Fix the docker channel's negative-control and token-interop CI steps

.github/workflows/smoke.yml

@@ -212,8 +212,16 @@ jobs:
       # tampered tokens and the wrong key.
       - name: Token interop
         run: |
-          impls="rust,js-node,js-bun"
-          # The Docker cell needs a daemon; GitHub's macOS runners have none, so
-          # it's Linux-only. (Docker is preinstalled on the Linux runners.)
-          if [ "$RUNNER_OS" = "Linux" ]; then impls="$impls,rust-docker"; fi
+          # The `rust` impl needs moq-token-cli on PATH, which only the
+          # cargo/apt/brew/nix channels install. The docker channel ships no such
+          # binary, so it exercises the Rust verifier through the
+          # moqdev/moq-token-cli image (rust-docker) instead of plain `rust`.
+          if [ "${{ matrix.channel }}" = "docker" ]; then
+            impls="js-node,js-bun,rust-docker"
+          else
+            impls="rust,js-node,js-bun"
+            # The Docker cell needs a daemon; GitHub's macOS runners have none, so
+            # it's Linux-only. (Docker is preinstalled on the Linux runners.)
+            if [ "$RUNNER_OS" = "Linux" ]; then impls="$impls,rust-docker"; fi
+          fi
           ./token.sh --generators "$impls" --verifiers "$impls"

clients/docker/moq-relay

@@ -16,8 +16,16 @@ set -euo pipefail
 runtime="${SMOKE_DOCKER:-docker}"
 image="${MOQ_RELAY_IMAGE:-moqdev/moq-relay}"
 
+# Give the container a stable name so smoke.sh can reap it. A SIGKILL of this
+# wrapper (how smoke.sh tears the relay down) kills the runtime client but leaves
+# the detached container running and still holding the relay's port, which then
+# blocks the next smoke.sh run in the same job. smoke.sh's cleanup removes it by
+# this name; clear any leftover from a crashed run here too, before we rebind.
+name="${MOQ_RELAY_CONTAINER:-moq-relay-smoke}"
+"$runtime" rm -f "$name" >/dev/null 2>&1 || true
+
 # smoke.sh passes the config path as the final argument.
 cfg="${*: -1}"
 dir=$(cd "$(dirname "$cfg")" && pwd)
 
-exec "$runtime" run --rm -i --network host -v "$dir:$dir" "$image" "$@"
+exec "$runtime" run --rm -i --name "$name" --network host -v "$dir:$dir" "$image" "$@"

smoke.sh

@@ -29,6 +29,11 @@ NEGATIVE=0
 # Binaries under test. Whatever channel installed them (cargo/brew/apt) just has
 # to leave them on PATH; override here to point at a specific build.
 RELAY="${RELAY_BIN:-moq-relay}"
+# Name of the docker-channel relay container, shared with clients/docker/moq-relay
+# so cleanup() can reap it after a SIGKILL of the wrapper (see cleanup()). Exported
+# so the wrapper binds the same name; ignored by the non-docker channels.
+RELAY_CONTAINER="${MOQ_RELAY_CONTAINER:-moq-relay-smoke}"
+export MOQ_RELAY_CONTAINER="$RELAY_CONTAINER"
 # The CLI's real binary name is `moq` (what the apt/rpm packages install). `cargo
 # install moq-cli` instead names it after the crate, `moq-cli`. Honor MOQ_BIN if
 # set, otherwise pick whichever name the channel left on PATH (resolved once the
@@ -123,6 +128,14 @@ cleanup() {
     # Reap the last publisher too; subscribers self-terminate via their timeouts.
     [[ -n "${PUB_PID:-}" ]] && kill_tree "$PUB_PID"
     [[ -n "$RELAY_PID" ]] && kill_tree "$RELAY_PID"
+    # The docker-channel relay runs in a container that outlives a SIGKILL of its
+    # wrapper's runtime client, so kill_tree alone leaves it holding the port and
+    # blocking the next run in the same job. Reap it by name -- but only when the
+    # docker wrapper is actually the relay, so a non-docker run on a host that
+    # happens to have docker doesn't delete an unrelated container of that name.
+    if [[ "$RELAY" == */clients/docker/moq-relay ]] && have "${SMOKE_DOCKER:-docker}"; then
+        "${SMOKE_DOCKER:-docker}" rm -f "$RELAY_CONTAINER" >/dev/null 2>&1 || true
+    fi
     rm -rf "$TMP"
 }
 trap cleanup EXIT
@@ -513,6 +526,13 @@ if needs gst; then
     fi
 fi
 
+# A relay from a previous run in the same job is reaped by cleanup(), but the
+# kernel can take a moment to release the (host-network) socket afterwards, so
+# wait briefly for the port to clear before treating it as a real conflict.
+for _ in $(seq 1 20); do
+    curl -sf "$URL/certificate.sha256" >/dev/null 2>&1 || break
+    sleep 0.5
+done
 if curl -sf "$URL/certificate.sha256" >/dev/null 2>&1; then
     echo "error: something is already listening on 127.0.0.1:4443 (stale relay?)" >&2
     exit 1