📦 build: add operator tooling and harden setup

.devcontainer/Dockerfile

@@ -47,6 +47,14 @@ RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/s
 # Install Helm
 RUN curl -fsSL https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
 
+# Install Go for the Kubernetes operator
+ARG GO_VERSION=1.26.5
+RUN ARCH=$(dpkg --print-architecture) \
+    && curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o /tmp/go.tar.gz \
+    && tar -C /usr/local -xzf /tmp/go.tar.gz \
+    && rm /tmp/go.tar.gz
+ENV PATH="/usr/local/go/bin:/home/dev/go/bin:${PATH}"
+
 # Enable systemd
 RUN find /lib/systemd/system/sysinit.target.wants -mindepth 1 -not -name "systemd-tmpfiles-setup.service" -delete; \
     find /lib/systemd/system/multi-user.target.wants -mindepth 1 -not -name "systemd-user-sessions.service" -delete; \

.devcontainer/post-create.sh

@@ -5,24 +5,65 @@ echo "=============================================="
 echo "  Minikura Development Environment Setup"
 echo "=============================================="
 
-# Start Docker
+# sudo resolves the container hostname via DNS and stalls for seconds on each
+# call until the name is in /etc/hosts.
+if ! grep -q "$(hostname)" /etc/hosts 2>/dev/null; then
+    echo "127.0.0.1 $(hostname)" | sudo -n tee -a /etc/hosts >/dev/null 2>&1 || true
+fi
+
+# Start Docker. systemd is PID 1 here, so `service` proxies to systemctl and
+# blocks; --no-block plus an explicit wait keeps a failed unit from hanging.
 echo "==> Starting Docker..."
-sudo service docker start
-sleep 2
-sudo chmod 666 /var/run/docker.sock
+sudo systemctl start --no-block docker 2>/dev/null || sudo service docker start &
+for i in {1..30}; do
+    [ -S /var/run/docker.sock ] && break
+    sleep 1
+done
+sudo chmod 666 /var/run/docker.sock 2>/dev/null || true
+
+# The k3s installer fetches the binary with a bare `curl -sfL` and no retry, so
+# one transient reset aborts the whole install. Fetch it here with retries and
+# hand it over via INSTALL_K3S_SKIP_DOWNLOAD.
+K3S_VERSION="${K3S_VERSION:-v1.31.5+k3s1}"
+K3S_ARCH=$(dpkg --print-architecture)
+K3S_BIN_URL="https://github.com/k3s-io/k3s/releases/download/${K3S_VERSION//+/%2B}/k3s"
+[ "$K3S_ARCH" != "amd64" ] && K3S_BIN_URL="${K3S_BIN_URL}-${K3S_ARCH}"
+
+echo "==> Downloading k3s ${K3S_VERSION} (${K3S_ARCH})..."
+if ! sudo curl -fL --retry 5 --retry-delay 3 --retry-all-errors \
+        --connect-timeout 20 --max-time 600 \
+        -o /usr/local/bin/k3s "$K3S_BIN_URL"; then
+    echo "[ERROR] Failed to download the k3s binary from:"
+    echo "        $K3S_BIN_URL"
+    echo "        Check container network access to github.com and retry."
+    exit 1
+fi
+sudo chmod 755 /usr/local/bin/k3s
 
-# Install and start k3s via install script (sets up systemd service)
 echo "==> Installing k3s..."
-curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--write-kubeconfig-mode 644 --disable traefik" sh -
+curl -sfL https://get.k3s.io | \
+    INSTALL_K3S_EXEC="--write-kubeconfig-mode 644 --disable traefik" \
+    INSTALL_K3S_SKIP_DOWNLOAD=true \
+    INSTALL_K3S_SKIP_START=true sh -
 
-# Wait for k3s to be ready
-echo "==> Waiting for k3s..."
-sleep 5
+# Started separately from the installer so a unit that never activates surfaces
+# as a timeout below rather than blocking the install indefinitely.
+echo "==> Starting k3s..."
+sudo systemctl enable --now --no-block k3s 2>/dev/null || sudo systemctl start k3s || true
 
-# Configure kubectl
-echo "==> Configuring kubectl..."
+echo "==> Waiting for k3s kubeconfig..."
 mkdir -p /home/dev/.kube
-until [ -f /etc/rancher/k3s/k3s.yaml ]; do sleep 1; done
+for i in {1..90}; do
+    [ -f /etc/rancher/k3s/k3s.yaml ] && break
+    if [ "$i" -eq 90 ]; then
+        echo "[ERROR] k3s did not write a kubeconfig within 90s."
+        echo "        Check: sudo systemctl status k3s; sudo journalctl -xeu k3s"
+        exit 1
+    fi
+    sleep 1
+done
+
+echo "==> Configuring kubectl..."
 sudo cp /etc/rancher/k3s/k3s.yaml /home/dev/.kube/config
 sudo chown dev:dev /home/dev/.kube/config
 chmod 600 /home/dev/.kube/config
@@ -43,17 +84,17 @@ sleep 2  # Extra buffer for stability
 echo "==> Verifying k3s..."
 kubectl get nodes || { echo "[ERROR] k3s not responding properly"; exit 1; }
 
-# Wait for node to be Ready
 echo "==> Waiting for node to be Ready..."
-for i in {1..30}; do
-    kubectl get nodes 2>/dev/null | grep -q " Ready" && break
-    sleep 2
-done
+kubectl wait --for=condition=Ready node --all --timeout=120s \
+    || echo "[WARN] node did not reach Ready; continuing"
 
-# Create namespace
 echo "==> Creating minikura namespace..."
 kubectl create namespace minikura --dry-run=client -o yaml | kubectl apply -f - 2>/dev/null || true
 
+echo "==> Installing CRDs..."
+kubectl apply -f /workspace/operator/config/crd 2>/dev/null \
+    || echo "[WARN] CRD install failed; run 'make install-crds' in operator/"
+
 # Install dependencies
 echo "==> Installing dependencies..."
 cd /workspace
@@ -65,11 +106,3 @@ bun install
 echo "==> Setting up database..."
 bun run db:generate
 bun run db:push
-
-echo ""
-echo "=============================================="
-echo "  Ready! Commands:"
-echo "    bun run dev      - Start backend + web"
-echo "    bun run k8s:dev  - Start K8s operator"
-echo "    kubectl get nodes"
-echo "=============================================="