testinfra

var UsePublishedPorts = sync.OnceValue(func() bool {
	if runtime.GOOS != "linux" {
		return true
	}

	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()

	cli, err := testcontainers.NewDockerClientWithOpts(ctx)
	if err != nil {
		return true
	}
	defer func() { _ = cli.Close() }()

	if !strings.HasPrefix(cli.DaemonHost(), "unix://") {
		return true
	}

	res, err := cli.Info(ctx, client.InfoOptions{})
	if err != nil {
		return true
	}

	return res.Info.OperatingSystem == "Docker Desktop" || slices.Contains(res.Info.SecurityOptions, "name=rootless")
})

UsePublishedPorts reports whether test containers must publish host ports for tests to reach them. Published ports are the source of two recurring CI flake classes: Docker's dynamic host-port allocator can pick a port already held by a host process (container start fails with "address already in use"), and dials through the publishing path (NAT rules, userland proxy) can be misrouted to unrelated host listeners under heavy parallel container churn. When the test process can route to container IPs directly — a local, rootful Docker daemon on Linux — ports are not published at all and tests dial <container IP>:<container port>. Docker Desktop and rootless daemons keep containers behind a VM or user namespace where container IPs are unreachable, so they retain published ports.