Function run

harness/docker_ops.py:24–83

Start a container, detached, interactive. Cleans up any existing container with the same name first (clean slate). ``runtime`` selects an OCI runtime (e.g. ``runsc`` for gVisor). The active runtime is verified via ``docker inspect`` so a typo or missing registration fails loudly ins

(
    image_tag: str,
    name: str,
    network: str = "none",
    memory: str = "4g",
    shm_size: str | None = None,
    shell: str = "/bin/bash",
    runtime: str | None = None,
    env: dict[str, str] | None = None,
    mounts: list[tuple[str, str]] | None = None,
)

def run(
    image_tag: str,
    name: str,
    network: str = "none",
    memory: str = "4g",
    shm_size: str | None = None,
    shell: str = "/bin/bash",
    runtime: str | None = None,
    env: dict[str, str] | None = None,
    mounts: list[tuple[str, str]] | None = None,
) -> str:
    """Start a container, detached, interactive. Cleans up any existing
    container with the same name first (clean slate).

    ``runtime`` selects an OCI runtime (e.g. ``runsc`` for gVisor). The
    active runtime is verified via ``docker inspect`` so a typo or missing
    registration fails loudly instead of silently falling back to runc."""
    subprocess.run(["docker", "rm", "-f", name], capture_output=True)
    runtime = runtime or os.environ.get("VULN_PIPELINE_DOCKER_RUNTIME")
    extra: list[str] = []
    if runtime:
        extra += ["--runtime", runtime]
    if shm_size:
        extra += ["--shm-size", shm_size]
    for k, v in (env or {}).items():
        extra += ["-e", f"{k}={v}"]
    for src, dst in (mounts or []):
        extra += ["-v", f"{src}:{dst}:ro"]
    r = subprocess.run(
        [
            "docker", "run", "-dit",
            *extra,
            "--name", name,
            "--network", network,
            "--memory", memory,
            image_tag, shell,
        ],
        check=False,
        capture_output=True,
        text=True,
    )
    if r.returncode != 0:
        raise RuntimeError(
            f"docker run failed (exit {r.returncode}): {r.stderr.strip()}"
        )
    actual_image, actual_runtime = subprocess.run(
        ["docker", "inspect", name, "--format",
         "{{.Config.Image}}\t{{.HostConfig.Runtime}}"],
        capture_output=True, text=True, check=True,
    ).stdout.rstrip("\n").split("\t")
    if actual_image != image_tag:
        raise RuntimeError(
            f"container {name} has wrong image: requested {image_tag!r}, got {actual_image!r}"
        )
    if runtime and actual_runtime != runtime:
        raise RuntimeError(
            f"container {name} runtime mismatch: requested {runtime!r}, "
            f"docker reports {actual_runtime!r}"