fix(shell): restart browser sidecar reliably via healthcheck + DinD isolation

- add healthcheck to browser service (curl /json/version on port 9223) so Docker
  knows when CDP is actually ready instead of just when the container started
- switch depends_on to condition: service_healthy so the main container waits
  for a healthy browser before starting — fixes the restart race condition (#137)
- replace host docker.sock bind-mount in docker-compose.api.yml with a dedicated
  DinD service (docker:27-dind) and set DOCKER_HOST=tcp://dind:2375 in api,
  providing full Docker isolation without touching the host daemon

Closes #137

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: skulidropek

docker-compose.api.yml

@@ -1,4 +1,14 @@
 services:
+  dind:
+    image: docker:27-dind
+    container_name: docker-git-dind
+    privileged: true
+    environment:
+      DOCKER_TLS_CERTDIR: ""
+    volumes:
+      - docker-git-dind-storage:/var/lib/docker
+    restart: unless-stopped
+
   api:
     build:
       context: .
@@ -9,9 +19,14 @@ services:
       DOCKER_GIT_PROJECTS_ROOT: ${DOCKER_GIT_PROJECTS_ROOT:-/home/dev/.docker-git}
       DOCKER_GIT_FEDERATION_PUBLIC_ORIGIN: ${DOCKER_GIT_FEDERATION_PUBLIC_ORIGIN:-}
       DOCKER_GIT_FEDERATION_ACTOR: ${DOCKER_GIT_FEDERATION_ACTOR:-docker-git}
+      DOCKER_HOST: tcp://dind:2375
     ports:
       - "${DOCKER_GIT_API_BIND_HOST:-127.0.0.1}:${DOCKER_GIT_API_PORT:-3334}:${DOCKER_GIT_API_PORT:-3334}"
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
       - ${DOCKER_GIT_PROJECTS_ROOT_HOST:-/home/dev/.docker-git}:${DOCKER_GIT_PROJECTS_ROOT:-/home/dev/.docker-git}
+    depends_on:
+      - dind
     restart: unless-stopped
+
+volumes:
+  docker-git-dind-storage:

packages/lib/src/core/templates/docker-compose.ts

@@ -78,13 +78,13 @@ const buildPlaywrightFragments = (
   const browserCdpEndpoint = `http://${browserServiceName}:9223`
 
   return {
-    maybeDependsOn: `    depends_on:\n      - ${browserServiceName}\n`,
+    maybeDependsOn: `    depends_on:\n      ${browserServiceName}:\n        condition: service_healthy\n`,
     maybePlaywrightEnv:
       `      MCP_PLAYWRIGHT_ENABLE: "1"\n      MCP_PLAYWRIGHT_CDP_ENDPOINT: "${browserCdpEndpoint}"\n`,
     maybeBrowserService:
       `\n  ${browserServiceName}:\n    build:\n      context: .\n      dockerfile: ${browserDockerfile}\n    container_name: ${browserContainerName}\n    restart: unless-stopped\n${
         renderResourceLimits(resourceLimits)
-      }    environment:\n      VNC_NOPW: "1"\n    shm_size: "2gb"\n    expose:\n      - "9223"\n    volumes:\n      - ${browserVolumeName}:/data\n    networks:\n      - ${networkName}\n`,
+      }    healthcheck:\n      test: ["CMD", "curl", "-sf", "http://localhost:9223/json/version"]\n      interval: 5s\n      timeout: 3s\n      retries: 10\n      start_period: 15s\n    environment:\n      VNC_NOPW: "1"\n    shm_size: "2gb"\n    expose:\n      - "9223"\n    volumes:\n      - ${browserVolumeName}:/data\n    networks:\n      - ${networkName}\n`,
     maybeBrowserVolume: `  ${browserVolumeName}:\n`
   }
 }