Let docker-install.sh take its three answers up front

The script asked three questions with no way to answer them in advance,
so a Docker container could not be deployed unattended: Portainer, the
Portainer Agent, and whether to expose the TCP socket.

Each now reads a variable and prompts only when it is unset, the same
shape install/forgejo-runner-install.sh already uses:

  var_portainer         yes | no
  var_portainer_agent   yes | no
  var_docker_socket     n | l (127.0.0.1) | a (0.0.0.0)

Interactive behaviour is unchanged — with nothing set, all three still
ask exactly as before.

The matching declaration for the script's PocketBase record, which the
website generator reads to offer these as form fields:

  "app_vars": [
    {"name":"var_portainer","label":"Install Portainer","type":"boolean","default":"no"},
    {"name":"var_portainer_agent","label":"Install Portainer Agent","type":"boolean","default":"no",
     "help":"Only used when Portainer itself is not installed"},
    {"name":"var_docker_socket","label":"Expose Docker TCP socket","type":"select",
     "options":["n","l","a"],"default":"n",
     "help":"l = 127.0.0.1 only, a = all interfaces (insecure)"}
  ]

CONTRIBUTING.md documents the convention so the next script follows it.

CONTRIBUTING.md

@@ -103,6 +103,47 @@ Key rules at a glance:
 - Quote all variables: `"$VAR"` not `$VAR`
 - Use lowercase variable names
 - Do not hardcode credentials or sensitive values
+- Never prompt without an escape hatch — see below
+
+### Answering a prompt up front
+
+An install script that only asks cannot be deployed unattended. Read the
+variable first and prompt only when it is unset:
+
+```bash
+if [[ -z "${var_admin_user:-}" ]]; then
+  read -r -p "${TAB3}Admin username: " var_admin_user
+fi
+var_admin_user="${var_admin_user:-admin}"
+```
+
+Name them `var_<something>`, the same namespace the container variables use.
+`install/forgejo-runner-install.sh` and `install/docker-install.sh` both follow
+this.
+
+Declare them on the script's PocketBase record in `app_vars` so the website's
+generator can offer them as fields:
+
+```json
+"app_vars": [
+  {
+    "name": "var_admin_user",
+    "label": "Admin Username",
+    "type": "text",
+    "default": "admin"
+  },
+  {
+    "name": "var_admin_pass",
+    "label": "Admin Password",
+    "type": "password",
+    "secret": true
+  }
+]
+```
+
+`type` is one of `text`, `password`, `number`, `boolean` (`yes`/`no`) or
+`select` (with `options`). Mark anything credential-like `secret` — the
+generator keeps those out of shareable links and out of the on-screen summary.
 
 Full standards and examples: **[community-scripts.org/docs/contribution](https://community-scripts.org/docs/contribution)**
 

install/docker-install.sh

@@ -17,11 +17,24 @@ PORTAINER_AGENT_LATEST_VERSION=$(get_latest_github_release "portainer/agent")
 
 setup_docker
 
-if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
+# Every choice below can be supplied up front so the install runs unattended.
+# Same convention as install/forgejo-runner-install.sh: read the variable, and
+# only ask when it was not set.
+if [[ -z "${var_portainer:-}" ]]; then
+  if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
+    var_portainer="yes"
+  else
+    var_portainer="no"
+  fi
+fi
+
+if [[ "${var_portainer:-}" =~ ^([yY]|[yY][eE][sS])$ ]]; then
   bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)" <<<"y"
 else
-  read -r -p "${TAB3}Would you like to install the Portainer Agent (for remote management)? <y/N> " prompt_agent
-  if [[ ${prompt_agent,,} =~ ^(y|yes)$ ]]; then
+  if [[ -z "${var_portainer_agent:-}" ]]; then
+    read -r -p "${TAB3}Would you like to install the Portainer Agent (for remote management)? <y/N> " var_portainer_agent
+  fi
+  if [[ "${var_portainer_agent:-}" =~ ^([yY]|[yY][eE][sS])$ ]]; then
     msg_info "Installing Portainer Agent $PORTAINER_AGENT_LATEST_VERSION"
     $STD docker run -d \
       -p 9001:9001 \
@@ -34,12 +47,14 @@ else
   fi
 fi
 
-read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
-case "${socket_choice,,}" in
-l)
+if [[ -z "${var_docker_socket:-}" ]]; then
+  read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " var_docker_socket
+fi
+case "${var_docker_socket:-}" in
+l | L | local | Local)
   socket="tcp://127.0.0.1:2375"
   ;;
-a)
+a | A | all | All)
   socket="tcp://0.0.0.0:2375"
   ;;
 *)