Docker backend cannot find credential helper under Homebrew service PATH

[STRRL]

This was generated by AI during triage.

Problem

When elastic-fruit-runner runs as a Homebrew launchd service, the service PATH can omit /usr/local/bin. On hosts where Docker or OrbStack installs docker-credential-osxkeychain under /usr/local/bin, Docker image pulls from the daemon fail even though the same pull works in an interactive shell.

Observed error:

docker: error getting credentials - err: exec: "docker-credential-osxkeychain": executable file not found in $PATH

Impact

GitHub scale set registration succeeds and the listener receives jobs, but the Docker backend cannot start ephemeral runners because docker run fails while resolving registry credentials. Jobs can remain queued or repeatedly fail to spawn runners.

Reproduction Notes

On a macOS host using Homebrew services and OrbStack:

1. Configure a Docker runner set.
2. Start the daemon through brew services start elastic-fruit-runner.
3. Queue a workflow that targets the Docker runner set.
4. Check /opt/homebrew/var/log/elastic-fruit-runner.log.

The daemon logs scale set ready and listening for jobs, then start runner failed with the credential helper error above.

Expected Fix Direction

Make Docker backend subprocesses robust to Homebrew launchd PATH differences. Possible options:

1. Include common Docker helper directories such as /usr/local/bin in the service environment.
2. Resolve credential helper paths before invoking Docker.
3. Document the required helper path setup for OrbStack and Docker Desktop.

The local workaround was adding:

/opt/homebrew/bin/docker-credential-osxkeychain -> /usr/local/bin/docker-credential-osxkeychain

That workaround allowed docker pull --platform linux/arm64 ghcr.io/quipper/actions-runner:2.332.0 to succeed under the service PATH.