Fix Bare Docker access: HTTP unix socket support for dockerode

bare-http1 ignores socketPath and always dials TCP localhost:80, so
dockerode got HTTP 301→HTTPS and TLS errors. Patch the Bare http Agent
to connect via bare-net IPC when socketPath is set, matching Node.

server/services/docker.js

@@ -1,15 +1,45 @@
 /**
  * Shared Dockerode client.
+ *
+ * Prefer the unix socket. Explicit host: undefined so docker-modem does not
+ * fall back to TCP localhost (which bare-http would hit without socketPath).
  */
 import Docker from 'dockerode'
 import os from 'os'
+import fs from 'fs'
 
-const socketPath =
-  os.platform() === 'win32'
-    ? '//./pipe/dockerDesktopLinuxEngine'
-    : '/var/run/docker.sock'
+function resolveSocketPath() {
+  if (process.env.DOCKER_HOST?.startsWith('unix://')) {
+    return process.env.DOCKER_HOST.slice('unix://'.length) || '/var/run/docker.sock'
+  }
+  if (os.platform() === 'win32') {
+    return '//./pipe/dockerDesktopLinuxEngine'
+  }
+  const candidates = [
+    process.env.DOCKER_SOCK,
+    '/var/run/docker.sock',
+    `${os.homedir()}/.docker/run/docker.sock`,
+  ].filter(Boolean)
+  for (const p of candidates) {
+    try {
+      fs.accessSync(p)
+      return p
+    } catch {
+      // try next
+    }
+  }
+  return '/var/run/docker.sock'
+}
 
-export const docker = new Docker({ socketPath })
+const socketPath = resolveSocketPath()
+
+export const docker = new Docker({
+  socketPath,
+  // Force unix-socket mode in docker-modem (do not set host)
+  protocol: 'http',
+})
+
+export { socketPath as dockerSocketPath }
 
 /**
  * Normalize docker.listVolumes() response shapes across API versions.