From 5748953236997f94420fcebdeabac1cb478b5729 Mon Sep 17 00:00:00 2001 From: Matthew Grossman Date: Tue, 6 Oct 2026 09:07:34 -0700 Subject: [PATCH] fix(docker): use sandbox ID for recorded startup failures Keep the workload container ID for Docker inspection and use the sandbox ID to retrieve the monitor failure. Test with distinct identifiers so the lookup cannot accidentally pass with a container ID. Signed-off-by: Matthew Grossman --- crates/openshell-driver-docker/src/lib.rs | 7 +++++-- crates/openshell-driver-docker/src/tests.rs | 13 +++++++++---- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/crates/openshell-driver-docker/src/lib.rs b/crates/openshell-driver-docker/src/lib.rs index 3b3ea73a7..eb3338751 100644 --- a/crates/openshell-driver-docker/src/lib.rs +++ b/crates/openshell-driver-docker/src/lib.rs @@ -5240,7 +5240,8 @@ async fn spawn_docker_control_process( let supervisor_id = created.id; let monitored_supervisor_id = supervisor_id.clone(); let monitored_docker = failure_context.docker.clone(); - let readiness_sandbox_id = failure_context.container_id.clone(); + let readiness_container_id = failure_context.container_id.clone(); + let readiness_sandbox_id = sandbox_id.clone(); let readiness_failures = failure_context.failures.clone(); let task = tokio::spawn(async move { let wait = async { @@ -5317,6 +5318,7 @@ async fn spawn_docker_control_process( if let Err(error) = Box::pin(wait_for_docker_supervisor_ready( docker, &supervisor_id, + &readiness_container_id, &readiness_sandbox_id, &readiness_failures, )) @@ -5331,6 +5333,7 @@ async fn spawn_docker_control_process( async fn wait_for_docker_supervisor_ready( docker: &Docker, supervisor_id: &str, + workload_container_id: &str, sandbox_id: &str, failures: &Arc>>, ) -> Result<(), Status> { @@ -5341,7 +5344,7 @@ async fn wait_for_docker_supervisor_ready( if let Some(status) = recorded_workspace_validation_failure(failures, sandbox_id).await { return Err(status); } - let sandbox = match docker.inspect_container(sandbox_id, None).await { + let sandbox = match docker.inspect_container(workload_container_id, None).await { Ok(sandbox) => sandbox, Err(error) => { return Err(recorded_workspace_validation_failure(failures, sandbox_id) diff --git a/crates/openshell-driver-docker/src/tests.rs b/crates/openshell-driver-docker/src/tests.rs index 836abfc35..ebc87f88a 100644 --- a/crates/openshell-driver-docker/src/tests.rs +++ b/crates/openshell-driver-docker/src/tests.rs @@ -3733,10 +3733,15 @@ async fn workspace_failure_survives_supervisor_cleanup_before_readiness_inspecti // There is no Docker daemon at this address: a monitor that has removed // the supervisor must not need another inspection to retain the reason. let docker = Docker::connect_with_http("127.0.0.1:1", 1, bollard::API_DEFAULT_VERSION).unwrap(); - let status = - wait_for_docker_supervisor_ready(&docker, "removed-supervisor", "sandbox-1", &failures) - .await - .expect_err("the recorded workspace failure takes precedence over inspection"); + let status = wait_for_docker_supervisor_ready( + &docker, + "removed-supervisor", + "workload-container-1", + "sandbox-1", + &failures, + ) + .await + .expect_err("the recorded workspace failure takes precedence over inspection"); assert_eq!( supervisor_start_failure_reason(&status, "ControlSupervisorStartFailed"), CONDITION_WORKSPACE_VALIDATION_FAILED