{
  "format": "buyproxies-docker-bridge-local-qualification-v1",
  "observed_at_utc": "2026-10-14T08:16:00.854362+00:00",
  "environment": {
    "operating_system": "Ubuntu 24.04 under WSL",
    "docker_client": "29.9.0",
    "docker_engine": "29.9.0",
    "compose": "v5.6.0",
    "curl_image": "curlimages/curl:8.21.0",
    "cached_image_id": "sha256:5c3599497451e27dda363f540b18969a5bc88baac6d1ba3d483187de85499b0a"
  },
  "source_sha256": {
    "docker-proxy-compose.yaml": "b7cc12faf2d9bb20c3536064d3040a09d1d782dd95aad915302f894e14f92437",
    "docker-proxy.env.example": "99f84d117458c03fcf08784e1c603bf14eb570e5864bfab13c959d9d68f91dfc"
  },
  "method": {
    "network": "dedicated user-defined bridge inside a separate network and mount namespace",
    "fixture": "synthetic HTTP/1.1 CONNECT proxy at the owned bridge gateway; fixed documentation JSON; never forwards",
    "curl_command_unchanged": true,
    "test_override": "owned bridge and read-only synthetic CA, except the untrusted certificate control",
    "connect_timeout_seconds": 10,
    "max_time_seconds": 30,
    "host_network_override": false,
    "retries": 0,
    "public_ip_service_requests": 0,
    "real_proxy_requests": 0,
    "new_image_pulls": 0
  },
  "controls": [
    {
      "case": "success",
      "client_exit": 0,
      "elapsed_seconds": 2.723,
      "stdout_matches_fixed_document": true,
      "events": [
        {
          "connect_target_allowed": true,
          "auth_matched": true,
          "connect_status": 200,
          "tls_get_matched": true,
          "destination_status": 200,
          "peer_on_owned_bridge": true
        }
      ]
    },
    {
      "case": "loopback-refused",
      "client_exit": 7,
      "elapsed_seconds": 2.503,
      "stdout_matches_fixed_document": false,
      "events": []
    },
    {
      "case": "wrong-auth",
      "client_exit": 22,
      "elapsed_seconds": 2.406,
      "stdout_matches_fixed_document": false,
      "events": [
        {
          "connect_target_allowed": true,
          "auth_matched": false,
          "connect_status": 407,
          "tls_get_matched": false,
          "destination_status": null,
          "peer_on_owned_bridge": true
        }
      ]
    },
    {
      "case": "destination403",
      "client_exit": 22,
      "elapsed_seconds": 2.386,
      "stdout_matches_fixed_document": false,
      "events": [
        {
          "connect_target_allowed": true,
          "auth_matched": true,
          "connect_status": 200,
          "tls_get_matched": true,
          "destination_status": 403,
          "peer_on_owned_bridge": true
        }
      ]
    },
    {
      "case": "untrusted-tls",
      "client_exit": 60,
      "elapsed_seconds": 2.357,
      "stdout_matches_fixed_document": false,
      "events": [
        {
          "connect_target_allowed": true,
          "auth_matched": true,
          "connect_status": 200,
          "tls_get_matched": false,
          "destination_status": null,
          "peer_on_owned_bridge": true
        }
      ]
    },
    {
      "case": "connection-refused",
      "client_exit": 7,
      "elapsed_seconds": 2.129,
      "stdout_matches_fixed_document": false,
      "events": []
    },
    {
      "case": "timeout",
      "client_exit": 28,
      "elapsed_seconds": 32.932,
      "stdout_matches_fixed_document": false,
      "events": [
        {
          "connect_target_allowed": true,
          "auth_matched": true,
          "connect_status": 200,
          "tls_get_matched": true,
          "destination_status": null,
          "peer_on_owned_bridge": true
        }
      ]
    }
  ],
  "client_defaults_observations": {
    "status": "THREE_DEFAULTS_OBSERVATIONS_PASS",
    "initial_new_container_received_defaults": true,
    "existing_created_container_preserved_first_values": true,
    "later_new_container_received_second_values": true,
    "created_containers": 2,
    "started_containers": 0,
    "values_or_ids_exported": false
  },
  "earlier_attempts_retained_unqualified": [
    {
      "stage": "initial preflight",
      "runtime_ownership_acquired": false,
      "daemon_starts": 0,
      "case_attempts": 0,
      "reason": "cache fingerprint rejected two engine-local backing block markers; old failure retained"
    },
    {
      "stage": "earlier first bridge control",
      "namespace_terminal_validation_failure": true,
      "client_exit": null,
      "elapsed_seconds": null,
      "fixture_events": null,
      "container_start_observed": null,
      "synthetic_public_ca_mode_observed": "0600",
      "cached_image_configured_user": "curl_user",
      "client_outcome_or_cause_inferred": false,
      "cleanup_parent_network_and_old_cache_preservation_verified": true,
      "reason": "sanitized client observation was not persisted before validation; later corrected method uses readable public CA and terminal case recording"
    }
  ],
  "cleanup": {
    "containers_empty": true,
    "owned_bridge_removed": true,
    "private_daemon_stopped": true,
    "private_socket_accepts_connections": false,
    "synthetic_key_and_env_removed": true,
    "parent_network_and_default_socket_unchanged": true,
    "parent_ip_forward_zero": true,
    "previous_owned_cache_bytes_unchanged": true
  },
  "limits": [
    "This qualifies only this Linux Engine/Compose bridge-to-gateway fixture and created-container defaults.",
    "Existing created containers retained their first environment values after the client config changed; later new containers received the updated defaults.",
    "Docker Desktop, host.docker.internal, production Internet NAT, bridge DNS, image-pull and build proxy settings were not tested.",
    "No real proxy availability, performance, capacity, throughput, causality, ranking or indexation outcome is inferred.",
    "The earlier 12 October host-network qualification and its excluded timeout fixture remain separate historical evidence."
  ]
}