Ensure container run commands clean up after success #26

New issue

Open

opened 2025-11-19 20:50:52 +00:00 by glenux · 0 comments

glenux commented

2025-11-19 20:50:52 +00:00

Owner

Summary

Ensure DocMachine::Container::Run#run_command cleans up containers even when the command exits successfully.
Align CLI auto-clean defaults with enforced cleanup logic so success-path leaks disappear.

Current behavior

Audit AUDIT-2025-015 shows run_command only calls cleanup_container from exception handlers. When process.wait returns status 0 and the user did not pass an explicit --keep-container, the method exits without touching the container. Containers linger on disk until a manual docker rm or podman rm occurs.

Desired behavior

After process.wait, trigger cleanup_container whenever the configuration indicates auto-clean (default) or when the container still exists.
Ensure success-path cleanup mirrors the failure-path behavior, logging what was removed for operator awareness.
Add specs covering both success and failure flows to verify cleanup happens whenever auto-clean is enabled.

Technical notes

Restructure run_command to share an ensure block or explicit helper that runs after the status check, without swallowing real errors.
Reuse the opt-out flag introduced in task 11aa03 so users can keep containers intentionally while still avoiding accidental leaks.
Touch src/container/run.cr and related specs to keep documentation consistent with the new lifecycle guarantees.

Local task: 11aa05

## Summary - Ensure `DocMachine::Container::Run#run_command` cleans up containers even when the command exits successfully. - Align CLI auto-clean defaults with enforced cleanup logic so success-path leaks disappear. ## Current behavior Audit AUDIT-2025-015 shows `run_command` only calls `cleanup_container` from exception handlers. When `process.wait` returns status 0 and the user did not pass an explicit `--keep-container`, the method exits without touching the container. Containers linger on disk until a manual `docker rm` or `podman rm` occurs. ## Desired behavior - After `process.wait`, trigger `cleanup_container` whenever the configuration indicates auto-clean (default) or when the container still exists. - Ensure success-path cleanup mirrors the failure-path behavior, logging what was removed for operator awareness. - Add specs covering both success and failure flows to verify cleanup happens whenever auto-clean is enabled. ## Technical notes - Restructure `run_command` to share an `ensure` block or explicit helper that runs after the status check, without swallowing real errors. - Reuse the opt-out flag introduced in task 11aa03 so users can keep containers intentionally while still avoiding accidental leaks. - Touch `src/container/run.cr` and related specs to keep documentation consistent with the new lifecycle guarantees. Local task: 11aa05