Method provisionContainer

src/node/runtime/DockerRuntime.ts:675–786

* Provision container: create, sync project, checkout branch. * Throws on error (does not call logComplete - caller handles that). * Used by postCreateSetup() for streaming logs before initWorkspace().

(params: {
    containerName: string;
    projectPath: string;
    workspacePath: string;
    branchName: string;
    trunkBranch: string;
    initLogger: InitLogger;
    abortSignal?: AbortSignal;
    env?: Record<string, string>;
    trusted?: boolean;
  })

   * Used by postCreateSetup() for streaming logs before initWorkspace().
   */
  private async provisionContainer(params: {
    containerName: string;
    projectPath: string;
    workspacePath: string;
    branchName: string;
    trunkBranch: string;
    initLogger: InitLogger;
    abortSignal?: AbortSignal;
    env?: Record<string, string>;
    trusted?: boolean;
  }): Promise<void> {
    const {
      containerName,
      projectPath,
      workspacePath,
      branchName,
      trunkBranch,
      initLogger,
      abortSignal,
      env,
    } = params;

    // 1. Create container (with image pull if needed)
    initLogger.logStep(`Creating container from ${this.config.image}...`);

    if (abortSignal?.aborted) {
      throw new Error("Workspace creation aborted");
    }

    // Create and start container with streaming output for image pull progress
    const runResult = await streamDockerRun(containerName, this.config.image, initLogger, {
      abortSignal,
      shareCredentials: this.config.shareCredentials,
    });
    if (runResult.exitCode !== 0) {
      await runDockerCommand(`docker rm -f ${containerName}`, 10000);
      throw new Error(`Failed to create container: ${runResult.stderr}`);
    }

    // Detect container's default user (may be non-root, e.g., codercom/enterprise-base runs as "coder")
    const containerUser = await this.detectContainerUser(containerName, abortSignal);
    this.storeContainerUserInfo(containerUser);

    // Create /src directory and /var/mux/plans in container.
    // /var/mux is used instead of ~/.mux because /root has 700 permissions,
    // which makes it inaccessible to VS Code Dev Containers (non-root user).
    initLogger.logStep("Preparing workspace directory...");
    const mkdirResult = await this.prepareWorkspaceDirectories(
      containerName,
      containerUser,
      abortSignal
    );
    if (mkdirResult.exitCode !== 0) {
      await runDockerCommand(`docker rm -f ${containerName}`, 10000);
      throw new Error(`Failed to create workspace directory: ${mkdirResult.stderr}`);
    }

    initLogger.logStep("Container ready");