߲jk RUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlmZddlmZddlmZmZmZddlmZddlmZmZmZmZmZmZmZm Z m!Z!ddl"m#Z#dd l$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*ejVe,Z-gd Z.da/ee0e1d <eZ2d e3e0dzd e3e0fdZ4de5dzd e5e0e0ffdZ6e'Z7ejpdZ9de0d e0fdZ:e#Z;d e0fdZde0dzde0dzd e>fdZ?de0de0fdZ@de0d eAfd ZBd!de jeDfd"d#e3e0d$eEd%e0d&eFd'e0dzd(eFf d)ZGd ee0fd*ZHd+e0d e0fd,ZId+e0d e0fd-ZJgd.ZKd/ZLd0ZMd1e3d eAfd2ZNd3ZOd1e3d ee0fd4ZPd5ZQd6ZRgd7ZSeTZUeTe je1d8<e jZXd9ZYd:d;gZZdUd=eAd>eAd?eAd e3e0fd@Z[de0dAe0d eAfdBZ\d ee0fdCZ]da^eeAe1dD<da_eeAe1dE<dAe0d eAfdFZ`d/home/ubuntu/.hermes/hermes-agent/tools/environments/docker.py_normalize_forward_env_namesr)/sJ!r #$$ NNMt T jjl %%c* NNJD Q  "   c " # envcZ|siSt|ts+tjdt |j iSi}|j D]\}}t|tr#tj|jstjd|Pt|ttttfs9tjd|jt |j t|tr|n t|||j<|S)zTValidate a docker_env dict to {str: str}; scalars are coerced, other values dropped.zdocker_env is not a dict: %sz#Ignoring invalid docker_env key: %rz/Ignoring non-string docker_env value for %r: %s)rdictrr type__name__itemsrr"r#r!intfloatbool)r+r%r'values r(_normalize_env_dictr5@s  c4 5tCy7I7IJ !#JiikR U#s#+;+A+A#))++N NN@# F %#sE4!89 NNLciik[_`e[f[o[o p +5eS+A%s5z 399;R r*z[^A-Za-z0-9_.-]r4cbt|tr|sytjd|ddxsdS)zXLossy coercion into a Docker label-safe form; empty/invalid input becomes ``"unknown"``.unknown_N?)rr_LABEL_VALUE_OK_REsub)r4s r(_sanitize_label_valuer<\s0 eS !  ! !#u -cr 2 ?i?r*cD ddlm}|xsdS#t$rYywxYw)zActive Hermes profile name, or ``"default"`` on any error. Resolved at container-create time so a container stays tagged with its creator even if the process switches profiles.rget_active_profile_namedefault)hermes_cli.profilesr? Exceptionr>s r(_get_active_profile_namerChs*?&(5I5 s   shared_keyc|sttStj|j dj dd}t|ddd|S)a]Profile label used for container reuse and orphan reaping. Profiles are isolated by default; an explicit shared key lets trusted profiles share one Docker identity. Label sanitization is lossy and reuse is label-keyed, so a digest of the raw key disambiguates colliding keys. Plain profile names keep their historical un-suffixed labels.zutf-8N 2-)r<rChashlibsha256encode hexdigest)rDdigests r(_container_identityrNrs] $%=%?@@ ^^J--g6 7 A A CCR HF#J/4 5Qvh ??r*iX)max_age_secondsprofile_filter docker_exerOrPrQc |xstxsd}gd}|r|jddt|gt|ddg|ddd d d }|ytjj tj j}d}d|jjDD]}t||} | || z j} | |kr+t|d|gdd|d df} | D| jdk(r)|dz }tjd|d dt| |tj!d|d d| j"j%|S)aRemove stale hermes-tagged containers left behind by prior processes (SIGKILL/OOM exits that bypass atexit). Only ``status=exited`` containers (running ones may belong to a sibling process), only the caller's profile, and only if ``FinishedAt`` is older than *max_age_seconds* (a just-exited sibling may be about to reuse its container). Best-effort and idempotent: failures log at debug and the count removed so far is returned. docker)--filterlabel=hermes-agent=1rTz status=exitedrTlabel=hermes-profile=ps-a--formatz{{.ID}}z"orphan reaper docker ps failed: %sz'orphan reaper docker ps returned %d: %stimeoutfailnonzeroNrc3^K|]%}|js|j'ywNr!.0lns r( z)reap_orphan_containers..sOrBHHJ Os--rmz%orphan reaper docker rm %s failed: %srFr\r] fail_argsz2Reaped orphan container %s (exited %d seconds ago)zdocker rm %s failed: %s) find_dockerextendr< _docker_querydatetimenowtimezoneutcstdout splitlines_container_finished_at total_seconds returncoderinfor1debugstderrr!) rOrPrQrSfilterslistingroremovedcid finished_atageresults r(reap_orphan_containersr}s 4;= 4HFOG &;%>%@OU,VS9   [ //1   T3 2Yfijmkmfnepr >     ! qLG KKLcRUSUhX[\_X` a LL2CHfmm>Q>Q>S T%U& Nr* container_idct|ddd|gdd|ddf}||jd k7ry|jj}|r|j d ryt j d d |jd d} tjj|S#t$r%}tjd||dd|Yd}~yd}~wwxYw)z``docker inspect`` FinishedAt as an aware datetime; ``None`` (= don't reap) when missing/unparseable or Docker's never-finished zero value ``0001-01-01T00:00:00Z``.inspectrYz{{.State.FinishedAt}} z*orphan reaper docker inspect %s failed: %sNrFrhrz 0001-01-01z (\.\d{6})\d+z\1Zz+00:00z(could not parse FinishedAt %r for %s: %s) rmrvrrr! startswithrer;replacern fromisoformat ValueErrorrrx)rQrrrawes r(rtrts Y ,C\R\^ 9lSVTVFWEY[F~**a/ --   C #... &&% - 5 5c8 DC  ..s33  ?lSVTVFWYZ[sB C)C  Cpathctjj|xr$tj|tjSr`)osrisfileaccessX_OK)rs r(_is_executablers) 77>>$  .sMa>!;LMsz%Found docker at non-PATH location: %s) rrgetenvrrrwshutilwhichnext_DOCKER_SEARCH_PATHS)overridefounds r(rkrks%!!yy/0HN8, =xH,,x( ( ( ,,x( ( ( ;UCM#7MtT T T ;UC " Lr* executablechdtjj|jvrdSdS)zUser-facing runtime name (``"Podman"`` / ``"Docker"``) for the CLI at *executable*, so diagnostics and pickers name the runtime actually in use.rPodmanDocker)rrbasenamelowerrs r(docker_runtime_namers. 277#3#3J#?#E#E#GG8UXUr*c"t|dk7ryy)zHow to bring the runtime at *executable* back up, for a "not reachable" message. Docker has a daemon to start; Podman is daemonless (outside Linux it runs inside a VM).rzstart Docker and retryz$run `podman machine start` and retry)rrs r(docker_runtime_start_hintrs:&(2' 1r*) z --cap-dropALL --cap-add DAC_OVERRIDErCHOWNrFOWNER--tmpfsz/tmp:rw,nosuid,size=512mrz#/var/tmp:rw,noexec,nosuid,size=256m2561g extra_argsc.td|xsgDS)zUTrue when docker_extra_args already set ``--shm-size`` (then our default is skipped).c3pK|].}t|txr|dk(xs|jd0yw) --shm-sizez --shm-size=N)rrr)rcas r(rez+_extra_args_set_shm_size..s:%  1cQ\ 1 PQ\\-5PQ%s46)any)rs r(_extra_args_set_shm_sizers! %"% %%r*)z --networkz--netc4|xsgDcgc]}t|ts|}}t|D]a\}}tD]S}||k(r|dzt |kr||dzndccS|j |ds<|j dddccScycc}w)a_Network mode requested by ``docker_extra_args`` (``--network none`` / ``--network=none`` / ``--net``), or None when the operator set no network flag. Docker rejects a repeated ``--network`` outright (exit 125), so the implicit ``docker_network: false`` flag and an operator-supplied one must be reconciled before the command line is built.rj=N)rr enumerate_NETWORK_FLAGSlenrsplit)rrargsiargflags r(_extra_args_network_moders #(b @!Z3-?A @D @D/,3" ,Dd{&'!ec$i&7tAE{R?~~aj)yya(++  ,,  As BB)rz/run:rw,noexec,nosuid,size=64m)rz/run:rw,exec,nosuid,size=64m)rSETUIDrSETGID_TEARDOWN_THREADS)z/initz&/package/admin/s6-overlay/command/initz--security-optzno-new-privilegesFrun_as_host_userrun_exec snap_compatctt|rgnttz}|t|rtntz }|r|S|tt zS)aSecurity/cap/tmpfs args for the privilege mode; ``run_exec`` mounts /run exec for s6 images. ``snap_compat`` drops no-new-privileges: snap-packaged Docker's AppArmor profile turns it into "exec: operation not permitted" for every process in the container (#9730, LP#1908448).)list_BASE_SECURITY_ARGS_NO_NEW_PRIVILEGES_ARGS_RUN_TMPFS_EXEC_RUN_TMPFS_NOEXEC_PRIVDROP_CAP_ARGS)rrrrs r(_build_security_argsrCsJ # $ktD[?\ ]DDH2C DDD#4H5G0H)HHr*imagec t|dd|ddgdd|fdtjtf}||jxsd j nd }|r|d k(ry t j|}t|tr|g}t|tr|sy t|d j tvS#ttf$rYy wxYw) zTrue if ``image``'s entrypoint is the s6-overlay ``/init`` (own PID 1: incompatible with ``--init`` and a noexec /run). Any inspection failure, including an image not yet pulled, returns False and keeps the hardened defaults.rrrYz{{json .Config.Entrypoint}}rZz/Docker: could not inspect entrypoint for %s: %sz4Docker: image inspect for %s returned %d (stderr=%s))r\r]rir^rrnullFr)rm subprocessSubprocessErrorOSErrorrrr!jsonloadsr TypeErrorrrr_S6_INIT_ENTRYPOINTS)rQrrr entrypoints r(_image_uses_init_entrypointrLs Wi 5(F--w7 9F ,2+=6== B % % '2C #-ZZ_ *c" \ j$ 'z z!}  # # %)= ==  "sB55CCcttdd}ttdd}||y |d|S#t$rYywxYw)z``:`` of the host user, or ``None`` without POSIX ids. Uses os.getuid/getgid directly (not pwd/getpass) so nameless UIDs inside sandboxed launchers never raise.getuidNgetgid:)getattrrrB)get_uidget_gids r(_resolve_host_user_specrcsXb(D)Gb(D)G'/)Agi[)) s: AA_storage_opt_ok_cgroup_limits_okcttSt}|r|sy t|ddddddd d |d d g d }|j dk(rday|jxsdj}d|jvr%tj d|j |ddydatj d|ddy#t$r }tj d|Yd}~yd}~wwxYw)a Probe once per process whether ``--cpus``/``--memory``/``--pids-limit`` work here, via a throwaway ``sleep 0`` container from *image* (no extra pull). Without delegated cgroup controllers (unprivileged LXCs, rootless) these flags fail every start with exit 126; the result is host-wide, so it is cached. Only DEFINITIVE answers are cached: a probe that could not run (auto-pull past the timeout, daemon cold-start, manifest/pull error) says nothing about cgroup support, so it degrades this spawn and is retried on the next.NFrunz--rm--cpusz0.5--memory64m --pids-limit32sleep0<rzbCgroup limit probe failed; containers run without CPU/memory/PID limits until a probe succeeds: %srTrcgroupzCgroup limit probe could not determine support (docker exited %d: %s). Containers run without CPU/memory/PID limits until a probe succeeds.izCgroup resource limits (--cpus/--memory/--pids-limit) not available in this environment. Containers will run without CPU, memory or PID limits. To enable, delegate the cpu, memory and pids cgroup controllers to this container. Probe stderr: %s) rrkrrBrr rvryr!r)rrQrrrys r(_cgroup_limits_availablerts $  J U %UN\` GS "A mm!r ( ( *Fv||~% S   vds| - NN Q t  - JKL NsB99 C"CC"exc_infolog_msgerrorhintrcNtj|g|d|it||S)Nr) retry_hint)rrr)rrrrlog_argss r(_docker_unavailablers% LL787h7 %e ==r*ct}|stddd t|dgd}|jdk7r3td||j|jjddy#t$rtd|d d d tj $rtd |d dd t $rtjdd wxYw)zXFail fast with an ``EnvironmentConnectionError`` when the docker CLI/daemon is unusable.zDocker backend selected but no docker executable was found in PATH or known install locations. Install Docker Desktop and ensure the CLI is available.z|Docker executable not found in PATH or known install locations. Install Docker and ensure the 'docker' command is available.zZInstall Docker (or fix PATH) and retry, or run `hermes setup terminal` to switch to Local.)rrversionrzVDocker backend selected but the resolved docker executable '%s' could not be executed.TzHDocker executable could not be executed. Check your Docker installation.z)Repair the Docker installation and retry.)rrrzYDocker backend selected but '%s version' timed out. The Docker daemon may not be running.zHDocker daemon is not responding. Ensure Docker is running and try again.uStart Docker (e.g. `systemctl start docker` or launch Docker Desktop), then retry — or run `hermes setup terminal` to switch to Local.z4Unexpected error while checking Docker availability.rrzIDocker backend selected but '%s version' failed (exit code %d, stderr=%s)zXDocker command is available but 'docker version' failed. Check your Docker installation.uuStart Docker, or add your user to the docker group, then retry — or run `hermes setup terminal` to switch to Local.N) rkrrFileNotFoundErrorrTimeoutExpiredrBrrrvryr!)rQrs r(_ensure_docker_availabler sJ ! bQm o o j)4a@"A! W ))6==+>+>+@lF G G! >! d \< > >  $ $G! g \F G G  KVZ [ s A..AC cVt|Dcgc] }d|fD]}|c}}Scc}}w)z``-e KEY`` flags (no values): the docker CLI resolves values from its own env, so secrets live in owner-readable /proc/*/environ instead of world-readable cmdline.z-e)sorted)namesr'rs r(_name_only_env_argsr s,"%= @CT3K @SC @C @@ @s%))get_credential_file_mountsT credential)get_skills_directory_mountFz skills dir)get_cache_directory_mountsFz cache dirc &g} ddlm}tD]\}}}t||D]}t |d}|r'|j rdn|j rdnd}n|j rdnd}|r*tjd|jd||z|jd|dd |d d gtjd ||d|d  |S#t$r!}tjd |Yd}~|Sd}~wwxYw)a=``-v host:container:ro`` args for credential files, skill dirs and cache dirs. Read-only so the container can authenticate/read but never modify host state. Missing or wrong-kind sources are skipped with a warning (Docker-in-Docker auto-creates a missing file source as a directory, which would exit 125).rN host_pathz=source is a directory (likely Docker-in-Docker auto-creation)zsource not foundzsource is not a directoryu$Docker: skipping %s mount — %s: %s-vrcontainer_pathz:rozDocker: mounting %s %s -> %sz1Docker: could not load credential file mounts: %s)tools.credential_filescredential_files_RO_MOUNT_SOURCESrris_diris_filerr rrlrwrBrx) rcfgetter expects_filenounentrysrcproblemrs r(_readonly_skill_mount_argsr"s0 DM+*; o &FL$,V,. o5-.beblblbn^,/KKMD?Q'*jjld8SGNN#I4::f d6Z d7Z!d8ede fd9Z"de fd:Z#dId;ededeffd< Z$e%de fd=Z&d&edeefd>Z'd?ed@edAedeeeeffdBZ(dJdCZ)d dDdEe fdFZ*e%dKde de fdGZ+dLde de fdHZ,xZ-S)MDockerEnvironmentuHardened Docker container execution (caps dropped, no-new-privileges, PID limits, size-limited tmpfs). The container is the security boundary — its filesystem stays writable so agents can install packages. Persistence bind-mounts /workspace and /root.Tr.c,t|jS)z@Keep explicit docker_forward_env values out of shared snapshots.)tuple _forward_envselfs r(,_additional_profile_scoped_passthrough_namesz>DockerEnvironment._additional_profile_scoped_passthrough_names sT&&''r*/rootrrFr@Nrrcwdr\cpumemorydiskpersistent_filesystemtask_idvolumesrr+networkhost_cwdauto_mount_cwdrrpersist_across_processesshm_sizeshared_container_keyrc |dk(rd}t$|||||_||_d|_||_t | |_t| |_ d|_ d|_ i|_ d|_ d|_tj!d| | (t#| t$stj'd| g} t)|j+||||| ||}|j-| | ||\}}|j/t1|j3|\}}}}}|j/|t5|}t7xsd|_t;|j8|}|rtj!d |t=|xr t?||| }||_ |rtj'd tj!d |||z|z|z|z|z|z|z} tj!d | tC|}!tE|}"ddd|"d|!tF|i|_$||_%||_&| |_'|xr|jQ|"|!|| }#|#s|jS||_ |jU|_+|jYy)N~r.)r/r\FrzDockerEnvironment volumes: %sz'docker_volumes config is not a list: %rrSugDocker: image %s uses /init (s6-overlay) as entrypoint — skipping --init and mounting /run with exec.)rrz]docker_snap_compat: running without --init and no-new-privileges (snap Docker under AppArmor)zDocker volume_args: %szDocker run_args: %sz hermes-agent1hermes-task-idhermes-profile)-super__init__ _persistent_persist_across_processes_session_scoped_task_idr)r*r5_env_init_unset_passthrough_names _container_id_init_env_values_workspace_dir _home_dirrrwrrr r _resource_args _mount_argsrlr"_egress_and_env_argsr%rk _docker_exerrr3 _snap_compatrNr<r _labels_image_image_uses_s6_init _all_run_args_attach_existing_container _docker_run_build_init_env_args_init_env_args init_session)%r,rr/r\r0r1r2r3r4r5rr+r6r7r8rrr9r:r;r resource_args volume_args writable_args egress_labelegress_volume_argsegress_host_argsenv_argsvalidated_extra user_argsimage_uses_s6_init security_args all_run_args profile_name task_labelreused __class__s% r(rBzDockerEnvironment.__init__ s, #:C S'20)A& % 8E', >@*,002-1(, 3W=  z'4'@ NNDg NG "++E3gxYcd %)%5%5gxY`%a" ]578  % %j 1 V (*:Ho-.#$45 '=4H99I9I5Q  KK? -  0i;M[fh '  NNo q  ,k: I % 5 E !, -/7 8:I J   )<8++?@ *73 C j l | -  #5 ))=d.M.M  lG/=!%!1!1#!6D #779 r*ct\}}}t|||}|r tnd}t|}|r.t |j ||t |j||t|j||}t||_ g} |xsgD]:} t| tstjd| *| j| <|r t!| |||||t#|| fS)a)Egress credential-injection proxy plumbing (CA mount + HTTPS_PROXY/CA-bundle env so outbound traffic routes through the host-side proxy and the sandbox receives proxy tokens instead of real API keys), merged with docker_env into name-only ``-e`` args, plus the validated docker_extra_args. Returns ``(egress_label, volume_args, host_args, env_args, validated_extra)``; sets ``self._run_env_values`` (injected into the docker-client subprocess env at run time and reused verbatim by container-recreation recovery).Tz/Ignoring non-string docker_extra_args entry: %r)r r r r rr*rrGrr-_run_env_valuesrrrr r$rr ) r,rr_egress_env_overridesr`r^enforce_egresscritical_egress_names merged_envrbrs r(rOz&DockerEnvironment._egress_and_env_argsysFcEdB02B01CEY[kl 8L24RV :;O P  ():):(.b!'') 3#:&>z&J KKs+ , !8 0**, _dV1o>?ef4Z@M$ ,- &(#**7):;_`aa  r*cg}|xsgD]j}t|tstjd|*|j }|s=d|vrtjd|X|j d|glt d|D}|r.s*S!=A+=*Ssrz@Skipping docker cwd mount: host_cwd is not a valid directory: %sNr)get_sandbox_dirrShomeT)exist_okz:/root workspacerrz/workspace:rw,exec,size=10g)rz/home:rw,exec,size=1grz/root:rw,exec,size=1gz.Mounting configured host cwd to /workspace: %szDSkipping docker cwd mount: /workspace already mounted by user config)rrrr r!rlrrrabspath expanduserr3isdirrxr7rCtools.environments.baser_sandbox_dir_namerLmakedirsrKrw)r,r5r7r8r4r\volworkspace_explicitly_mounted host_cwd_abs bind_host_cwdmount_workspacer]rsandboxs r(rNzDockerEnvironment._mount_argssE"$ Mr ,Cc3'H#N))+C#~KSQ   c{ + ,(+*S{*S'S$HPrwwrww'9'9('CDVX  1tL1 1bggmmL6Q 100  hrww}}\/J LL[]e f)6 4 ++P4P0P#%    ?&'(25Fw5OOG 6!12DN KK 6 dt~~&6f$=> >M&)'K*?&@# D//$?$4+>+>*?{(K!LL ?i)FG`b bM e eM  KKH, WL>!=L LKM))* LL_ `M))r*c|j|||}|y|\}}|sS|j|}|dk7r=tjd|dd|xsd|| t |j dd|gd y|d k7r/|j|} | tjd |dd|| y||_ tjd|dd|||y#t jtf$r$} tjd |dd| Yd} ~ yd} ~ wwxYw)aAttach to a prior process's labeled container ("ONE long-lived container shared across sessions"; opt out via ``docker_persist_across_processes: false``). Network guard is lockdown-only: a bridge container under ``docker_network: false`` is removed and recreated, but a ``none`` container under default config is kept so ``--network=none`` in extra args doesn't churn containers every startup.NFruuExisting container %s has NetworkMode=%s but docker_network=false requests an air-gapped container — removing it and starting fresh (task=%s, profile=%s).rFr7rf-frgrz,Failed to remove mismatched container %s: %srunningu[Failed to start existing container %s (state=%s): %s — falling back to a fresh container.z:Reusing container %s (task=%s, profile=%s, prior state=%s)T) _find_reusable_container_container_network_moderr rrPrrr_start_containerrIrw) r,rhrgr^r6existingrstate actual_modererrs r(rVz,DockerEnvironment._attach_existing_containersE 00\<X  & e66|DKf$Z!"%{'?i\ [ i!1!14| LVXY I '' 5C@ "%uc3) H " z< @!#117;iNN#QS_`cacSdfghhisC D"DDrc t|jd|gddy#tjtjf$r }|cYd}~Sd}~wwxYw)zM``docker start`` a stopped container; returns the failure instead of raising.startrgT)r\checkN)rrPrCalledProcessErrorr)r,rrs r(rz"DockerEnvironment._start_containersJ  ))7LA2UY Z--z/H/HI H s#A AA A nameworkdirc ,|jjDcgc]\}}d|d|fD]}|}}}}|jddg|js |jrgndgd||d||j |j dd Scc}}}w) z``docker run -d`` argv for a fresh ``sleep infinity`` container (idle reaper handles lifetime). s6-overlay images already provide PID 1, so ``--init`` is skipped for them.z--labelrrz-dz--initz--namez-wrinfinity)rRr0rPrTrQrUrS)r,rrkrr label_argss r( _run_commandzDockerEnvironment._run_commands'+ll&8&8&:^^dayUVTWWXYZX[R\F]^sc^c^ ^   eT ! ,,0A0Abz !  !  ! !  ! !   ! KK !  !  ! !_sBcfdtjjdd}|j||}tj ddj | t|dd|j|j}|j"j%}tj'd||dd|S#tjtjf$rR}tjd ||tj|jd d |gdd tj d}~wwxYw)zStart a fresh container and return its id. A failed ``docker run`` (exit 125, timeout mid-pull) can leave a "Created" orphan the exited-only reaper never catches, so it is removed by name before re-raising.hermes-NzStarting container: %s xTr\rr+z#Rz7I7I K   s(B;;#D0A D++D0valuesct|S)a Env for the docker-client subprocess carrying forwarded values (pairs with name-only ``-e KEY`` flags to keep secrets out of cmdline); ``None`` = inherit when empty. Name-only ``-e KEY`` flags make the docker CLI read each value from its own process environment, keeping secrets out of the client's world-readable ``/proc//cmdline`` (issue #96268). Values live in ``/proc//environ`` instead, which is owner/root-only. Returns ``None`` (inherit as before) when there is nothing to add. )r)r,rs r(rz$DockerEnvironment._docker_client_envCsv&&r*c|j\}}i|j|}|D]}|j|dtt ||_t ||_t|S)u}Name-only ``-e`` args for init_session so ``export -p`` captures docker_env plus the current profile's forwarded values (values travel via the client env). The VALUES intentionally do not appear in the argv — they are passed via the docker client subprocess env (see _docker_client_env and issue #96268); the flags here are name-only ``-e KEY``. N) _resolve_passthrough_envrGpopr)r rHr-rJr )r,passthrough_env unset_namesexec_envrs r(rXz&DockerEnvironment._build_init_env_argsNsp(,'D'D'F$3dii3?3 %D LLt $ %-26+3F-G* $X"8,,r*c8t|jtS)zbSee ``remote_common.resolve_passthrough_env``; explicit docker_forward_env bypasses the blocklist.)hermes_env_loader)rr*_load_hermes_env_varsr+s r(rz*DockerEnvironment._resolve_passthrough_env]s&t'8'8Labbr*cz|j\}}t|tt|t |fS)zRuntime name-only forwarding args, names absent from scope, and the values to inject into the docker client subprocess env. See #96268. )rr r)r r-)r,rrs r(#_build_runtime_env_args_with_unsetsz5DockerEnvironment._build_runtime_env_args_with_unsetsas: (,'D'D'F$"?3U6+;N5OQUVeQfffr*r)loginr\ stdin_data cmd_stringrrc|jsJd|jdg}||jdd}i}|r?|j|jt t |di}t |dd}n1|jr%|j\}}}|j|||jgtt|||z }|j|} | t||| St||S)zSpawn bash inside the container. Init seeds the snapshot; profile-scoped passthrough values are re-injected on every command because one container can be shared by multiple routed profiles in a gateway process.zContainer not startedexecz-irrJrH)r+) rIrPr$rlrYr-r_profile_scoped_passthroughrrrrr) r,rrr\rcmdr env_values runtime_args client_envs r( _run_bashzDockerEnvironment._run_bashjs !!:#::!(  ! JJt  (* %'  JJt** +gd,>CDJ!$(GLK  - -484\4\4^ 1L+z JJ| $ ""^Y}Z/UW\%]^^,,Z8 ?I?U{3 ;w[fgjlv[wwr*)zNo such containerzis not runningzno such containeroutputc@tfd|jDS)Nc3&K|]}|v ywr`r)rcrrs r(rez7DockerEnvironment._is_container_gone..sD11;Ds)r_NO_CONTAINER_PATTERNS)r,rs `r(_is_container_gonez$DockerEnvironment._is_container_gonesD(C(CDDDr*c\tjd|jxsdddd|_|j|jj dd|jj dd|jj t d}|y|\}}|dk(r!||_tjd |ddnN|j|x}!||_tjd |ddntjd |dd||js|jstjd y dtjjdd}t|j||j dd|j#|j$}|j&j)|_tjd||jdd d |_|j5tjd|jxsddd|j9y#t*j,t*j.t0f$r }tjd|Yd}~y d}~wwxYw#t6$r }tjd|Yd}~y d}~wwxYw)zRecreate a container removed out-of-band: label-based reuse first (another process may have recreated it), else a fresh one from the saved image/run-args. False when recovery fails so the caller surfaces the original error.u7Container %s appears to be gone — attempting recoveryrNrFr?r@offrz&Recovery: reusing running container %sz Recovery: restarted container %sz*Recovery: failed to start container %s: %sz8Recovery: no saved image name, cannot recreate containerFrrrTrz)Recovery: created fresh container %s (%s)z,Recovery: failed to create new container: %sz2Recovery: init_session failed in new container: %su(Recovery successful — new container %s)rr rIrrRgetr rwrrSrrrrrrr/rrlrrr!rrrr_snapshot_readyrZrB_mark_recreated)r,rr}rrnew_namerrs r(_recreate_containerz%DockerEnvironment._recreate_containers_ PSWSeSeSkikmpnpRqr!00 LL  -r 2 LL  -r 2 LL  . 68  !JC !%(" Dc#2hO..s33#<%(" >CRIKSQTRTXWZ[!!;; WX $TZZ\%5%5bq%9$:;$%%h93d//0D0DEG&,]]%8%8%:" GSWSeSefigiSjk  #(D      >ASASAYWY[^\^@_` 11:3L3LgV  KQO   LLMq Q s1>B)H7(J7(I?I::I? J+ J&&J+commandc t|||fi|}|jdddk7rN|j|jddr-|jr!|j rt|||fi|}|S)zExecute a command; if the container was removed out-of-band (idle reaper, docker prune, OOM, daemon restart) recreate it and retry once.rvrrr)rAexecuterrrDr)r,rr/kwargsrrjs r(rzDockerEnvironment.executesu#88 JJ|Q '1 ,'' 8R(@A..((*W_Wc.sI"bhhj2Is rjrr) r rmrPrrrsrrr!r) r,rhrr^rzrrfirstrdpartsr}rs r(rz*DockerEnvironment._find_reusable_containers . / |< / ? &!2 31\NC E    tT WG WZ WAV WacNVX >%I 8 8 :I 'BHHT1%E5zQq58>>#3#9#9#;C}e  !go, '%r*cr|j|jfD]}|stj|dy)NT) ignore_errors)rKrLrrmtree)r,ds r(_remove_bind_dirsz#DockerEnvironment._remove_bind_dirss1%%t~~6 5A at4 5r*) force_removerc|js|js|jy|s|jrd|_y|jdddfd }t j |dd}t5tj|ddd|j||_ d|_|js|jyy#1swYExYw)uTear down per persist mode. Persist mode (default) leaves the container RUNNING — stopping it on every exit would kill background processes and add a ``docker start`` delay per session; reclamation is ``reap_orphan_containers()`` at next startup. ``persist_across_processes=False`` or ``force_remove=True`` (explicit-teardown hook, unused so far) does ``docker stop`` + ``docker rm -f`` on a daemon thread that the atexit hook joins via ``wait_for_cleanup`` so the work completes before exit. Cleanup runs on a daemon thread with bounded ``subprocess.run`` calls (not the racy ``Popen(... &)`` pattern from before PR #33645). The atexit hook in ``tools/terminal_tool.py`` waits up to 15s for the thread to finish before the interpreter exits, so ``docker stop`` / ``docker rm`` actually completes when we do trigger it. NrFcgddfddgdffD]2\}} tjg|ddtj4y#tjtf$r!}t j ||Yd}~kd}~wwxYw) N)stopz-t10z%docker stop %s timed out / failed: %srfrzdocker rm -f %s failed: %sTrgr)rrrrrrr )rfail_msgrrrQlog_ids r( _do_cleanupz.DockerEnvironment.cleanup.._do_cleanup4s$8:a#b%)4L2N#O#Q 8h8NN#9d9L9'+Rz?Q?QS 8 #117;8NN8VQ778s,AA>A99A>Tzhermes-cleanup-)targetdaemonrrN) rIrCrrDrP threadingThread_TEARDOWN_LOCKraddr_cleanup_thread)r,rrtrrQrs @@@r(cleanupzDockerEnvironment.cleanups)) ##&&(  > >"&D  %% cr" 8   K_U[T\C] ^  %  ! !! $ %   !  " " $  % %s ?CC"cltj|z} t5tj tDchc]}|j r|c}t t}dddsy|tjz }|dkry|dj|cc}w#1swYDxYw)uiJoin every in-flight teardown worker, including those of envs the idle reaper already popped out of the active registry (their handles are otherwise unreachable at exit, so ``docker rm`` died with the interpreter and left a stopped container behind — #86317). Re-snapshots each pass: the reaper may start a worker while the drain runs.TNrFr)time monotonicrrdifference_updateis_aliverr)r\deadlinerpending remainings r(wait_for_all_teardownsz(DockerEnvironment.wait_for_all_teardownsJs >>#g- 2!33@Q4f1YZYcYcYeQ4fg01 2 4>>#33IA~ AJOOIO .4f 2 2s"B*B% B% B*%B**B3ct|dd}||jsy|j||j S)zBlock up to *timeout* seconds for the cleanup thread (atexit hook). True if it finished or none was started, False on timeout.rNTr)rrr)r,r\threads r(wait_for_cleanupz"DockerEnvironment.wait_for_cleanup\sB0$7 >!2 G $??$$$r*rr)g.@)g>@).r/ __module__ __qualname____doc___sudo_nopasswd_probe_supportedrr)rr-_DEFAULT_SHM_SIZEr1r2r3rr-rrBrOrMrNrVrBrrrWrrXsetrrrPopenrrrrr staticmethodryrrrrr r __classcell__)rjs@r(r'r's^&*""&(eCHo(&+ (,"&$!&)-)$&!+iii i  i  ii $iii#Y%iD[ii3-ii !i"#i$#'%i&'i(")i*+iXt%T#YS SWX[S\^bcf^g8g2ht8"Y]^aYb"H3*tTWyZ^_bZcOcId3*j$Z^$cg$LSY5E!!s!tCy!"ss, 'c3h 'DcNT4D4Dx<ZEEE.T.` s   (D((<OCOHSMO  .1 AD IQRWX[]`X`RaIb B5 /42%t2%h////"%%%r*r'r)FFr)hrrnrIrloggingrrshlexrrrwrrrpathlibrtypingrrrrrtools.environments.base_outputr tools.environments.docker_egressr r r r r rrrrtools.environments.path_utilsr tools.environments.remote_commonrrrrrr getLoggerr/rrrr__annotations__r"rr)r-r5rcompiler:r<rrCrNr1rrtr3rrrr2r)rmrkrrrrvrrrrrrrrrrLockrrrrrrrrrrr r rr"r%r'rr*r(r%s    cc6 Dkk   8 $%)HSM(%d3i$.>49"TD[T#s(^(-  RZZ 23@@@.#@C@@"_c**36:*RUX\R\**Zs#(=== GI`d"117; s)!&.1>CSVY]S]$Xc],VCVCV 2#2#26%%$%(  (3- "@; D,/53y''(0!J,-@AI4I4IVZIgklogpI>C>>>. # #'$&$(8D>(*C*D*ZZ_>>>3>RV> "GJA$s)A8 DI4 d tCy b %b %r*