rig dep update

rig/ctrl/deps.sh

@@ -341,7 +341,12 @@ CORE_TOOLS="kubectl jq"
 # because it is what wires a cluster to a local registry — without one, an
 # unqualified image name resolves to docker.io/library/<name> and there is
 # nothing structural stopping a push there.
-DEV_TOOLS="kind tilt ctlptl"
+#
+# docker-compose is 'dev' for the same reason, and is here because the distro
+# docker packages ship the daemon and CLI but frequently not the compose
+# plugin — so `docker compose up` fails with "unknown command" on an otherwise
+# working Docker, and nothing about that message names the missing piece.
+DEV_TOOLS="kind tilt ctlptl docker-compose"
 
 # ── what is already on this machine ───────────────────────────────────────
 #
@@ -358,6 +363,7 @@ pin_of() {
         kind)    echo "$KIND_VERSION" ;;
         tilt)    echo "$TILT_VERSION" ;;
         ctlptl)  echo "$CTLPTL_VERSION" ;;
+        docker-compose) echo "$COMPOSE_VERSION" ;;
     esac
 }
 
@@ -406,6 +412,23 @@ detect_toolchain() {
     for b in $(tier_tools "$tier"); do
         pin=$(pin_of "$b")
         path=$(command -v "$b" 2>/dev/null || true)
+        # compose is the one tool that is normally NOT a binary on PATH. It is a
+        # docker CLI plugin, so a machine where `docker compose` works perfectly
+        # has no `docker-compose` to find — and probing only PATH would report it
+        # missing and re-download a copy that is already there. That is the exact
+        # noise the version-aware skip exists to prevent, so ask docker instead.
+        if [ "$b" = docker-compose ] && [ -z "$path" ]; then
+            if found=$(docker compose version --short 2>/dev/null) && [ -n "$found" ]; then
+                if [ "${found#v}" = "${pin#v}" ]; then
+                    printf "    %-8s %-9s %s\n" "$b" "$pin" "docker cli plugin"
+                else
+                    printf "  ! %-8s wants %s, the docker cli plugin reports '%s'\n" \
+                        "$b" "$pin" "$found"
+                    TOOLCHAIN_NEED+="$b "
+                fi
+                continue
+            fi
+        fi
         if [ -z "$path" ]; then
             printf "  - %-8s %-9s not found\n" "$b" "$pin"
             TOOLCHAIN_NEED+="$b "
@@ -455,6 +478,9 @@ fetch() {
         if want kind;   then fetch_bin kind   "$KIND_URL"   "$KIND_SHA256"   "$dest"; fi
         if want tilt;   then fetch_tgz tilt   "$TILT_URL"   "$TILT_SHA256"   "$dest" tilt   0; fi
         if want ctlptl; then fetch_tgz ctlptl "$CTLPTL_URL" "$CTLPTL_SHA256" "$dest" ctlptl 0; fi
+        if want docker-compose; then
+            fetch_bin docker-compose "$COMPOSE_URL" "$COMPOSE_SHA256" "$dest"
+        fi
     fi
 
     fix_ownership "$dest"
@@ -520,6 +546,30 @@ warn_shadowing() {
       OUT_BIN=\$PWD/def/bin make deps   # then put that dir first in PATH")
 }
 
+# A copy in OUT_BIN only gives you `docker-compose`. That hyphenated form is the
+# retired v1 spelling; every compose file written in the last few years assumes
+# `docker compose`, which resolves plugins BY NAME out of a plugin directory.
+# So the binary is fetched like any other and then linked, in your own home —
+# no root, and nothing outside it.
+install_compose_plugin() {
+    local src="$OUT_BIN/docker-compose" dir="$HOME/.docker/cli-plugins"
+    [ -x "$src" ] || return 0
+    mkdir -p "$dir"
+    # Something else already owns that name — docker-desktop and some distro
+    # packages install a real file there. Overwriting it would take the plugin
+    # away from whatever put it there, so say so and let the user decide.
+    if [ -e "$dir/docker-compose" ] && [ ! -L "$dir/docker-compose" ]; then
+        MANUAL+=("Something already installs the compose plugin at
+      $dir/docker-compose
+  To use rig's pinned build instead:
+      ln -sf $src $dir/docker-compose")
+        return 0
+    fi
+    ln -sfn "$src" "$dir/docker-compose"
+    echo "  compose plugin -> $dir/docker-compose"
+    return 0
+}
+
 install() {
     local tier="${1:-dev}" b
     TIER="$tier"
@@ -538,6 +588,12 @@ install() {
         if [ "$tier" = "core" ]; then
             echo "  (no kind/tilt — 'make deps dev' adds them)"
         fi
+        # Only when compose was one of the things fetched: linking a binary
+        # that is already satisfied elsewhere on PATH would point the plugin at
+        # a copy rig did not install.
+        case " $TOOLCHAIN_NEED " in
+            *" docker-compose "*) install_compose_plugin ;;
+        esac
 
         # Only worth saying when something actually landed in OUT_BIN. When every
         # tool was satisfied elsewhere, OUT_BIN may reasonably be off PATH, and

rig/ctrl/versions.env

@@ -44,6 +44,15 @@ JQ_VERSION=1.8.2
 JQ_SHA256=b1c22172dd303f3be49e935aa56aa48a8b7a46e0bc838b4997d3bb451495870f
 JQ_URL=https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/jq-linux-amd64
 
+# docker compose — the distro docker packages ship the daemon and the CLI but
+# frequently not this, so `docker compose up` fails with "unknown command" on an
+# otherwise working Docker. It is a CLI plugin, found by NAME in a plugin
+# directory, so a copy in the bin dir alone only gives you the retired
+# `docker-compose` v1 spelling; deps.sh links it into ~/.docker/cli-plugins.
+COMPOSE_VERSION=5.5.1
+COMPOSE_SHA256=db1889184726840f75c4f9c001048430d4f25b3be3cb084d3ddd762bc0aed576
+COMPOSE_URL=https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-linux-x86_64
+
 # Node images shipped with KIND_VERSION above, pinned by digest so a kind upgrade
 # can never silently move the k8s version. Profiles select one via K8S_VERSION.
 # Older entries are kept deliberately: running a trailing-edge control plane is