fix(docker): use sandbox ID for recorded startup failures

Keep the workload container ID for Docker inspection and use the sandbox ID to retrieve the monitor failure. Test with distinct identifiers so the lookup cannot accidentally pass with a container ID.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

crates/openshell-driver-docker/src/lib.rs

@@ -5240,7 +5240,8 @@ async fn spawn_docker_control_process(
     let supervisor_id = created.id;
     let monitored_supervisor_id = supervisor_id.clone();
     let monitored_docker = failure_context.docker.clone();
-    let readiness_sandbox_id = failure_context.container_id.clone();
+    let readiness_container_id = failure_context.container_id.clone();
+    let readiness_sandbox_id = sandbox_id.clone();
     let readiness_failures = failure_context.failures.clone();
     let task = tokio::spawn(async move {
         let wait = async {
@@ -5317,6 +5318,7 @@ async fn spawn_docker_control_process(
     if let Err(error) = Box::pin(wait_for_docker_supervisor_ready(
         docker,
         &supervisor_id,
+        &readiness_container_id,
         &readiness_sandbox_id,
         &readiness_failures,
     ))
@@ -5331,6 +5333,7 @@ async fn spawn_docker_control_process(
 async fn wait_for_docker_supervisor_ready(
     docker: &Docker,
     supervisor_id: &str,
+    workload_container_id: &str,
     sandbox_id: &str,
     failures: &Arc<Mutex<HashMap<String, DockerRuntimeFailure>>>,
 ) -> Result<(), Status> {
@@ -5341,7 +5344,7 @@ async fn wait_for_docker_supervisor_ready(
         if let Some(status) = recorded_workspace_validation_failure(failures, sandbox_id).await {
             return Err(status);
         }
-        let sandbox = match docker.inspect_container(sandbox_id, None).await {
+        let sandbox = match docker.inspect_container(workload_container_id, None).await {
             Ok(sandbox) => sandbox,
             Err(error) => {
                 return Err(recorded_workspace_validation_failure(failures, sandbox_id)

crates/openshell-driver-docker/src/tests.rs

@@ -3733,10 +3733,15 @@ async fn workspace_failure_survives_supervisor_cleanup_before_readiness_inspecti
     // There is no Docker daemon at this address: a monitor that has removed
     // the supervisor must not need another inspection to retain the reason.
     let docker = Docker::connect_with_http("127.0.0.1:1", 1, bollard::API_DEFAULT_VERSION).unwrap();
-    let status =
-        wait_for_docker_supervisor_ready(&docker, "removed-supervisor", "sandbox-1", &failures)
-            .await
-            .expect_err("the recorded workspace failure takes precedence over inspection");
+    let status = wait_for_docker_supervisor_ready(
+        &docker,
+        "removed-supervisor",
+        "workload-container-1",
+        "sandbox-1",
+        &failures,
+    )
+    .await
+    .expect_err("the recorded workspace failure takes precedence over inspection");
     assert_eq!(
         supervisor_start_failure_reason(&status, "ControlSupervisorStartFailed"),
         CONDITION_WORKSPACE_VALIDATION_FAILED