fix(docker): preserve Docker daemon env vars on direct-exec spawn path

The MCP-2744 direct-exec docker-isolation spawn replaced the $SHELL -l -c
login-shell wrap, so the child inherits only the secure-env allowlist. That
allowlist excluded DOCKER_HOST/DOCKER_CONTEXT/DOCKER_CONFIG/DOCKER_TLS_VERIFY/
DOCKER_CERT_PATH, so for Colima/rootless/remote daemons the docker binary
resolved but 'docker run' could not reach the daemon (silent regression).

Add DockerDaemonEnvVars() to the secure-env allowlist (DefaultEnvConfig) and
thread them through for command/stdio servers even when an operator supplies a
custom Environment allowlist. These are connection pointers, not secrets.

Related #699
Related #696

Author: Dumbris

internal/secureenv/docker_daemon_env_test.go

@@ -0,0 +1,48 @@
+package secureenv
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestDefaultEnvConfigAllowsDockerDaemonVars guards the MCP-2744 regression:
+// the direct-exec docker spawn path (no login-shell wrap) inherits ONLY the
+// vars BuildSecureEnvironment passes through. Docker daemon-access vars
+// (DOCKER_HOST, DOCKER_CONTEXT, …) used by Colima / rootless / remote Docker
+// MUST survive into the spawn env, or `docker run` resolves the binary but
+// cannot reach the daemon. See PR #699 Codex review.
+func TestDefaultEnvConfigAllowsDockerDaemonVars(t *testing.T) {
+	cfg := DefaultEnvConfig()
+	mgr := NewManager(cfg)
+
+	for _, key := range DockerDaemonEnvVars() {
+		if !mgr.isKeyAllowed(key) {
+			t.Errorf("DefaultEnvConfig should allow docker daemon var %q so direct-exec docker isolation can reach the daemon (Colima/rootless)", key)
+		}
+	}
+}
+
+// TestBuildSecureEnvironmentPreservesDockerHost is the Colima regression test
+// requested in the PR #699 review: DOCKER_HOST set in the mcpproxy environment
+// must survive into the spawned child's secure environment.
+func TestBuildSecureEnvironmentPreservesDockerHost(t *testing.T) {
+	t.Setenv("DOCKER_HOST", "tcp://127.0.0.1:2375")
+	t.Setenv("DOCKER_CONTEXT", "colima")
+
+	mgr := NewManager(DefaultEnvConfig())
+	env := mgr.BuildSecureEnvironment()
+
+	got := map[string]string{}
+	for _, kv := range env {
+		if i := strings.IndexByte(kv, '='); i >= 0 {
+			got[kv[:i]] = kv[i+1:]
+		}
+	}
+
+	if got["DOCKER_HOST"] != "tcp://127.0.0.1:2375" {
+		t.Errorf("DOCKER_HOST should survive into spawn env, got %q", got["DOCKER_HOST"])
+	}
+	if got["DOCKER_CONTEXT"] != "colima" {
+		t.Errorf("DOCKER_CONTEXT should survive into spawn env, got %q", got["DOCKER_CONTEXT"])
+	}
+}

internal/secureenv/manager.go

@@ -41,6 +41,27 @@ type PathDiscovery struct {
 	AvailableTools  map[string]string
 }
 
+// DockerDaemonEnvVars returns the environment variables the docker CLI uses to
+// locate and authenticate to the daemon (local, remote, Colima, or rootless).
+//
+// MCP-2744 / PR #699: the docker-isolation spawn now direct-execs the resolved
+// docker binary instead of routing through a `$SHELL -l -c` login-shell wrap.
+// The login shell used to re-derive these from the user's rc files; the
+// direct-exec path inherits only what BuildSecureEnvironment passes through, so
+// they must be on the allowlist or `docker run` resolves the binary yet cannot
+// reach the daemon (silent regression for Colima/rootless users). These are
+// connection pointers (host URL, context name, config/cert directory paths) and
+// not secrets, so allowing them through is safe.
+func DockerDaemonEnvVars() []string {
+	return []string{
+		"DOCKER_HOST",       // Daemon socket/URL (e.g. tcp://… for Colima/remote)
+		"DOCKER_CONTEXT",    // Named docker context selecting the daemon
+		"DOCKER_CONFIG",     // Path to the docker config dir (~/.docker by default)
+		"DOCKER_TLS_VERIFY", // Enable TLS verification against the daemon
+		"DOCKER_CERT_PATH",  // Path to TLS client certs for the daemon
+	}
+}
+
 // DefaultEnvConfig returns default environment configuration with safe system variables
 func DefaultEnvConfig() *EnvConfig {
 	allowedVars := []string{
@@ -56,6 +77,10 @@ func DefaultEnvConfig() *EnvConfig {
 		"USERNAME", // Current user (Windows)
 	}
 
+	// Docker daemon-access vars (MCP-2744): required so direct-exec docker
+	// isolation can reach a non-default daemon (Colima/rootless/remote).
+	allowedVars = append(allowedVars, DockerDaemonEnvVars()...)
+
 	// Add Windows-specific variables
 	if runtime.GOOS == osWindows {
 		allowedVars = append(allowedVars,

internal/upstream/core/client.go

@@ -182,6 +182,20 @@ func NewClientWithOptions(id string, serverConfig *config.ServerConfig, logger *
 		// Create a copy of the config to avoid modifying the original
 		envConfigCopy := *envConfig
 		envConfigCopy.EnhancePath = true
+
+		// MCP-2744: the docker-isolation spawn direct-execs the resolved docker
+		// binary (no login-shell wrap), so it inherits only the secure-env
+		// allowlist. Ensure docker daemon-access vars (DOCKER_HOST/CONTEXT/…)
+		// survive even when an operator supplied a custom Environment allowlist,
+		// or Colima/rootless/remote daemons become unreachable. DefaultEnvConfig
+		// already includes these; this covers the custom-config path. The slice
+		// is rebuilt (not appended in place) so the shared source config is not
+		// mutated.
+		allowed := make([]string, 0, len(envConfigCopy.AllowedSystemVars)+len(secureenv.DockerDaemonEnvVars()))
+		allowed = append(allowed, envConfigCopy.AllowedSystemVars...)
+		allowed = append(allowed, secureenv.DockerDaemonEnvVars()...)
+		envConfigCopy.AllowedSystemVars = allowed
+
 		envConfig = &envConfigCopy
 	}
 

internal/upstream/core/connection_docker_test.go

@@ -6,12 +6,52 @@ import (
 	"testing"
 
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/secureenv"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/zap"
 )
 
+// TestDockerIsolationSpawnEnvPreservesDockerHost is the Colima regression test
+// for the PR #699 review (MCP-2744): the direct-exec docker spawn inherits only
+// the secure-env allowlist, so docker daemon-access vars must survive into the
+// child env even when the operator supplied a RESTRICTIVE custom Environment
+// allowlist that omits them. Otherwise Colima/rootless/remote daemons become
+// unreachable ("binary resolves but `docker run` can't reach the daemon").
+func TestDockerIsolationSpawnEnvPreservesDockerHost(t *testing.T) {
+	t.Setenv("DOCKER_HOST", "tcp://127.0.0.1:2375")
+
+	globalCfg := &config.Config{
+		// Operator-supplied allowlist that deliberately omits DOCKER_* — the
+		// client must still thread daemon vars through for command servers.
+		Environment: &secureenv.EnvConfig{
+			InheritSystemSafe: true,
+			AllowedSystemVars: []string{"PATH", "HOME"},
+		},
+	}
+	serverCfg := &config.ServerConfig{
+		Name:    "iso-server",
+		Command: "python",
+		Args:    []string{"-m", "mcp_server"},
+	}
+
+	c, err := NewClient("iso-server", serverCfg, zap.NewNop(), nil, globalCfg, nil, nil)
+	require.NoError(t, err)
+
+	mgr, ok := c.GetEnvManager().(*secureenv.Manager)
+	require.True(t, ok, "env manager must be a *secureenv.Manager")
+
+	var found bool
+	for _, kv := range mgr.BuildSecureEnvironment() {
+		if strings.HasPrefix(kv, "DOCKER_HOST=") {
+			found = true
+			assert.Equal(t, "DOCKER_HOST=tcp://127.0.0.1:2375", kv)
+		}
+	}
+	assert.True(t, found, "DOCKER_HOST must survive into the docker-isolation spawn env even with a custom allowlist")
+}
+
 func newIsolatedTestClient() *Client {
 	return &Client{
 		config: &config.ServerConfig{