Replace Docker healthcheck with s6 readiness notifications

[dash14]

Summary

Replace Docker's healthcheck with s6 readiness notifications and manage buildkitd as an s6 service instead of the container's CMD.

Why

Docker healthcheck was insufficient for startup ordering

The previous setup used Docker's healthcheck to signal container readiness. However, this only tells Docker Compose that the container is healthy — it does not coordinate startup order within the container. buildkitd was launched as the container's CMD and could start before dnsmasq or haproxy were actually ready. While this race condition had not caused issues in practice, the startup order was not guaranteed and relied on timing rather than explicit dependency management.

buildkitd needs to wait for dependencies

buildkitd depends on dnsmasq (DNS resolution for builds), haproxy (proxy enforcement), and iptables rules (network isolation). These must all be ready before buildkitd accepts connections. s6's dependency system (dependencies.d/) enforces this ordering natively — buildkitd only starts after dnsmasq and haproxy report readiness and init-iptables completes.

s6-overlay installation was unnecessarily complex

s6-overlay was downloaded from GitHub releases via curl + tar + xz at build time, requiring architecture detection and a multi-step extraction. Alpine's apk repository already packages s6-overlay, so using apk add simplifies the Dockerfile and eliminates the pinned archive download.

Changes

• Add buildkitd as an s6 longrun service with dependencies on dnsmasq, haproxy, and init-iptables
• Add s6-notifyoncheck with health check scripts to dnsmasq and haproxy services for readiness notification
• Remove CMD from Dockerfile — buildkitd is now managed by s6
• Remove Docker healthcheck from compose.yml and setup/compose.yml
• Remove RUN chmod — files are committed with correct permissions
• Install s6-overlay via apk add instead of downloading from GitHub releases