rig dep update

rig/ctrl/deps.sh

@@ -341,7 +341,12 @@ CORE_TOOLS="kubectl jq"
 # because it is what wires a cluster to a local registry — without one, an
 # unqualified image name resolves to docker.io/library/<name> and there is
 # nothing structural stopping a push there.
-DEV_TOOLS="kind tilt ctlptl"
+#
+# docker-compose is 'dev' for the same reason, and is here because the distro
+# docker packages ship the daemon and CLI but frequently not the compose
+# plugin — so `docker compose up` fails with "unknown command" on an otherwise
+# working Docker, and nothing about that message names the missing piece.
+DEV_TOOLS="kind tilt ctlptl docker-compose"
 
 # ── what is already on this machine ───────────────────────────────────────
 #
@@ -358,6 +363,7 @@ pin_of() {
         kind)    echo "$KIND_VERSION" ;;
         tilt)    echo "$TILT_VERSION" ;;
         ctlptl)  echo "$CTLPTL_VERSION" ;;
+        docker-compose) echo "$COMPOSE_VERSION" ;;
     esac
 }
 
@@ -406,6 +412,23 @@ detect_toolchain() {
     for b in $(tier_tools "$tier"); do
         pin=$(pin_of "$b")
         path=$(command -v "$b" 2>/dev/null || true)
+        # compose is the one tool that is normally NOT a binary on PATH. It is a
+        # docker CLI plugin, so a machine where `docker compose` works perfectly
+        # has no `docker-compose` to find — and probing only PATH would report it
+        # missing and re-download a copy that is already there. That is the exact
+        # noise the version-aware skip exists to prevent, so ask docker instead.
+        if [ "$b" = docker-compose ] && [ -z "$path" ]; then
+            if found=$(docker compose version --short 2>/dev/null) && [ -n "$found" ]; then
+                if [ "${found#v}" = "${pin#v}" ]; then
+                    printf "    %-8s %-9s %s\n" "$b" "$pin" "docker cli plugin"
+                else
+                    printf "  ! %-8s wants %s, the docker cli plugin reports '%s'\n" \
+                        "$b" "$pin" "$found"
+                    TOOLCHAIN_NEED+="$b "
+                fi
+                continue
+            fi
+        fi
         if [ -z "$path" ]; then
             printf "  - %-8s %-9s not found\n" "$b" "$pin"
             TOOLCHAIN_NEED+="$b "
@@ -455,6 +478,9 @@ fetch() {
         if want kind;   then fetch_bin kind   "$KIND_URL"   "$KIND_SHA256"   "$dest"; fi
         if want tilt;   then fetch_tgz tilt   "$TILT_URL"   "$TILT_SHA256"   "$dest" tilt   0; fi
         if want ctlptl; then fetch_tgz ctlptl "$CTLPTL_URL" "$CTLPTL_SHA256" "$dest" ctlptl 0; fi
+        if want docker-compose; then
+            fetch_bin docker-compose "$COMPOSE_URL" "$COMPOSE_SHA256" "$dest"
+        fi
     fi
 
     fix_ownership "$dest"
@@ -520,6 +546,30 @@ warn_shadowing() {
       OUT_BIN=\$PWD/def/bin make deps   # then put that dir first in PATH")
 }
 
+# A copy in OUT_BIN only gives you `docker-compose`. That hyphenated form is the
+# retired v1 spelling; every compose file written in the last few years assumes
+# `docker compose`, which resolves plugins BY NAME out of a plugin directory.
+# So the binary is fetched like any other and then linked, in your own home —
+# no root, and nothing outside it.
+install_compose_plugin() {
+    local src="$OUT_BIN/docker-compose" dir="$HOME/.docker/cli-plugins"
+    [ -x "$src" ] || return 0
+    mkdir -p "$dir"
+    # Something else already owns that name — docker-desktop and some distro
+    # packages install a real file there. Overwriting it would take the plugin
+    # away from whatever put it there, so say so and let the user decide.
+    if [ -e "$dir/docker-compose" ] && [ ! -L "$dir/docker-compose" ]; then
+        MANUAL+=("Something already installs the compose plugin at
+      $dir/docker-compose
+  To use rig's pinned build instead:
+      ln -sf $src $dir/docker-compose")
+        return 0
+    fi
+    ln -sfn "$src" "$dir/docker-compose"
+    echo "  compose plugin -> $dir/docker-compose"
+    return 0
+}
+
 install() {
     local tier="${1:-dev}" b
     TIER="$tier"
@@ -538,6 +588,12 @@ install() {
         if [ "$tier" = "core" ]; then
             echo "  (no kind/tilt — 'make deps dev' adds them)"
         fi
+        # Only when compose was one of the things fetched: linking a binary
+        # that is already satisfied elsewhere on PATH would point the plugin at
+        # a copy rig did not install.
+        case " $TOOLCHAIN_NEED " in
+            *" docker-compose "*) install_compose_plugin ;;
+        esac
 
         # Only worth saying when something actually landed in OUT_BIN. When every
         # tool was satisfied elsewhere, OUT_BIN may reasonably be off PATH, and

rig/ctrl/versions.env

@@ -44,6 +44,15 @@ JQ_VERSION=1.8.2
 JQ_SHA256=b1c22172dd303f3be49e935aa56aa48a8b7a46e0bc838b4997d3bb451495870f
 JQ_URL=https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/jq-linux-amd64
 
+# docker compose — the distro docker packages ship the daemon and the CLI but
+# frequently not this, so `docker compose up` fails with "unknown command" on an
+# otherwise working Docker. It is a CLI plugin, found by NAME in a plugin
+# directory, so a copy in the bin dir alone only gives you the retired
+# `docker-compose` v1 spelling; deps.sh links it into ~/.docker/cli-plugins.
+COMPOSE_VERSION=5.5.1
+COMPOSE_SHA256=db1889184726840f75c4f9c001048430d4f25b3be3cb084d3ddd762bc0aed576
+COMPOSE_URL=https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-linux-x86_64
+
 # Node images shipped with KIND_VERSION above, pinned by digest so a kind upgrade
 # can never silently move the k8s version. Profiles select one via K8S_VERSION.
 # Older entries are kept deliberately: running a trailing-edge control plane is

rig/standalone/rigdeps.sh

@@ -7,8 +7,9 @@
 #
 # What it will not do, deliberately:
 #
-#   * no sudo, no apt, no yum. It writes ONLY into $OUT_BIN (default
+#   * no sudo, no apt, no yum. It writes into $OUT_BIN (default ~/.local/bin)
-#     ~/.local/bin). Everything needing root — installing Docker, joining the
+#     and, for compose only, a symlink under ~/.docker/cli-plugins — both in
+#     your own home. Everything needing root — installing Docker, joining the
 #     docker group, raising inotify limits — is REPORTED for you to decide on.
 #     That is what makes it safe to run on a machine that already works.
 #   * no unverified download. Every artifact is checked against a SHA256 taken
@@ -72,8 +73,16 @@ JQ_VERSION=1.8.2
 JQ_SHA256=b1c22172dd303f3be49e935aa56aa48a8b7a46e0bc838b4997d3bb451495870f
 JQ_URL="https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/jq-linux-amd64"
 
+# Distro docker packages ship the daemon and CLI but frequently not this, so
+# `docker compose up` fails with "unknown command" on an otherwise working
+# Docker. It is a CLI plugin: the binary is found by name in a plugin directory,
+# which is why install_compose_plugin links it into ~/.docker/cli-plugins.
+COMPOSE_VERSION=5.5.1
+COMPOSE_SHA256=db1889184726840f75c4f9c001048430d4f25b3be3cb084d3ddd762bc0aed576
+COMPOSE_URL="https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-linux-x86_64"
+
 CORE_TOOLS="kubectl jq"
-DEV_TOOLS="kind tilt ctlptl"
+DEV_TOOLS="kind tilt ctlptl docker-compose"
 
 # No helm: every rig addon installs with `kubectl apply -f`, so nothing has ever
 # invoked it. Add it the day something actually needs a chart.
@@ -305,6 +314,14 @@ detect_docker() {
     fi
     if docker info >/dev/null 2>&1; then
         echo "  docker      $(docker version --format '{{.Server.Version}}' 2>/dev/null)"
+        # Distro packages routinely omit the compose plugin, so a working
+        # daemon says nothing about whether `docker compose up` will run.
+        if docker compose version >/dev/null 2>&1; then
+            echo "  compose     $(docker compose version --short 2>/dev/null)"
+        else
+            echo "  ! no 'docker compose' plugin — compose files will not start."
+            echo "    The dev tier installs one; no root needed."
+        fi
         local n
         n=$(docker ps --filter "label=io.x-k8s.kind.cluster" --format '{{.Names}}' 2>/dev/null | wc -l)
         # Must be an `if`, not `[ ] && echo`: as the last statement here the
@@ -411,7 +428,30 @@ fetch() {
         fetch_bin kind   "$KIND_URL"   "$KIND_SHA256"   "$dest"
         fetch_tgz tilt   "$TILT_URL"   "$TILT_SHA256"   "$dest" tilt   0
         fetch_tgz ctlptl "$CTLPTL_URL" "$CTLPTL_SHA256" "$dest" ctlptl 0
+        fetch_bin docker-compose "$COMPOSE_URL" "$COMPOSE_SHA256" "$dest"
+    fi
+    return 0
+}
+
+# A copy in OUT_BIN only gives you `docker-compose`. The hyphenated form is the
+# retired v1 spelling; every compose file written in the last few years assumes
+# `docker compose`, and that resolves plugins by name from this directory.
+install_compose_plugin() {
+    local src="$OUT_BIN/docker-compose" dir="$HOME/.docker/cli-plugins"
+    [ -x "$src" ] || return 0
+    mkdir -p "$dir"
+    if [ -e "$dir/docker-compose" ] && [ ! -L "$dir/docker-compose" ]; then
+        echo
+        echo "  ! $dir/docker-compose exists and is not a symlink — left alone"
+        MANUAL+=("Something already installs the compose plugin at
+      $dir/docker-compose
+  To use the pinned build instead:
+      ln -sf $src $dir/docker-compose")
+        return 0
     fi
+    ln -sfn "$src" "$dir/docker-compose"
+    echo
+    echo "  compose plugin linked into $dir"
     return 0
 }
 
@@ -509,13 +549,18 @@ install() {
     detect
     echo
     fetch "$tier"
+    # An `if`, not `[ ] && ...`: on the core tier the test fails, and under
+    # `set -e` a bare failing test here would end the run silently.
+    if [ "$tier" = "dev" ]; then
+        install_compose_plugin
+    fi
     echo
     verify_tools "$tier"
     warn_shadowing "$tier"
 
     if [ "$tier" = "core" ]; then
         echo
-        echo "  core tier: no kind, tilt or ctlptl. '$0 install dev' adds them."
+        echo "  core tier: no kind, tilt, ctlptl or compose. '$0 install dev' adds them."
     fi
 
     case ":${PATH}:" in
@@ -541,11 +586,12 @@ install() {
 
 list() {
     echo "pinned, linux/amd64 only:"
-    printf '  %-8s %s\n' kubectl "$KUBECTL_VERSION"
+    printf '  %-14s %s\n' kubectl "$KUBECTL_VERSION"
-    printf '  %-8s %s\n' jq      "$JQ_VERSION"
+    printf '  %-14s %s\n' jq      "$JQ_VERSION"
-    printf '  %-8s %s\n' kind    "$KIND_VERSION"
+    printf '  %-14s %s\n' kind    "$KIND_VERSION"
-    printf '  %-8s %s\n' tilt    "$TILT_VERSION"
+    printf '  %-14s %s\n' tilt    "$TILT_VERSION"
-    printf '  %-8s %s\n' ctlptl  "$CTLPTL_VERSION"
+    printf '  %-14s %s\n' ctlptl  "$CTLPTL_VERSION"
+    printf '  %-14s %s\n' docker-compose "$COMPOSE_VERSION"
     echo
     echo "  core = $CORE_TOOLS"
     echo "  dev  = $CORE_TOOLS $DEV_TOOLS"