-cli2 and editorconfig-checker are clean. Exercised --report, --install/--upgrade --dry-run, and a simulated-WSL run (WSL_DISTRO_NAME set) against the real download.docker.com repository - the GPG key fetch and verification succeeded and the WSL path correctly refused with no apt commands attempted.

A real install/upgrade on a native Windows host and inside an actual WSL distribution has not been run in this session - the maintainer is following up with both separately.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR closes the Docker tooling gaps by adding a declared Docker Engine version floor (29.6.2) to the host tool spec and implementing first-class install/upgrade support for Docker on both Linux (apt repo) and Windows (winget), including explicit WSL handling.

Changes:

• Declare a target Docker Engine floor (29.6.2) in spec/host-tools.json, including source/remedy metadata.
• Add Docker install/upgrade support on Linux via Docker’s apt repository, with a hard skip inside WSL distributions.
• Add Windows Docker preflight checks to ensure WSL is present and meets Docker Desktop’s documented minimum before install/upgrade, and update docs/bootstrap tests accordingly.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
spec/host-tools.json	Adds Docker minimum version floor plus source/remedy text for each platform.
host-setup/linux/install-tools.sh	Adds Docker to managed tools and implements Docker apt-repo install/upgrade flow; detects and skips WSL distributions.
host-setup/windows/install-tools.ps1	Adds WSL readiness checks gated specifically for Docker, and surfaces notes during reporting.
scripts/test_bootstrap.py	Updates the “not managed” coverage assertions now that Docker is managed on Linux.
host-setup/windows/README.md	Documents the new Docker/WSL behavior and contrasts Linux vs Windows handling.
docs/host-setup.md	Updates the contract table and narrative to reflect the new Docker floor and install source expectations.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (2)

host-setup/windows/README.md:93

• The “Differences From the Linux Tooling” table columns are swapped for the docker/WSL row: the Linux column currently describes install-tools.ps1 (Windows) and the Windows column describes install-tools.sh (Linux), which makes the comparison misleading.

| `install-tools.ps1` checks the WSL *platform* version before installing docker | `install-tools.sh` refuses docker entirely inside a WSL *distribution* | Windows needs WSL2 present for Docker Desktop's own backend; a WSL distribution instead takes docker only from Docker Desktop's own WSL integration |

host-setup/linux/install-tools.sh:566

• In the WSL-distro case, docker_install always returns success even if docker is not on PATH, so --install docker can exit 0 with no failure recorded despite not installing (or providing) docker. Consider treating “WSL + docker missing” as a collected failure while still refusing the native install, so callers can detect the unmet contract.

    # A native install here would run a second engine beside Desktop's, so this is a skip rather than a failure, on the same pattern dotnet_feed uses for an architecture Microsoft's feed does not carry.
    if [[ $IS_WSL == true ]]; then
        warn "This is a WSL distribution, and docker here comes only from Docker Desktop's own WSL integration, never from installing docker-ce directly. Enable it in Docker Desktop under Settings, Resources, WSL integration, or check it from Windows with setup-wsl.ps1 -Status. Skipping the native install."
        return 0
    fi

[ptr727]

Addressing the two suppressed findings from the previous review round, both real, fixed in 810133c:

• host-setup/windows/README.md:93 - the docker/WSL comparison table row had its Linux and Windows columns swapped (install-tools.ps1 was described under Linux, install-tools.sh under Windows). Fixed.
• host-setup/linux/install-tools.sh:566 - docker_install on a WSL distribution now returns failure when docker is not on PATH there either, rather than always reporting success. A skip is success only where Docker Desktop's own WSL integration already answers; otherwise --install/--upgrade was exiting 0 having neither installed docker nor found it working. Verified by simulating a WSL distribution with docker genuinely absent: the run now exits 1 and names docker as failed.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

host-setup/linux/install-tools.sh:539

• docker_source() always reports download.docker.com, but inside a WSL distribution docker is explicitly expected to come from Docker Desktop’s WSL integration (and docker_install even refuses the native docker-ce path). This makes the report/list SOURCE column misleading on WSL hosts.

docker_source() { printf 'download.docker.com'; }

[ptr727]

Addressing the newest suppressed finding, fixed in d1cee0a:

• host-setup/linux/install-tools.sh:539 - docker_source always reported download.docker.com, even inside a WSL distribution where docker_install refuses that path outright and points at Docker Desktop's own WSL integration instead, so the --report/--list SOURCE column was misleading exactly where the WSL note already explains the real source. docker_source now reads IS_WSL the same way docker_install does, mirroring the existing dotnet_source precedent for a source that depends on host state.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.