{ "schemaVersion": 3, "dataset": { "version": 3, "date": "2026-08-13", "group": { "id": "developer-infrastructure", "name": "Developer Infrastructure" }, "repository": { "id": "testcontainers-go", "repo": "testcontainers/testcontainers-go", "name": "Testcontainers for Go", "keywords": [ "Testcontainers" ] }, "context": { "repository": "testcontainers/testcontainers-go", "url": "https://github.com/testcontainers/testcontainers-go", "description": "Testcontainers for Go is a Go package that makes it simple to create and clean up container-based dependencies for automated integration/smoke tests. The clean, easy-to-use API enables developers to programmatically define containers that should be run as part of a test and clean up those resources when the test is done.", "homepage": "https://golang.testcontainers.org", "language": "Go", "topics": [ "automation", "docker", "go", "golang", "hacktoberfest", "testcontainers", "testcontainers-go", "testing" ], "license": "MIT", "defaultBranch": "main", "stars": 4949, "forks": 628, "openIssues": 162, "archived": false, "collectedAt": "2026-08-13T18:02:09.926681+00:00" }, "news": { "repository": "testcontainers/testcontainers-go", "collectedAt": "2026-08-13T18:02:09.926681+00:00", "latestRelease": { "repository": "testcontainers/testcontainers-go", "tag": "v0.44.0", "title": "v0.44.0", "url": "https://github.com/testcontainers/testcontainers-go/releases/tag/v0.44.0", "publishedAt": "2026-08-07T10:53:52Z", "notes": "# What's Changed\r\n## ๐Ÿ”’ Security\r\n\r\n* security: fix Dependabot alerts for grpc and OTel (#3835) @mdelapenya\r\n\r\n## ๐Ÿš€ Features\r\n\r\n* feat: allow overriding the session ID (#3051) @jcmfernandes\r\n* feat: add Azure SQL Edge module (#3787) @mdelapenya\r\n* feat: add S3Mock module (#3781) @mdelapenya\r\n* feat: add Fake-GCS-Server module (#3770) @mdelapenya\r\n* feat: add Typesense module (#3786) @mdelapenya\r\n* feat: add Firebird module (#3771) @mdelapenya\r\n* feat: add CouchDB module (#3768) @mdelapenya\r\n* feat: add Mosquitto module (#3774) @mdelapenya\r\n* feat: add Papercut-SMTP module (#3777) @mdelapenya\r\n* feat: add Timeplus module (#3784) @mdelapenya\r\n* feat: add Solr module (#3783) @mdelapenya\r\n* feat: add SFTP module (#3782) @mdelapenya\r\n* feat: add RavenDB module (#3780) @mdelapenya\r\n* feat: add QuestDB module (#3779) @mdelapenya\r\n* feat: add Presto module (#3778) @mdelapenya\r\n* feat: add OrientDB module (#3776) @mdelapenya\r\n* feat: add Nginx module (#3775) @mdelapenya\r\n* feat: add Mailpit module (#3773) @mdelapenya\r\n* feat: add Trino module (#3785) @mdelapenya\r\n* feat: add KurrentDB module (#3772) @mdelapenya\r\n* feat: add CrateDB module (#3769) @mdelapenya\r\n* feat: add ActiveMQ Classic module (#3767) @mdelapenya\r\n* feat: add ability to chain WithConfigModifier, WithEndpointSettingsModifier and WithHostConfigModifier (#3733) @LaurentGoderre\r\n\r\n## ๐Ÿ› Bug Fixes\r\n\r\n* fix: escape the container name in the Docker name filter (#3837) @jcmfernandes\r\n* fix: should print max information by default (#3459) @strowk\r\n* fix: read exec exit code only after draining the output stream (#3766) @dean-island\r\n* fix: properly wait for Ryuk startup when reusing reaper (#3761) @karsov\r\n* fix(openfga): remove playground wait from Run and up image to v1.18.0 (#3745) @selvakannanjr\r\n\r\n## ๐Ÿ“– Documentation\r\n\r\n* docs: fix incomplete CleanupContainer documentation (#3826) @Hashim1999164\r\n* docs: fix typo in SkipIfProviderIsNotHealthy docstring (#3764) @salandered\r\n* chore: update modules usage metrics (2026-07) (#3759) @[github-actions[bot]](https://github.com/apps/github-actions)\r\n* chore: update usage metrics (2026-07) (#3757) @[github-actions[bot]](https://github.com/apps/github-actions)\r\n* chore(metrics): usage metrics for modules (#3737) @mdelapenya\r\n* docs(site): add missing languages and reorder docs navigation (#3735) @mdelapenya\r\n\r\n## ๐Ÿงน Housekeeping\r\n\r\n* chore: update usage metrics (2026-08) (#3830) @[github-actions[bot]](https://github.com/apps/github-actions)\r\n* chore: update modules usage metrics (2026-08) (#3831) @[github-actions[bot]](https://github.com/apps/github-actions)\r\n* fix: correct indentation in dependabot.yml (#3808) @mdelapenya\r\n* chore(compose): use require instead of assert for service name checks (#3765) @sunghyun1999\r\n* chore: update usage metrics (2026-07) (#3757) @[github-actions[bot]](https://github.com/apps/github-actions)\r\n* chore(wait): replace manual StrategyTarget mocks with generated mockery mocks (#3603) @mateenali66\r\n* chore: use testify's require instead of assert (#3740) @TheRodzz\r\n* fix(metrics): harden collect.go and modules workflow (#3738) @mdelapenya\r\n\r\n## ๐Ÿ“ฆ Dependency updates\r\n\r\n* chore(deps): bump slackapi/slack-github-action from 3.0.3 to 4.0.0 (#3788) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#3789) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump docker/setup-docker-action from 5.1.0 to 5.4.0 (#3790) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(azurite): tidy module dependencies (#3838) @mdelapenya\r\n* security: fix Dependabot alerts for grpc and OTel (#3835) @mdelapenya\r\n* chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1.6.0 to 1.8.0 in /modules/azure (#3805) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets from 1.4.0 to 1.5.0 in /modules/azure (#3806) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /modules/weaviate (#3820) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /modules/qdrant (#3821) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 in /modules/grafana-lgtm (#3822) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.82.1 in /modules/gcloud (#3823) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /modules/compose (#3824) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore: propagate azcore dependency update to azurite module (#3818) @mdelapenya\r\n* chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.21.1 to 1.22.0 in /modules/azure (#3809) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#3791) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.5 to 4.26.6 (#3750) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/data/azcosmos from 1.4.1 to 1.5.0 in /modules/azure (#3810) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.17.5 to 1.19.29 in /modules/localstack (#3812) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.28 to 1.19.29 in /modules/s3mock (#3813) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.17.46 to 1.19.29 in /modules/scylladb (#3814) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 in /modules/azure (#3811) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 in /modules/azure (#3794) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/go-stomp/stomp/v3 from 3.0.5 to 3.1.5 in /modules/artemis (#3801) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 in /modules/azure (#3803) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump software.sslmate.com/src/go-pkcs12 from 0.6.0 to 0.7.3 in /modules/cassandra (#3804) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 in /modules/elasticsearch (#3796) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 in /modules/kafka (#3797) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/arangodb/go-driver/v2 from 2.1.3 to 2.3.1 in /modules/arangodb (#3800) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.54.0 in /modules/dex (#3795) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump github.com/aerospike/aerospike-client-go/v8 from 8.6.0 to 8.7.0 in /modules/aerospike (#3799) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /modules/dex (#3763) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 in /modules/dex (#3758) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 in /modulegen (#3751) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/mod from 0.33.0 to 0.37.0 in /modules/redpanda (#3756) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golangci/golangci-lint-action from 7.0.0 to 9.3.0 (#3748) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump tj-actions/changed-files from 47.0.1 to 47.0.6 (#3746) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump SonarSource/sonarqube-scan-action from 5.1.0 to 8.2.0 (#3747) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0 (#3749) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/text from 0.34.0 to 0.38.0 in /modulegen (#3752) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/mod from 0.33.0 to 0.37.0 in /modules/elasticsearch (#3753) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/mod from 0.33.0 to 0.37.0 in /modules/kafka (#3754) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump golang.org/x/mod from 0.33.0 to 0.37.0 in /modules/localstack (#3755) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump actions/github-script from 7.0.1 to 9.0.0 (#3675) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump pymdown-extensions from 10.16.1 to 10.21.3 (#3707) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump go.mongodb.org/mongo-driver/v2 from 2.3.0 to 2.4.2 in /modules/mongodb (#3730) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): bump go.mongodb.org/mongo-driver from 1.14.0 to 1.17.7 in /modules/weaviate (#3731) @[dependabot[bot]](https://github.com/apps/dependabot)\r\n* chore(deps): update moby to latest version (#3736) @Steven-Harris\r\n", "highlights": [ "๐Ÿ”’ Security", "security: fix Dependabot alerts for grpc and OTel (#3835) @mdelapenya", "๐Ÿš€ Features", "feat: allow overriding the session ID (#3051) @jcmfernandes", "feat: add Azure SQL Edge module (#3787) @mdelapenya", "feat: add S3Mock module (#3781) @mdelapenya" ], "prerelease": false }, "upcoming": [], "communityDiscussions": [] }, "runs": [ { "collectedAt": "2026-08-13T12:26:38.318Z", "since": "2026-08-12T12:26:38.318Z", "observedCount": 1, "changedCount": 1 }, { "collectedAt": "2026-08-13T13:48:00.446149Z", "since": "2026-08-12T13:48:00.446149Z", "observedCount": 1, "changedCount": 1 }, { "collectedAt": "2026-08-13T16:19:22.035158Z", "since": "2026-08-12T16:19:22.035158Z", "observedCount": 1, "changedCount": 0 }, { "collectedAt": "2026-08-13T17:43:20.785491Z", "since": "2026-08-12T17:43:20.785491Z", "observedCount": 2, "changedCount": 1 }, { "collectedAt": "2026-08-13T17:47:07.884300Z", "since": "2026-08-12T17:47:07.884300Z", "observedCount": 2, "changedCount": 0 }, { "collectedAt": "2026-08-13T18:01:55.420671Z", "since": "2026-08-12T18:01:55.420671Z", "observedCount": 2, "changedCount": 0 } ], "signals": [ { "id": "github:testcontainers/testcontainers-go:issue:3662", "source": "github", "group": "developer-infrastructure", "project": "testcontainers/testcontainers-go", "kind": "issue", "title": "[Feature]: Honor DOCKER_HOST scheme when launching Ryuk (TCP/TLS daemon support)", "text": "## Problem When `DOCKER_HOST` points at a TCP daemon (`tcp://...` or `https://...`), testcontainers-go itself talks to that endpoint correctly โ€” but Ryuk gets launched with a hard-coded bind-mount of the host Docker socket: ```go // reaper.go ~line 385 hc.Binds = []string{dockerHostMount + \":/var/run/docker.sock\"} ``` This breaks any setup where the test process accesses Docker through a TCP endpoint instead of `/var/run/docker.sock`. Ryuk's own Docker client already honors `DOCKER_HOST` / `DOCKER_TLS_VERIFY` / `DOCKER_CERT_PATH` (see [moby-ryuk main.go](https://github.com/testcontainers/moby-ryuk/blob/main/main.go)), but testcontainers-go never propagates that configuration into Ryuk's env. **Concrete use case**: per-user sandbox isolation on a shared macOS development host. Each user has their own per-user Docker proxy โ€” a policy gate in front of the real daemon that restricts privileged containers, validates bind-mount paths to the user's workspace, and tags containers with an owner label. The proxy listens on TLS-protected `127.0.0.1:NNNN` (per-user CA + mutual auth), not a raw Unix socket. The test process is configured with: ```bash DOCKER_HOST=tcp://localhost:40006 DOCKER_TLS_VERIFY=1 DOCKER_CERT_PATH=/Users//.docker-proxy ``` Everything works โ€” **except Ryuk**, because testcontainers-go's reaper tries to bind-mount a Unix socket regardless of the scheme. The bind either fails outright (no Unix socket exists on the host) or, if a Unix socket bind exists but the only working endpoint is TLS, Ryuk reports `Cannot connect to the Docker daemon` and times out. There is no env var (`TESTCONTAINERS_RYUK_DOCKER_SOCKET_OVERRIDE` exists in the Java client but not here) to override the bind. **Related**: [testcontainers-java #9137](https://github.com/testcontainers/testcontainers-java/issues/9137) describes the same bug in the Java client โ€” open since August 2024, no fix. Same root cause; both clients hard-code the Unix-socket bind. --- ## Solution Branch on the scheme of `tcConfig.Host` in `reaper.go` `newReaper`: | `DOCKER_HOST` scheme | Ryuk container setup | |---|---| | `unix://` (current default) | Bind-mount the socket โ€” **unchanged** | | `tcp://` / `https://` | Don't bind-mount; set `DOCKER_HOST` env on Ryuk. Translate `localhost`/`127.0.0.1` to gateway IP using existing `getGatewayIP` machinery (the same translation already added for #1373). | | TLS enabled (`TLSVerify=1` + `CertPath` non-empty) | Bind-mount the cert dir to a fixed in-container path (e.g. `/certs`), set `DOCKER_TLS_VERIFY=1` and `DOCKER_CERT_PATH=/certs` env vars on Ryuk. | The config struct in `internal/config/config.go` already exposes `Config.Host`, `Config.TLSVerify`, and `Config.CertPath`. The reaper just needs to read those fields and propagate them to Ryuk's environment instead of hard-coding the bind. Estimated diff: ~40 lines in `reaper.go` + a small helper for host translation + ~80 lines of table-driven tests. --- ## Benefit - Unblocks per-user / per-team Docker-proxy deployments โ€” sandbox isolation, multi-tenant CI runners, audited environments, restricted hosts. - Aligns testcontainers-go with what `moby-ryuk` already supports โ€” no upstream Ryuk change needed. - Users on plain Docker Desktop / OrbStack get exactly the current behavior; the Unix-socket path is preserved as the default. - Closes the long-standing parallel gap with testcontainers-java. --- ## Alternatives 1. **Disable Ryuk (`TESTCONTAINERS_RYUK_DISABLED=true`)** โ€” current workaround, but loses cleanup-on-test-crash, which is the whole point of Ryuk. 2. **Run a custom reaper outside testcontainers** โ€” defeats the purpose of using the library. 3. **Modify Ryuk's image upstream** โ€” not needed; Ryuk already supports `DOCKER_HOST` / `DOCKER_TLS_VERIFY` / `DOCKER_CERT_PATH`. The gap is purely on the testcontainers-go side. --- ## Contribute **Yes** โ€” happy to draft the PR if the maintainers are open to this direction. Posting an issue first to confirm the approach before writing code.", "url": "https://github.com/testcontainers/testcontainers-go/issues/3662", "createdAt": "2026-04-26T18:07:13Z", "updatedAt": "2026-08-12T19:17:34Z", "timestamp": "2026-08-12T19:17:34Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [], "author": "BorisTyshkevich", "state": "open", "assignees": [] }, { "id": "github:testcontainers/testcontainers-go:pull_request:3841", "source": "github", "group": "developer-infrastructure", "project": "testcontainers/testcontainers-go", "kind": "pull_request", "title": "fix: return reaper handshake errors", "text": "This supersedes #3828. The original PR was automatically closed after I accidentally deleted my fork ## Related issues - Closes #3827 ## What does this PR do? This PR makes `Reaper.connect` perform the Ryuk handshake synchronously before returning a successful connection. If the handshake fails, the connection is closed and the handshake error is returned to the caller. The existing retry path can then handle the failure instead of treating the reaper connection as successful. It also adds a regression test using a local TCP listener that returns an invalid ACK, verifying that `connect` returns an error and no termination channel. ## Why is it important? Previously, handshake failures were only logged inside the connection goroutine. `Reaper.connect` still returned a non-nil termination channel and nil error, so callers could believe the reaper was connected even though Ryuk had rejected or failed the handshake. Returning the error makes reaper startup failures visible and retryable. ## How to test this PR ```shell go test ./ -run \"TestReaperConnectReturnsHandshakeError|TestSpawnerRetryError|TestSpawnerBackoff\"", "url": "https://github.com/testcontainers/testcontainers-go/pull/3841", "createdAt": "2026-08-06T17:26:16Z", "updatedAt": "2026-08-13T17:21:01Z", "timestamp": "2026-08-13T17:21:01Z", "metrics": { "reactions": 0, "comments": 3 }, "labels": [], "author": "drawliin", "state": "open", "assignees": [] } ], "events": [ { "id": "event:a9670ae2acf6698b9fd5", "signalId": "github:testcontainers/testcontainers-go:issue:3662", "event": "changed", "observedAt": "2026-08-13T13:48:00.446149Z", "changedFields": [], "signal": { "id": "github:testcontainers/testcontainers-go:issue:3662", "source": "github", "group": "developer-infrastructure", "project": "testcontainers/testcontainers-go", "kind": "issue", "title": "[Feature]: Honor DOCKER_HOST scheme when launching Ryuk (TCP/TLS daemon support)", "text": "## Problem When `DOCKER_HOST` points at a TCP daemon (`tcp://...` or `https://...`), testcontainers-go itself talks to that endpoint correctly โ€” but Ryuk gets launched with a hard-coded bind-mount of the host Docker socket: ```go // reaper.go ~line 385 hc.Binds = []string{dockerHostMount + \":/var/run/docker.sock\"} ``` This breaks any setup where the test process accesses Docker through a TCP endpoint instead of `/var/run/docker.sock`. Ryuk's own Docker client already honors `DOCKER_HOST` / `DOCKER_TLS_VERIFY` / `DOCKER_CERT_PATH` (see [moby-ryuk main.go](https://github.com/testcontainers/moby-ryuk/blob/main/main.go)), but testcontainers-go never propagates that configuration into Ryuk's env. **Concrete use case**: per-user sandbox isolation on a shared macOS development host. Each user has their own per-user Docker proxy โ€” a policy gate in front of the real daemon that restricts privileged containers, validates bind-mount paths to the user's workspace, and tags containers with an owner label. The proxy listens on TLS-protected `127.0.0.1:NNNN` (per-user CA + mutual auth), not a raw Unix socket. The test process is configured with: ```bash DOCKER_HOST=tcp://localhost:40006 DOCKER_TLS_VERIFY=1 DOCKER_CERT_PATH=/Users//.docker-proxy ``` Everything works โ€” **except Ryuk**, because testcontainers-go's reaper tries to bind-mount a Unix socket regardless of the scheme. The bind either fails outright (no Unix socket exists on the host) or, if a Unix socket bind exists but the only working endpoint is TLS, Ryuk reports `Cannot connect to the Docker daemon` and times out. There is no env var (`TESTCONTAINERS_RYUK_DOCKER_SOCKET_OVERRIDE` exists in the Java client but not here) to override the bind. **Related**: [testcontainers-java #9137](https://github.com/testcontainers/testcontainers-java/issues/9137) describes the same bug in the Java client โ€” open since August 2024, no fix. Same root cause; both clients hard-code the Unix-socket bind. --- ## Solution Branch on the scheme of `tcConfig.Host` in `reaper.go` `newReaper`: | `DOCKER_HOST` scheme | Ryuk container setup | |---|---| | `unix://` (current default) | Bind-mount the socket โ€” **unchanged** | | `tcp://` / `https://` | Don't bind-mount; set `DOCKER_HOST` env on Ryuk. Translate `localhost`/`127.0.0.1` to gateway IP using existing `getGatewayIP` machinery (the same translation already added for #1373). | | TLS enabled (`TLSVerify=1` + `CertPath` non-empty) | Bind-mount the cert dir to a fixed in-container path (e.g. `/certs`), set `DOCKER_TLS_VERIFY=1` and `DOCKER_CERT_PATH=/certs` env vars on Ryuk. | The config struct in `internal/config/config.go` already exposes `Config.Host`, `Config.TLSVerify`, and `Config.CertPath`. The reaper just needs to read those fields and propagate them to Ryuk's environment instead of hard-coding the bind. Estimated diff: ~40 lines in `reaper.go` + a small helper for host translation + ~80 lines of table-driven tests. --- ## Benefit - Unblocks per-user / per-team Docker-proxy deployments โ€” sandbox isolation, multi-tenant CI runners, audited environments, restricted hosts. - Aligns testcontainers-go with what `moby-ryuk` already supports โ€” no upstream Ryuk change needed. - Users on plain Docker Desktop / OrbStack get exactly the current behavior; the Unix-socket path is preserved as the default. - Closes the long-standing parallel gap with testcontainers-java. --- ## Alternatives 1. **Disable Ryuk (`TESTCONTAINERS_RYUK_DISABLED=true`)** โ€” current workaround, but loses cleanup-on-test-crash, which is the whole point of Ryuk. 2. **Run a custom reaper outside testcontainers** โ€” defeats the purpose of using the library. 3. **Modify Ryuk's image upstream** โ€” not needed; Ryuk already supports `DOCKER_HOST` / `DOCKER_TLS_VERIFY` / `DOCKER_CERT_PATH`. The gap is purely on the testcontainers-go side. --- ## Contribute **Yes** โ€” happy to draft the PR if the maintainers are open to this direction. Posting an issue first to confirm the approach before writing code.", "url": "https://github.com/testcontainers/testcontainers-go/issues/3662", "createdAt": "2026-04-26T18:07:13Z", "updatedAt": "2026-08-12T19:17:34Z", "timestamp": "2026-08-12T19:17:34Z", "metrics": { "reactions": 0, "comments": 2 }, "labels": [], "author": "BorisTyshkevich", "state": "open", "assignees": [], "change": "updated" } }, { "id": "event:02f562b5b43f4db0762a", "signalId": "github:testcontainers/testcontainers-go:pull_request:3841", "event": "discovered", "observedAt": "2026-08-13T17:43:20.785491Z", "changedFields": [], "signal": { "id": "github:testcontainers/testcontainers-go:pull_request:3841", "source": "github", "group": "developer-infrastructure", "project": "testcontainers/testcontainers-go", "kind": "pull_request", "title": "fix: return reaper handshake errors", "text": "This supersedes #3828. The original PR was automatically closed after I accidentally deleted my fork ## Related issues - Closes #3827 ## What does this PR do? This PR makes `Reaper.connect` perform the Ryuk handshake synchronously before returning a successful connection. If the handshake fails, the connection is closed and the handshake error is returned to the caller. The existing retry path can then handle the failure instead of treating the reaper connection as successful. It also adds a regression test using a local TCP listener that returns an invalid ACK, verifying that `connect` returns an error and no termination channel. ## Why is it important? Previously, handshake failures were only logged inside the connection goroutine. `Reaper.connect` still returned a non-nil termination channel and nil error, so callers could believe the reaper was connected even though Ryuk had rejected or failed the handshake. Returning the error makes reaper startup failures visible and retryable. ## How to test this PR ```shell go test ./ -run \"TestReaperConnectReturnsHandshakeError|TestSpawnerRetryError|TestSpawnerBackoff\"", "url": "https://github.com/testcontainers/testcontainers-go/pull/3841", "createdAt": "2026-08-06T17:26:16Z", "updatedAt": "2026-08-13T17:21:01Z", "timestamp": "2026-08-13T17:21:01Z", "metrics": { "reactions": 0, "comments": 3 }, "labels": [], "author": "drawliin", "state": "open", "assignees": [], "change": "new" } } ] } }