Improve Docker-in-Docker (DinD) support

[jarlah]

Summary

Adds comprehensive Docker-in-Docker / Docker-outside-of-Docker support so that tests can run inside a container with a shared Docker socket:

docker run -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd):/app -w /app elixir:1.17 bash -c "mix deps.get && MIX_ENV=test mix test"

Core changes

• Container networking mode: At startup, detects if the bridge gateway is unreachable (hairpin NAT) and switches to connecting to containers via their internal IPs on the bridge network. New APIs get_host(container) and get_port(container, port) return the correct host/port based on the connection mode.
• Ryuk internal IP fallback: When connecting to Ryuk via gateway:mapped_port fails, falls back to container_ip:8080 (internal port) since both containers are on the same bridge network.
• Connect timeout: gen_tcp.connect for Ryuk now has a 5-second timeout instead of infinite, preventing indefinite hangs.

Host detection improvements

• TESTCONTAINERS_HOST_OVERRIDE env var / tc.host.override property to explicitly set the Docker host, bypassing auto-detection (matches testcontainers-java)
• TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE env var to override the Docker socket path mounted into Ryuk
• /proc/net/route fallback: Parses the kernel route table for the default gateway when bridge network inspection fails
• Better container detection: Checks /proc/1/cgroup for docker|kubepods|lxc|containerd patterns when /.dockerenv doesn't exist

Container module updates

All built-in container modules updated to use get_host(container) / get_port(container, port):
postgres, mysql, redis, cassandra, ceph, minio, rabbitmq, emqx, kafka, toxiproxy, selenium

PortWaitStrategy and HttpWaitStrategy also updated to use the DinD-aware APIs.

Custom network handling

Containers on custom Docker networks fall back to docker_hostname:mapped_port since the test container can't reach them via internal IP (different network).

Test updates

• Tests that hardcoded 127.0.0.1 or localhost updated to use get_host(container) / get_port(container, port)
• Tests incompatible with DooD tagged with @tag :dood_limitation and auto-excluded when running inside a container
• 11 new unit tests for route parsing and container detection logic

DooD limitations (tagged tests)

These tests are auto-excluded in DooD environments:

• Custom network tests (toxiproxy integration, network hostname) — test container not on the custom network
• Kafka integration — advertised.listeners requires the container IP at startup, not dynamically configurable in KRaft mode
• Host network mode — binds to Docker host, not the test container
• Selenium / EMQX custom config — slow startup timeouts in nested Docker

Test plan

• 11 new unit tests for route parsing and container detection
• DooD verification: all tests pass (with expected exclusions) inside docker run
• Standard mode: no regressions when running directly on host

🤖 Generated with Claude Code

[jarlah]

Results from running docker in docker:

docker run -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd):/app -w /app elixir:1.17 bash -c "mix deps.get && MIX_ENV=test mix test"

Results:

==> testcontainers
Compiling 124 files (.ex)
Generated testcontainers app

19:41:38.433 [error] backend port not found: :inotifywait

Running ExUnit with seed: 891013, max_cases: 32
Excluding tags: [:dood_limitation]

.............................................................................********************************************************************************
Ryuk has been disabled. This can cause unexpected behavior in your environment.
********************************************************************************

................................................
Finished in 37.4 seconds (28.0s async, 9.4s sync)
132 tests, 0 failures, 7 excluded

[jarlah]

@gossi take a look if you have time?

[jarlah]

also merging this and releasing a 2.1.0-rc1 soon to test both this DinD and docker compose support