fix(core): stabilize box project container startup

Author: skulidropek

packages/app/src/lib/core/templates/dockerfile.ts

@@ -264,7 +264,7 @@ const renderDockerfileBun = (config: TemplateConfig): string =>
  */
 const renderDockerfileUsers = (config: TemplateConfig): string =>
   `# Create non-root user for SSH (align UID/GID with host user 1000)
-RUN for BASE_USER in box ubuntu; do \
+RUN for BASE_USER in ubuntu box; do \
       if [ "$BASE_USER" != "${config.sshUser}" ] && id -u "$BASE_USER" >/dev/null 2>&1; then \
         if getent group 1000 >/dev/null 2>&1; then \
           EXISTING_GROUP="$(getent group 1000 | cut -d: -f1)"; \

packages/app/src/lib/usecases/errors.ts

@@ -80,6 +80,23 @@ const renderDockerAccessActionPlan = (issue: DockerAccessError["issue"]): string
   return issue === "PermissionDenied" ? permissionDeniedPlan.join("\n") : daemonUnavailablePlan.join("\n")
 }
 
+// CHANGE: classify Docker build apt signature noise that is commonly caused by storage exhaustion.
+// WHY: when Docker's backing filesystem is full, apt can report every repository as "not signed"; surfacing disk-pressure recovery avoids chasing false GPG/key fixes.
+// QUOTE(ТЗ): "Все пробелмы с котоырми ты сталкиваешься должны быть потом покрыты тестами"
+// REF: runtime-2026-05-14-docker-disk-full
+// SOURCE: n/a
+// FORMAT THEOREM: contains_apt_invalid_signature(details) -> render_error(details) includes disk_space_recovery_hint
+// PURITY: CORE
+// INVARIANT: the classifier only adds guidance and does not alter command execution semantics
+// COMPLEXITY: O(n) time / O(1) space where n = |details|.
+const isAptInvalidSignatureFailure = (details: string | undefined): boolean => {
+  const normalized = details?.toLowerCase() ?? ""
+  return normalized.includes("apt-get update failed") &&
+    normalized.includes("invalid signature") &&
+    normalized.includes("repository") &&
+    normalized.includes("not signed")
+}
+
 const renderDockerCommandError = ({ details, exitCode }: DockerCommandError): string =>
   [
     `docker compose failed with exit code ${exitCode}`,
@@ -92,6 +109,11 @@ const renderDockerCommandError = ({ details, exitCode }: DockerCommandError): st
         "Hint: NVIDIA GPU access is enabled but Docker cannot load the host NVIDIA runtime; run with GPU disabled (`--gpu none`) or install the NVIDIA driver and NVIDIA Container Toolkit."
       ]
       : []),
+    ...(isAptInvalidSignatureFailure(details)
+      ? [
+        "Hint: apt reported invalid signatures for multiple repositories during Docker build; this can be caused by low Docker host disk space. Check `df -h` and reclaim unused Docker cache with `docker builder prune -af` and `docker image prune -af` before retrying."
+      ]
+      : []),
     "Hint: if output above contains 'lookup auth.docker.io' or 'read udp ... [::1]:53 ... connection refused', fix Docker DNS resolver (set working DNS in host/daemon config) and retry."
   ].join("\n")
 

packages/lib/src/core/templates/dockerfile.ts

@@ -264,7 +264,7 @@ const renderDockerfileBun = (config: TemplateConfig): string =>
  */
 const renderDockerfileUsers = (config: TemplateConfig): string =>
   `# Create non-root user for SSH (align UID/GID with host user 1000)
-RUN for BASE_USER in box ubuntu; do \
+RUN for BASE_USER in ubuntu box; do \
       if [ "$BASE_USER" != "${config.sshUser}" ] && id -u "$BASE_USER" >/dev/null 2>&1; then \
         if getent group 1000 >/dev/null 2>&1; then \
           EXISTING_GROUP="$(getent group 1000 | cut -d: -f1)"; \

packages/lib/src/usecases/errors.ts

@@ -79,6 +79,23 @@ const renderDockerAccessActionPlan = (issue: DockerAccessError["issue"]): string
   return issue === "PermissionDenied" ? permissionDeniedPlan.join("\n") : daemonUnavailablePlan.join("\n")
 }
 
+// CHANGE: classify Docker build apt signature noise that is commonly caused by storage exhaustion.
+// WHY: when Docker's backing filesystem is full, apt can report every repository as "not signed"; surfacing disk-pressure recovery avoids chasing false GPG/key fixes.
+// QUOTE(ТЗ): "Все пробелмы с котоырми ты сталкиваешься должны быть потом покрыты тестами"
+// REF: runtime-2026-05-14-docker-disk-full
+// SOURCE: n/a
+// FORMAT THEOREM: contains_apt_invalid_signature(details) -> render_error(details) includes disk_space_recovery_hint
+// PURITY: CORE
+// INVARIANT: the classifier only adds guidance and does not alter command execution semantics
+// COMPLEXITY: O(n) time / O(1) space where n = |details|.
+const isAptInvalidSignatureFailure = (details: string | undefined): boolean => {
+  const normalized = details?.toLowerCase() ?? ""
+  return normalized.includes("apt-get update failed") &&
+    normalized.includes("invalid signature") &&
+    normalized.includes("repository") &&
+    normalized.includes("not signed")
+}
+
 const renderDockerCommandError = ({ details, exitCode }: DockerCommandError): string =>
   [
     `docker compose failed with exit code ${exitCode}`,
@@ -91,6 +108,11 @@ const renderDockerCommandError = ({ details, exitCode }: DockerCommandError): st
         "Hint: NVIDIA GPU access is enabled but Docker cannot load the host NVIDIA runtime; run with GPU disabled (`--gpu none`) or install the NVIDIA driver and NVIDIA Container Toolkit."
       ]
       : []),
+    ...(isAptInvalidSignatureFailure(details)
+      ? [
+        "Hint: apt reported invalid signatures for multiple repositories during Docker build; this can be caused by low Docker host disk space. Check `df -h` and reclaim unused Docker cache with `docker builder prune -af` and `docker image prune -af` before retrying."
+      ]
+      : []),
     "Hint: if output above contains 'lookup auth.docker.io' or 'read udp ... [::1]:53 ... connection refused', fix Docker DNS resolver (set working DNS in host/daemon config) and retry."
   ].join("\n")
 

packages/lib/tests/core/templates.test.ts

@@ -94,10 +94,10 @@ describe("renderDockerfile", () => {
     expect(dockerfile).not.toContain("FROM ubuntu:24.04")
   })
 
-  it("renames the box base user to the configured SSH user", () => {
+  it("renames the UID 1000 base user to the configured SSH user before the box fallback", () => {
     const dockerfile = renderDockerfile(makeTemplateConfig())
 
-    expect(dockerfile).toContain("for BASE_USER in box ubuntu; do")
+    expect(dockerfile).toContain("for BASE_USER in ubuntu box; do")
     expect(dockerfile).toContain('if [ "$BASE_USER" != "dev" ] && id -u "$BASE_USER" >/dev/null 2>&1; then')
     expect(dockerfile).toContain('usermod -l dev -d /home/dev -m -s /usr/bin/zsh "$BASE_USER" || true')
   })

packages/lib/tests/usecases/errors.test.ts

@@ -42,6 +42,25 @@ describe("renderError", () => {
     expect(message).toContain("NVIDIA Container Toolkit")
   })
 
+  it("includes disk pressure recovery hint for apt invalid signature build failures", () => {
+    const message = renderError(
+      new DockerCommandError({
+        exitCode: 1,
+        details: [
+          "apt-get update failed after retries",
+          "W: GPG error: http://archive.ubuntu.com/ubuntu noble InRelease: At least one invalid signature was encountered.",
+          "E: The repository 'http://archive.ubuntu.com/ubuntu noble InRelease' is not signed.",
+          "E: The repository 'http://security.ubuntu.com/ubuntu noble-security InRelease' is not signed."
+        ].join("\n")
+      })
+    )
+
+    expect(message).toContain("low Docker host disk space")
+    expect(message).toContain("df -h")
+    expect(message).toContain("docker builder prune -af")
+    expect(message).toContain("docker image prune -af")
+  })
+
   it("shows NVIDIA hint iff docker output contains NVIDIA runtime markers", () => {
     const nvidiaContainerCliMarker = "nvidia-container-cli"
     const libNvidiaMlMarker = "libnvidia-ml.so.1"