release: v0.9.8 [skip ci]

.taskid

@@ -1 +1 @@
-DEVX-20
+DEVX-29

CHANGELOG.md

@@ -2,6 +2,56 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.9.8] - 2026-06-24
+
+### Bug Fixes
+
+- Use DOCKER_HOST env var in is_docker_ready + scan all rootless sockets
+
+## [0.9.7] - 2026-06-24
+
+### Bug Fixes
+
+- Add rootless socket fallback and GITHUB_ENV export
+
+## [0.9.6] - 2026-06-24
+
+### Bug Fixes
+
+- Add Docker socket diagnostics to start_docker
+- Add Docker socket diagnostics to start_docker
+
+## [0.9.5] - 2026-06-24
+
+### Bug Fixes
+
+- Use host Docker socket with DOCKER_HOST fallback to local dockerd
+- Use host Docker socket with DOCKER_HOST fallback to local dockerd
+
+## [0.9.4] - 2026-06-24
+
+### Bug Fixes
+
+- Use separate Docker socket for DinD in CI
+
+## [0.9.3] - 2026-06-24
+
+### Bug Fixes
+
+- Use tempfile for dockerd log to fix CI permission error
+
+## [0.9.2] - 2026-06-24
+
+### Bug Fixes
+
+- Use vfs storage driver for Docker-in-Docker in CI
+
+## [0.9.1] - 2026-06-23
+
+### Bug Fixes
+
+- Always start dockerd in CI runner for molecule tests
+
 ## [0.9.0] - 2026-06-23
 
 ### Features

src/devx/__init__.py

@@ -1,3 +1,3 @@
 """devx — reusable development and CI/CD tools for oblachno-oss projects."""
 
-__version__ = "0.9.0"
+__version__ = "0.9.8"

src/devx/molecule/start_docker.py

@@ -1,10 +1,14 @@
 #!/usr/bin/env python3
-"""Start a Docker daemon inside a CI runner container (Docker-in-Docker).
+"""Ensure Docker is available for molecule tests in CI.
 
-CI runners (e.g. ``gitea/runner-images:ubuntu-latest``) may not have a
+CI runners (e.g. ``gitea/runner-images:ubuntu-latest``) may have the host's
-Docker daemon running. This module starts ``dockerd`` in the background
+Docker socket mounted. This module verifies Docker is accessible and
-and waits for it to become ready, or exits immediately if Docker is
+sets ``DOCKER_HOST`` explicitly so molecule's Python docker library
-already available.
+connects to the same socket as the Docker CLI.
+
+If the host socket is not available, it tries the rootless socket, then
+starts a local ``dockerd`` with the vfs storage driver (requires
+privileged container).
 
 Usage::
 
@@ -13,8 +17,11 @@ Usage::
 
 from __future__ import annotations
 
+import glob
+import os
 import subprocess  # nosec B404
 import sys
+import tempfile
 import time
 
 import click
@@ -22,34 +29,130 @@ import click
 from devx.i18n import _
 
 DEFAULT_TIMEOUT = 30
-DOCKERD_LOG = "/var/log/dockerd.log"
+DOCKER_SOCK = "/var/run/docker.sock"
+# Rootless socket fallback (e.g. /run/user/994/docker.sock)
+ROOTLESS_SOCK = f"/run/user/{os.getuid()}/docker.sock"
 
 
 def is_docker_ready() -> bool:
-    """Check if the Docker daemon is responding."""
+    """Check if Docker daemon is responding on the configured socket."""
+    docker_host = os.environ.get("DOCKER_HOST", f"unix://{DOCKER_SOCK}")
     result = subprocess.run(  # nosec B603 B607
         ["docker", "info"],
         capture_output=True,
         check=False,
+        env={**os.environ, "DOCKER_HOST": docker_host},
     )
     return result.returncode == 0
 
 
-def start_docker_daemon(timeout: int = DEFAULT_TIMEOUT) -> bool:
+def _diagnose_socket() -> None:
-    """Start dockerd in the background and wait for it to be ready.
+    """Print diagnostic info about the Docker socket."""
+    click.echo(f"DOCKER_HOST = {os.environ.get('DOCKER_HOST', '(not set)')}")
+    click.echo(f"Socket path: {DOCKER_SOCK}")
+    click.echo(f"Socket exists: {os.path.exists(DOCKER_SOCK)}")
+    if os.path.exists(DOCKER_SOCK):
+        stat = os.stat(DOCKER_SOCK)
+        click.echo(f"Socket mode: {oct(stat.st_mode)}")
+        click.echo(f"Socket uid: {stat.st_uid}, gid: {stat.st_gid}")
+    # Check if it's a mount point
+    result = subprocess.run(  # nosec B603 B607
+        ["mount"],
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    docker_mounts = [line for line in result.stdout.splitlines() if "docker" in line.lower()]
+    if docker_mounts:
+        click.echo("Docker-related mounts:")
+        for line in docker_mounts:
+            click.echo(f"  {line}")
+    else:
+        click.echo("No Docker-related mounts found")
+    # Check docker context
+    result = subprocess.run(  # nosec B603 B607
+        ["docker", "context", "ls"],
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    click.echo(f"Docker contexts:\n{result.stdout}")
+    # Try docker info without DOCKER_HOST
+    result = subprocess.run(  # nosec B603 B607
+        ["docker", "info"],
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    click.echo(f"docker info (no DOCKER_HOST): rc={result.returncode}")
+    if result.returncode != 0:
+        click.echo(f"  stderr: {result.stderr[:500]}")
+    else:
+        # Print server version and storage driver
+        for line in result.stdout.splitlines():
+            if "Server Version" in line or "Storage Driver" in line or "Docker Root Dir" in line:
+                click.echo(f"  {line.strip()}")
 
-    Returns ``True`` if Docker is ready (either already running or
+
-    successfully started), ``False`` if it failed to start within
+def start_docker_daemon(timeout: int = DEFAULT_TIMEOUT) -> bool:
-    the timeout.
+    """Ensure Docker is ready for molecule tests.
+
+    First tries the host socket. If that works, sets ``DOCKER_HOST`` and
+    returns immediately. If not, tries the rootless socket. If neither
+    works, starts a local ``dockerd`` with vfs storage driver (requires
+    privileged container).
+
+    Returns ``True`` if Docker is ready, ``False`` if it failed to
+    start within the timeout.
     """
+    # Point Docker CLI and Python library to the socket explicitly
+    os.environ["DOCKER_HOST"] = f"unix://{DOCKER_SOCK}"
+
+    # Diagnose socket state
+    click.echo("--- Docker socket diagnostics ---")
+    _diagnose_socket()
+    click.echo("--- End diagnostics ---")
+
+    # Check if host Docker is already available
     if is_docker_ready():
         click.echo(_("Docker daemon already running"))
         return True
 
-    click.echo(_("Starting Docker daemon..."))
+    # Try rootless socket (e.g. /run/user/994/docker.sock)
-    log_file = open(DOCKERD_LOG, "w")  # noqa: SIM115
+    click.echo(f"Trying rootless socket: {ROOTLESS_SOCK}")
+    os.environ["DOCKER_HOST"] = f"unix://{ROOTLESS_SOCK}"
+    if os.path.exists(ROOTLESS_SOCK) and is_docker_ready():
+        click.echo(_("Docker daemon already running"))
+        return True
+
+    # Scan for any rootless sockets at other UIDs
+    for sock in sorted(glob.glob("/run/user/*/docker.sock")):
+        if sock == ROOTLESS_SOCK:
+            continue
+        click.echo(f"Trying alternative rootless socket: {sock}")
+        os.environ["DOCKER_HOST"] = f"unix://{sock}"
+        if is_docker_ready():
+            click.echo(_("Docker daemon already running"))
+            return True
+
+    click.echo(_("Host Docker not available, starting local dockerd..."))
+
+    # Reset DOCKER_HOST to host socket for local dockerd
+    os.environ["DOCKER_HOST"] = f"unix://{DOCKER_SOCK}"
+
+    # Start local dockerd (requires privileged container)
+    log_file = tempfile.NamedTemporaryFile(  # noqa: SIM115
+        mode="w", suffix="dockerd.log", delete=False
+    )
+    click.echo(f"dockerd log: {log_file.name}")
     subprocess.Popen(  # nosec B603 B607
-        ["dockerd"],
+        [
+            "dockerd",
+            "--storage-driver",
+            "vfs",
+            "-H",
+            f"unix://{DOCKER_SOCK}",
+        ],
         stdout=log_file,
         stderr=subprocess.STDOUT,
         start_new_session=True,
@@ -61,7 +164,17 @@ def start_docker_daemon(timeout: int = DEFAULT_TIMEOUT) -> bool:
             return True
         time.sleep(1)
 
+    # Print dockerd log on failure
     click.echo(_("Docker daemon failed to start"))
+    click.echo("--- dockerd log ---")
+    try:
+        with open(log_file.name) as f:
+            log_content = f.read()
+        click.echo(log_content[-3000:] if len(log_content) > 3000 else log_content)
+    except OSError as e:
+        click.echo(f"Could not read log: {e}")
+    click.echo("--- End dockerd log ---")
+
     return False
 
 
@@ -75,6 +188,12 @@ def start_docker_daemon(timeout: int = DEFAULT_TIMEOUT) -> bool:
 def main(timeout: int) -> None:
     """Start Docker daemon for CI molecule tests."""
     if start_docker_daemon(timeout):
+        # Export DOCKER_HOST to GITHUB_ENV for subsequent CI steps
+        github_env = os.environ.get("GITHUB_ENV")
+        if github_env and os.environ.get("DOCKER_HOST"):
+            with open(github_env, "a") as f:
+                f.write(f"DOCKER_HOST={os.environ['DOCKER_HOST']}\n")
+            click.echo(f"Exported DOCKER_HOST={os.environ['DOCKER_HOST']} to GITHUB_ENV")
         sys.exit(0)
     sys.exit(1)
 

src/devx/translations.json

@@ -420,10 +420,10 @@
     "zh": "Created release commit."
   },
   "Docker daemon already running": {
-    "bg": "Docker daemon already running",
+    "bg": "Докер демонът вече работи",
     "de": "Docker-Daemon läuft bereits",
     "en": "Docker daemon already running",
-    "ru": "Docker-демон уже запущен",
+    "ru": "Демон Docker уже работает",
     "zh": "Docker 守护进程已在运行"
   },
   "Docker daemon failed to start": {
@@ -559,6 +559,13 @@
     "ru": "Head branch is behind master. Pulling and rebasing...",
     "zh": "Head branch is behind master. Pulling and rebasing..."
   },
+  "Host Docker not available, starting local dockerd...": {
+    "bg": "Хост Docker не е наличен, стартиране на локален dockerd...",
+    "de": "Host-Docker nicht verfügbar, lokaler dockerd wird gestartet...",
+    "en": "Host Docker not available, starting local dockerd...",
+    "ru": "Хост Docker недоступен, запускается локальный dockerd...",
+    "zh": "主机 Docker 不可用，正在启动本地 dockerd..."
+  },
   "Infrastructure commit (no DEVX-N task ID), skipping Vikunja update: {msg}": {
     "bg": "Инфраструктурен commit (без идентификатор на задача DEVX-N), пропускаме обновяването на Vikunja: {msg}",
     "de": "Infrastruktur-Commit (keine DEVX-N Task-ID), Vikunja-Update wird übersprungen: {msg}",
@@ -937,13 +944,6 @@
     "ru": "Skipping commit push — no staged changes.",
     "zh": "Skipping commit push — no staged changes."
   },
-  "Starting Docker daemon...": {
-    "bg": "Starting Docker daemon...",
-    "de": "Docker-Daemon wird gestartet...",
-    "en": "Starting Docker daemon...",
-    "ru": "Запуск Docker-демона...",
-    "zh": "正在启动 Docker 守护进程..."
-  },
   "Syncing {count} documentation pages to wiki...": {
     "bg": "Syncing {count} documentation pages to wiki...",
     "de": "Syncing {count} documentation pages to wiki...",

tests/unit/test_start_docker.py

@@ -1,80 +1,239 @@
 """Unit tests for devx.molecule.start_docker."""
 
+import os
 from unittest.mock import MagicMock, mock_open, patch
 
 from click.testing import CliRunner
 
-from devx.molecule.start_docker import is_docker_ready, main, start_docker_daemon
+from devx.molecule.start_docker import (
+    DOCKER_SOCK,
+    _diagnose_socket,
+    is_docker_ready,
+    main,
+    start_docker_daemon,
+)
 
 
 class TestIsDockerReady:
     @patch("devx.molecule.start_docker.subprocess.run")
     def test_ready(self, mock_run: MagicMock) -> None:
         mock_run.return_value = MagicMock(returncode=0)
-        assert is_docker_ready() is True
+        with patch.dict("os.environ", {"DOCKER_HOST": f"unix://{DOCKER_SOCK}"}, clear=False):
-        mock_run.assert_called_once_with(["docker", "info"], capture_output=True, check=False)
+            assert is_docker_ready() is True
+        call_kwargs = mock_run.call_args
+        assert call_kwargs.args[0] == ["docker", "info"]
+        assert call_kwargs.kwargs["env"]["DOCKER_HOST"] == f"unix://{DOCKER_SOCK}"
 
     @patch("devx.molecule.start_docker.subprocess.run")
     def test_not_ready(self, mock_run: MagicMock) -> None:
         mock_run.return_value = MagicMock(returncode=1)
         assert is_docker_ready() is False
 
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_uses_docker_host_env(self, mock_run: MagicMock) -> None:
+        """Should check the socket specified by DOCKER_HOST env var."""
+        mock_run.return_value = MagicMock(returncode=0)
+        rootless = "unix:///run/user/999/docker.sock"
+        with patch.dict("os.environ", {"DOCKER_HOST": rootless}, clear=False):
+            assert is_docker_ready() is True
+        call_kwargs = mock_run.call_args
+        assert call_kwargs.kwargs["env"]["DOCKER_HOST"] == rootless
+
+
+class TestDiagnoseSocket:
+    @patch("devx.molecule.start_docker.os.stat")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_socket_exists(self, mock_run: MagicMock, mock_exists: MagicMock, mock_stat: MagicMock) -> None:
+        mock_stat.return_value = MagicMock(st_mode=0o660, st_uid=0, st_gid=0)
+        mock_run.side_effect = [
+            MagicMock(stdout="/dev/sda1 /var/lib/docker ext4\n", returncode=0, text=""),
+            MagicMock(stdout="default\n", returncode=0, text=""),
+            MagicMock(
+                stdout="Server Version: 29.5.2\nStorage Driver: overlay2\nDocker Root Dir: /var/lib/docker\n",
+                returncode=0,
+                text="",
+            ),
+        ]
+        _diagnose_socket()
+        mock_exists.assert_called_with(DOCKER_SOCK)
+
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_socket_missing(self, mock_run: MagicMock, mock_exists: MagicMock) -> None:
+        mock_run.side_effect = [
+            MagicMock(stdout="proc on /proc type proc\n", returncode=0, text=""),
+            MagicMock(stdout="default\n", returncode=0, text=""),
+            MagicMock(stdout="", stderr="Cannot connect", returncode=1, text=""),
+        ]
+        _diagnose_socket()
+        mock_exists.assert_called_with(DOCKER_SOCK)
+
 
 class TestStartDockerDaemon:
+    @patch("devx.molecule.start_docker._diagnose_socket")
     @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
-    def test_already_running(self, mock_ready: MagicMock) -> None:
+    def test_host_socket_available(self, mock_ready: MagicMock, mock_diag: MagicMock) -> None:
-        assert start_docker_daemon() is True
+        """Should return immediately if host Docker is available."""
+        assert start_docker_daemon(timeout=5) is True
         mock_ready.assert_called_once()
+        mock_diag.assert_called_once()
 
-    @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
     @patch("devx.molecule.start_docker.is_docker_ready")
-    @patch("devx.molecule.start_docker.subprocess.Popen")
+    def test_rootless_socket_available(
-    @patch("builtins.open", new_callable=mock_open)
+        self, mock_ready: MagicMock, mock_exists: MagicMock, mock_diag: MagicMock
-    def test_starts_successfully(
-        self,
-        mock_file: MagicMock,
-        mock_popen: MagicMock,
-        mock_ready: MagicMock,
-        mock_sleep: MagicMock,
     ) -> None:
-        # First call: initial check (not ready). Second: first loop iteration (ready).
+        """Should use rootless socket if host socket fails."""
+        # First check (host) fails, second check (rootless) succeeds
         mock_ready.side_effect = [False, True]
+        with patch("devx.molecule.start_docker.glob.glob", return_value=[]):
+            assert start_docker_daemon(timeout=5) is True
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    def test_alt_rootless_socket_found(
+        self, mock_ready: MagicMock, mock_exists: MagicMock, mock_diag: MagicMock
+    ) -> None:
+        """Should find rootless socket at a different UID via glob scan."""
+        # Host fails, own rootless fails, alt rootless succeeds
+        mock_ready.side_effect = [False, False, True]
+        alt_sock = "/run/user/999/docker.sock"
+        with patch("devx.molecule.start_docker.glob.glob", return_value=[alt_sock]):
+            assert start_docker_daemon(timeout=5) is True
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    def test_alt_rootless_socket_skips_own(
+        self, mock_ready: MagicMock, mock_exists: MagicMock, mock_diag: MagicMock
+    ) -> None:
+        """Should skip the own rootless socket in glob scan (already tried)."""
+        # Host fails, own rootless fails, alt rootless also fails, dockerd fails
+        mock_ready.side_effect = [False, False, False, False, False, False]
+        own_sock = f"/run/user/{os.getuid()}/docker.sock"
+        alt_sock = "/run/user/999/docker.sock"
+        with (
+            patch("devx.molecule.start_docker.glob.glob", return_value=[own_sock, alt_sock]),
+            patch("devx.molecule.start_docker.time.sleep"),
+            patch("devx.molecule.start_docker.subprocess.Popen"),
+            patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile") as mock_ntf,
+            patch("builtins.open", mock_open(read_data="err")),
+        ):
+            mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+            assert start_docker_daemon(timeout=2) is False
+
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
+    @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    def test_starts_local_daemon(
+        self,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_sleep: MagicMock,
+        mock_ready: MagicMock,
+        mock_exists: MagicMock,
+        mock_diag: MagicMock,
+        mock_glob: MagicMock,
+    ) -> None:
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        # Host fails, rootless doesn't exist, local daemon starts
+        mock_ready.side_effect = [False, False, False, False, True]
         assert start_docker_daemon(timeout=5) is True
         mock_popen.assert_called_once()
-        mock_sleep.assert_not_called()
+        popen_args = mock_popen.call_args.args[0]
+        assert "dockerd" in popen_args
+        assert "--storage-driver" in popen_args
+        assert "vfs" in popen_args
+        assert "-H" in popen_args
 
-    @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
     @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
+    @patch("devx.molecule.start_docker.time.sleep")
     @patch("devx.molecule.start_docker.subprocess.Popen")
-    @patch("builtins.open", new_callable=mock_open)
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
     def test_fails_after_timeout(
         self,
-        mock_file: MagicMock,
+        mock_ntf: MagicMock,
         mock_popen: MagicMock,
-        mock_ready: MagicMock,
         mock_sleep: MagicMock,
+        mock_ready: MagicMock,
+        mock_exists: MagicMock,
+        mock_diag: MagicMock,
+        mock_glob: MagicMock,
     ) -> None:
-        # is_docker_ready always returns False: 1 initial + 3 loop iterations = 4 calls
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
-        assert start_docker_daemon(timeout=3) is False
+        with patch("builtins.open", mock_open(read_data="dockerd error log")):
+            assert start_docker_daemon(timeout=3) is False
         mock_popen.assert_called_once()
         assert mock_sleep.call_count == 3
 
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
     @patch("devx.molecule.start_docker.time.sleep")
-    @patch("devx.molecule.start_docker.is_docker_ready")
     @patch("devx.molecule.start_docker.subprocess.Popen")
-    @patch("builtins.open", new_callable=mock_open)
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
-    def test_custom_timeout(
+    def test_fails_log_read_error(
         self,
-        mock_file: MagicMock,
+        mock_ntf: MagicMock,
         mock_popen: MagicMock,
-        mock_ready: MagicMock,
         mock_sleep: MagicMock,
+        mock_ready: MagicMock,
+        mock_exists: MagicMock,
+        mock_diag: MagicMock,
+        mock_glob: MagicMock,
     ) -> None:
-        # First call: initial check (not ready). Then 9 loop iterations (not ready),
+        """Should handle log read errors gracefully."""
-        # 10th iteration (ready).
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
-        mock_ready.side_effect = [False] * 10 + [True]
+        with patch("builtins.open", side_effect=OSError("permission denied")):
-        assert start_docker_daemon(timeout=10) is True
+            assert start_docker_daemon(timeout=2) is False
-        assert mock_sleep.call_count == 9
+
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    def test_local_daemon_ready_on_first_check(
+        self,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_sleep: MagicMock,
+        mock_ready: MagicMock,
+        mock_exists: MagicMock,
+        mock_diag: MagicMock,
+        mock_glob: MagicMock,
+    ) -> None:
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        # Host fails, rootless doesn't exist, local ready on first loop check
+        mock_ready.side_effect = [False, False, True]
+        assert start_docker_daemon(timeout=5) is True
+        assert mock_popen.call_count == 1
+        assert mock_sleep.call_count == 1
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker.os.environ")
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
+    def test_sets_docker_host(
+        self,
+        mock_ready: MagicMock,
+        mock_environ: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """DOCKER_HOST must be set so molecule connects to correct socket."""
+        start_docker_daemon(timeout=5)
+        mock_environ.__setitem__.assert_called_with("DOCKER_HOST", f"unix://{DOCKER_SOCK}")
 
 
 class TestMain:
@@ -96,3 +255,24 @@ class TestMain:
         result = runner.invoke(main, ["--timeout", "60"])
         assert result.exit_code == 0
         mock_start.assert_called_once_with(60)
+
+    @patch("devx.molecule.start_docker.os.environ.get")
+    @patch("devx.molecule.start_docker.start_docker_daemon", return_value=True)
+    def test_exports_github_env(self, mock_start: MagicMock, mock_get: MagicMock) -> None:
+        """Should write DOCKER_HOST to GITHUB_ENV when available."""
+        mock_get.side_effect = lambda key, default="": (
+            "/tmp/github_env" if key == "GITHUB_ENV" else f"unix://{DOCKER_SOCK}" if key == "DOCKER_HOST" else default
+        )
+        with patch("builtins.open", mock_open()) as mock_file:
+            runner = CliRunner()
+            result = runner.invoke(main, [])
+            assert result.exit_code == 0
+            mock_file.assert_called_with("/tmp/github_env", "a")
+
+    @patch("devx.molecule.start_docker.os.environ.get", return_value="")
+    @patch("devx.molecule.start_docker.start_docker_daemon", return_value=True)
+    def test_no_github_env(self, mock_start: MagicMock, mock_get: MagicMock) -> None:
+        """Should not crash when GITHUB_ENV is not set."""
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code == 0