fix: harden operations and configuration recovery

internal/dockerclient/dockerclient_test.go

@@ -656,6 +656,39 @@ func (f *failingFS) AtomicWrite(path string, data []byte, mode os.FileMode, owne
 	return f.FileSystem.AtomicWrite(path, data, mode, owner)
 }
 
+type concurrentChangeFS struct {
+	dockerclient.FileSystem
+	configPath string
+	reads      int
+}
+
+func (f *concurrentChangeFS) ReadFile(path string) ([]byte, error) {
+	if path == f.configPath {
+		f.reads++
+		if f.reads == 3 {
+			if err := os.WriteFile(path, []byte(`{"auths":{"registry.example":{"auth":"external-update"}}}`), 0o600); err != nil {
+				return nil, err
+			}
+		}
+	}
+	return f.FileSystem.ReadFile(path)
+}
+
+func TestConcurrentDockerConfigChangeIsNotOverwritten(t *testing.T) {
+	files := &concurrentChangeFS{FileSystem: dockerclient.OSFileSystem{}}
+	a := newAdapter(t, files)
+	files.configPath = a.ConfigPath()
+	writeConfig(t, a.ConfigPath(), `{"auths":{"registry.example":{"auth":"original"}}}`)
+
+	result := a.SetDesired(context.Background(), true, activeProfile())
+	if result.Err == nil || !strings.Contains(result.Err.Error(), "changed concurrently") {
+		t.Fatalf("concurrent update result = %#v", result)
+	}
+	if got := readFile(t, a.ConfigPath()); !strings.Contains(got, "external-update") || strings.Contains(got, "httpProxy") {
+		t.Fatalf("external Docker config update was overwritten: %s", got)
+	}
+}
+
 type countingFS struct {
 	dockerclient.FileSystem
 	writes int