Diagnosing a failing app meant reading its container logs, and the only route to them was raw docker. The target mirrors compose-app-exec and goes through the same container wrapper, so the log route is no wider than the exec route already is.
