Summary

Expose OneDev workspace port-mapping information inside the workspace so tools that require an allowlist of external origins (e.g. --allowed-origins=http://HOST:PORT) can be started with the same host/port used by Port Mappings links.

Agreed design from issue #2928.

Motivation

Workspace containers publish ports via Docker (docker -P today). The Port Mappings UI shows host → published port (e.g. 9832 → 55012), but nothing inside the workspace currently exposes that mapped host port (or the Port Mappings host) in a form a startup script can consume before launching tools.

Agreed design

1. Pre-allocate free host ports for each exposed container port before the workspace container starts (automatic; users do not coordinate ports across workspaces on the same agent).
2. Write a sourceable env-style file into the mounted workspace directory before the container starts.
3. Start the container so the entrypoint can source the file immediately.

Variables in that file

Example

tool --allowed-origins=http://$WORKSPACE_AGENT_HOST:$WORKSPACE_PORT_9832

Constraints / notes

• Docker cannot update the environment of a running container, and with random -P assignment host ports are only known at start time — so pure -P cannot provide a file that exists before the entrypoint runs.
• Pre-allocating free host ports (instead of Docker -P) satisfies “available at startup” without requiring users to manage port clashes.
• Container HOSTNAME is not a reliable Port Mappings host; always expose WORKSPACE_AGENT_HOST explicitly.

Acceptance criteria

1. For every exposed workspace container port, a free host port is chosen before container start (no cross-workspace clash on the agent).
2. An env-style file is present in the mounted workspace directory before the container entrypoint runs.
3. The file defines WORKSPACE_AGENT_HOST and WORKSPACE_PORT_<containerPort> for all exposed ports.
4. Port Mappings UI links use the same host/ports as those variables.
5. Entrypoint/startup scripts can source the file and launch tools with origins matching browser access URLs.

Context

Original discussion and use case: issue #2928.