chore(docker): supply docker compose via Bazel (#830)

## Why?

Host-installed Compose versions can reject flags such as `up --wait`,
breaking local stacks and Docker tests.

## What?

- Use `rules_docker_compose` 0.4.0 and its default Compose 5.5.1
directly from Bazel and test runfiles. Upgrade both through
`MODULE.bazel`.
- Upgrade rules_go to 0.59.0 and Gazelle to 0.53.0; keep Go 1.25.0.
- Make service Dockerfiles work without Buildx. Docker CLI and a
reachable daemon remain required.

## Test Plan

Build, 134 unit targets, 13 Docker integration/e2e targets,
documentation, lint, Gazelle, tidy, and mock checks passed. Verified
startup, a demo request reaching landed, and shutdown without Buildx or
a host Compose plugin.

Unit checks used isolated Git configuration and pinned helpers. Live
GitHub cases skipped without credentials. The shared verifier could not
complete coverage/lint checks; repository checks passed.

To try locally:

```bash
./tool/bazel run @rules_docker_compose//docker_compose -- version
make local-submitqueue-start
make demo-requests COUNT=1 WATCH=true BURST=true
make local-submitqueue-stop
```


## Revert Plan

Revert this PR to restore host-selected Compose and previous build-rule
versions.

Author: mnoah1

MODULE.bazel

@@ -2,8 +2,8 @@
 # which is pulled in transitively by rules_go/rules_proto.
 bazel_dep(name = "toolchains_protoc", version = "0.6.1")
 bazel_dep(name = "git", version = "2.55.0")
-bazel_dep(name = "rules_go", version = "0.57.0")
-bazel_dep(name = "gazelle", version = "0.45.0")
+bazel_dep(name = "rules_go", version = "0.59.0")
+bazel_dep(name = "gazelle", version = "0.53.0")
 bazel_dep(name = "rules_proto", version = "7.1.0")
 bazel_dep(name = "aspect_rules_js", version = "3.5.0")
 bazel_dep(name = "aspect_rules_ts", version = "3.10.1")
@@ -15,6 +15,8 @@ bazel_dep(name = "rules_python", version = "2.2.0")
 bazel_dep(name = "bazel_lib", version = "3.7.2")
 bazel_dep(name = "platforms", version = "1.1.0")
 
+bazel_dep(name = "rules_docker_compose", version = "0.4.0", dev_dependency = True)
+
 single_version_override(
     module_name = "git",
     version = "2.55.0",

Makefile

@@ -1,27 +1,27 @@
 # Bazel wrapper
 BAZEL = ./tool/bazel
 
-# Docker Compose wrapper
-COMPOSE = docker-compose
+# Bazel supplies the pinned Docker Compose release for every local stack.
+COMPOSE = $(BAZEL) run @rules_docker_compose//docker_compose --
 
 # SubmitQueue compose files
-COMPOSE_FILE = service/submitqueue/docker-compose.yml
-WEB_COMPOSE_FILE = service/submitqueue/docker-compose.web.yml
-GATEWAY_COMPOSE_FILE = service/submitqueue/gateway/server/docker-compose.yml
-ORCHESTRATOR_COMPOSE_FILE = service/submitqueue/orchestrator/server/docker-compose.yml
+COMPOSE_FILE = $(abspath service/submitqueue/docker-compose.yml)
+GATEWAY_COMPOSE_FILE = $(abspath service/submitqueue/gateway/server/docker-compose.yml)
+ORCHESTRATOR_COMPOSE_FILE = $(abspath service/submitqueue/orchestrator/server/docker-compose.yml)
+WEB_COMPOSE_FILE = $(abspath service/submitqueue/docker-compose.web.yml)
 
 # Fixed project name for local manual testing (tests use unique random names)
 SUBMITQUEUE_LOCAL_PROJECT = submitqueue
 
 # Stovepipe compose file (single Ping-only service)
-STOVEPIPE_COMPOSE_FILE = service/stovepipe/docker-compose.yml
-STOVEPIPE_DEBUG_COMPOSE_FILE = service/stovepipe/docker-compose.debug.yml
+STOVEPIPE_COMPOSE_FILE = $(abspath service/stovepipe/docker-compose.yml)
+STOVEPIPE_DEBUG_COMPOSE_FILE = $(abspath service/stovepipe/docker-compose.debug.yml)
 
 # Fixed project name for local manual testing (tests use unique random names)
 STOVEPIPE_LOCAL_PROJECT = stovepipe
 
 # Runway compose files
-RUNWAY_COMPOSE_FILE = service/runway/server/docker-compose.yml
+RUNWAY_COMPOSE_FILE = $(abspath service/runway/server/docker-compose.yml)
 
 # Fixed project name for local manual testing (tests use unique random names)
 RUNWAY_LOCAL_PROJECT = runway
@@ -61,9 +61,9 @@ export SQ_PROVIDER_CONFIG_DIR ?= $(REPO_ROOT)/service/submitqueue/demo/provider/
 # Which compose overlay each mode needs. This cannot live in the provider
 # directory: the two config files say how the services are configured, not what
 # has to be mounted or which credential has to be present for them to start.
-PROVIDER_COMPOSE_FILE_fake = service/submitqueue/docker-compose.fake.yml
-PROVIDER_COMPOSE_FILE_git = service/submitqueue/docker-compose.git.yml
-PROVIDER_COMPOSE_FILE_github = service/submitqueue/docker-compose.provider.yml
+PROVIDER_COMPOSE_FILE_fake = $(abspath service/submitqueue/docker-compose.fake.yml)
+PROVIDER_COMPOSE_FILE_git = $(abspath service/submitqueue/docker-compose.git.yml)
+PROVIDER_COMPOSE_FILE_github = $(abspath service/submitqueue/docker-compose.provider.yml)
 PROVIDER_COMPOSE_FILE = $(PROVIDER_COMPOSE_FILE_$(PROVIDER))
 
 # Where PROVIDER=git keeps the bare repository it lands into. Outside the

README.md

@@ -18,7 +18,7 @@ Cross-domain Go code (errors, metrics, consumer framework, HTTP helpers, shared
 
 ## Quick Start
 
-Put traffic through the queue and watch it land. Requires Docker and Docker Compose, and nothing else — no repository, no account, no token.
+Put traffic through the queue and watch it land. Requires Docker; Bazel supplies Docker Compose. No repository, no account, no token.
 
 ```bash
 # Start the full stack (Gateway + Orchestrator + Runway + MySQL)

doc/howto/DEVELOPMENT.md

@@ -3,7 +3,7 @@
 ## Prerequisites
 
 - **Go 1.25+** — needed for `gopls`, `go mod`, and installing protoc plugins. Download from [go.dev/dl](https://go.dev/dl/). Note: Bazel manages its own Go toolchain for builds, but a local Go installation is required for editor tooling and dependency management.
-- **Docker** and **Docker Compose** — for integration and e2e tests, and for running services locally.
+- **Docker** — for integration and e2e tests, and for running services locally. Bazel supplies Docker Compose.
 - **direnv** (recommended) — automatically loads `.envrc` so you can use `bazel` directly instead of `./tool/bazel`.
 
 The project includes `./tool/bazel` (Bazelisk wrapper) and `.bazelversion`, so you don't need to install Bazel separately. Bazel manages its own Go toolchain for building and testing.

doc/howto/QUICKSTART.md

@@ -183,9 +183,13 @@ SQ_TOKEN=$(cat ~/.sq-token) bazel run //service/submitqueue/gateway/client:gatew
 
 ### Service logs
 
+Follow logs from every service, or just Runway:
+
 ```bash
-make local-submitqueue-logs                  # every service
-docker compose -p submitqueue logs -f runway-service   # one of them
+make local-submitqueue-logs
+REPO_ROOT="$PWD" ./tool/bazel run @rules_docker_compose//docker_compose -- \
+  -f "$PWD/service/submitqueue/docker-compose.yml" \
+  -p submitqueue logs -f runway-service
 ```
 
 The message queue logs a line per message published, fetched, leased and acked, which at debug level buries everything else a service says. It is levelled separately from the rest of the service, at info by default. To follow the queue itself — chasing a message that never arrived, or a partition that never got leased — turn it back up:

go.mod

@@ -4,6 +4,7 @@ go 1.25.0
 
 require (
 	github.com/DATA-DOG/go-sqlmock v1.5.0
+	github.com/bazelbuild/rules_go v0.59.0
 	github.com/go-sql-driver/mysql v1.6.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1

go.sum

@@ -11,6 +11,8 @@ github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRF
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
+github.com/bazelbuild/rules_go v0.59.0 h1:RLhOwYIqeMgBpKelHEWTfIPjA37so3oa/rX+/qqq/P4=
+github.com/bazelbuild/rules_go v0.59.0/go.mod h1:Pn30cb4M513fe2rQ6GiJ3q8QyrRsgC7zhuDvi50Lw4Y=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

service/runway/server/Dockerfile

@@ -16,7 +16,8 @@ RUN apt-get update && apt-get install -y ca-certificates git && rm -rf /var/lib/
 WORKDIR /app
 
 # Built via: make build-runway-linux
-COPY --chmod=0555 .docker-bin/runway ./runway
+COPY .docker-bin/runway ./runway
+RUN chmod 0555 ./runway
 
 EXPOSE 8080
 

service/submitqueue/gateway/server/Dockerfile

@@ -6,11 +6,13 @@ WORKDIR /app
 
 # Copy pre-built Linux binary
 # Built via: make build-submitqueue-gateway-linux
-COPY --chmod=0555 .docker-bin/gateway ./gateway
+COPY .docker-bin/gateway ./gateway
+RUN chmod 0555 ./gateway
 
 # Sample queue configuration; the gateway reads it on startup via
 # QUEUE_CONFIG_PATH (set in docker-compose.yml).
-COPY --chmod=0444 service/submitqueue/gateway/server/queues.yaml ./queues.yaml
+COPY service/submitqueue/gateway/server/queues.yaml ./queues.yaml
+RUN chmod 0444 ./queues.yaml
 
 EXPOSE 8080
 

service/submitqueue/orchestrator/server/Dockerfile

@@ -17,7 +17,8 @@ WORKDIR /app
 
 # Copy pre-built Linux binary
 # Built via: make build-submitqueue-orchestrator-linux
-COPY --chmod=0555 .docker-bin/orchestrator ./orchestrator
+COPY .docker-bin/orchestrator ./orchestrator
+RUN chmod 0555 ./orchestrator
 
 EXPOSE 8080