ci: Add Docker image runtime validation

.github/workflows/ci.yml

@@ -53,3 +53,74 @@ jobs:
 
       - name: Build Docker image
         run: docker build -t distributed-traffic-control:${{ github.sha }} .
+
+      - name: Validate Docker image at runtime
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+
+          IMAGE="distributed-traffic-control:${GITHUB_SHA}"
+          NETWORK="traffic-control-ci-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          REDIS_CONTAINER="${NETWORK}-redis"
+          APP_CONTAINER="${NETWORK}-app"
+
+          cleanup() {
+            docker rm -f "$APP_CONTAINER" "$REDIS_CONTAINER" >/dev/null 2>&1 || true
+            docker network rm "$NETWORK" >/dev/null 2>&1 || true
+          }
+          trap cleanup EXIT
+
+          docker network create "$NETWORK"
+
+          docker run -d \
+            --name "$REDIS_CONTAINER" \
+            --network "$NETWORK" \
+            redis:7-alpine
+
+          for attempt in $(seq 1 15); do
+            if docker exec "$REDIS_CONTAINER" redis-cli ping | grep -q PONG; then
+              break
+            fi
+
+            if [ "$attempt" -eq 15 ]; then
+              echo "Redis did not become ready."
+              docker logs "$REDIS_CONTAINER"
+              exit 1
+            fi
+
+            sleep 2
+          done
+
+          docker run -d \
+            --name "$APP_CONTAINER" \
+            --network "$NETWORK" \
+            -p 127.0.0.1::8081 \
+            -e SERVER_PORT=8081 \
+            -e REDIS_HOST="$REDIS_CONTAINER" \
+            -e REDIS_PORT=6379 \
+            -e NODE_ID=ci-validation \
+            -e LEASE_DURATION=PT30S \
+            -e LEASE_CAPACITY=10 \
+            "$IMAGE"
+
+          PORT=$(docker port "$APP_CONTAINER" 8081/tcp | awk -F: '{print $NF}')
+
+          for attempt in $(seq 1 30); do
+            if curl --fail --silent "http://127.0.0.1:${PORT}/actuator/health"; then
+              echo
+              echo "Docker image runtime validation passed."
+              exit 0
+            fi
+
+            if [ "$(docker inspect -f '{{.State.Running}}' "$APP_CONTAINER")" != "true" ]; then
+              echo "Application container exited before becoming healthy."
+              docker logs "$APP_CONTAINER"
+              exit 1
+            fi
+
+            sleep 2
+          done
+
+          echo "Application health endpoint did not become ready in time."
+          docker logs "$APP_CONTAINER"
+          exit 1