test(docker): extract runImageDetached helper to fix Sonar duplication gate

Sonar flagged 17.9% duplication on new code: TestImageFirstBootAutoInit
and TestImageServesHealthEndpoints share the same docker-run + cleanup +
hostPort envelope. Lift it into runImageDetached and call from both.

Author: aaronbrethorst

dockertest/docker_test.go

@@ -199,19 +199,7 @@ func TestImageFirstBootAutoInit(t *testing.T) {
 	}
 
 	containerName := fmt.Sprintf("hooks-dockertest-fb-%d", time.Now().UnixNano())
-	out, err := exec.Command("docker", "run", "-d", "--rm",
-		"--name", containerName,
-		"-v", dir+":/data",
-		"-e", "RENDER_WEBHOOK_SECRET=stub-for-tests",
-		"-p", "0:8080",
-		imageTag,
-	).CombinedOutput()
-	if err != nil {
-		t.Fatalf("docker run: %v\n%s", err, out)
-	}
-	t.Cleanup(func() { cleanupContainer(t, containerName) })
-
-	addr := "http://127.0.0.1:" + hostPort(t, containerName, "8080/tcp")
+	addr := runImageDetached(t, containerName, dir)
 	if err := waitForHealthz(addr, 60*time.Second); err != nil {
 		// Logs may contain the admin token from auto-init; never echo raw.
 		t.Fatalf("/healthz never returned 200: %v (logs redacted: may contain admin token)", err)
@@ -237,19 +225,7 @@ func TestImageServesHealthEndpoints(t *testing.T) {
 	dir := scaffoldDataDir(t)
 
 	containerName := fmt.Sprintf("hooks-dockertest-%d", time.Now().UnixNano())
-	out, err := exec.Command("docker", "run", "-d", "--rm",
-		"--name", containerName,
-		"-v", dir+":/data",
-		"-e", "RENDER_WEBHOOK_SECRET=stub-for-tests",
-		"-p", "0:8080",
-		imageTag,
-	).CombinedOutput()
-	if err != nil {
-		t.Fatalf("docker run: %v\n%s", err, out)
-	}
-	t.Cleanup(func() { cleanupContainer(t, containerName) })
-
-	addr := "http://127.0.0.1:" + hostPort(t, containerName, "8080/tcp")
+	addr := runImageDetached(t, containerName, dir)
 	if err := waitForHealthz(addr, 60*time.Second); err != nil {
 		t.Fatalf("/healthz never returned 200: %v\nlogs:\n%s", err, dockerLogs(containerName))
 	}
@@ -544,6 +520,30 @@ func TestImageInitFailsClearlyOn0o755HostDir(t *testing.T) {
 	}
 }
 
+// runImageDetached starts the standard test envelope (image, /data
+// bind-mounted from dir, stub RENDER_WEBHOOK_SECRET, ephemeral host port
+// → 8080, detached + auto-remove) and registers container cleanup on t.
+// Returns the http://127.0.0.1:<port> base URL the test should hit.
+//
+// Tests that need different env, no --rm, no port mapping, or a non-server
+// invocation should call docker directly rather than thread parameters
+// through here — every variant added here costs more than it saves.
+func runImageDetached(t *testing.T, name, dir string) string {
+	t.Helper()
+	out, err := exec.Command("docker", "run", "-d", "--rm",
+		"--name", name,
+		"-v", dir+":/data",
+		"-e", "RENDER_WEBHOOK_SECRET=stub-for-tests",
+		"-p", "0:8080",
+		imageTag,
+	).CombinedOutput()
+	if err != nil {
+		t.Fatalf("docker run: %v\n%s", err, out)
+	}
+	t.Cleanup(func() { cleanupContainer(t, name) })
+	return "http://127.0.0.1:" + hostPort(t, name, "8080/tcp")
+}
+
 // waitForHealthz polls /healthz on the running container until it returns
 // 200 or the deadline expires. Server-side errors (5xx) are preserved
 // across iterations — if the server ever returned 500 then died, the