Method run_task_container

src/docker/mod.rs:635–700

Run a task container with unified support for both interactive and non-interactive modes. Follows a setup → execute → cleanup structure: 1. **Setup**: Conditionally create an isolated network and connect the proxy 2. **Execute**: Create, configure, and run the container via [`run_container_inner`] 3. **Cleanup**: Always remove the container, tear down the network, and stop the proxy if idle — reg

(
        &self,
        docker_image_tag: &str,
        task: &crate::task::Task,
        agent: &dyn Agent,
    )

    /// * `Ok((output, task_result))` - The container output and synthesized task result
    /// * `Err(String)` - Error message if container infrastructure fails
    pub async fn run_task_container(
        &self,
        docker_image_tag: &str,
        task: &crate::task::Task,
        agent: &dyn Agent,
    ) -> Result<(String, crate::agent::TaskResult), String> {
        // --- Setup: atomically acquire proxy session ---
        // When nested inside a TSK container, skip proxy/network setup since the
        // outer container already provides network isolation.
        let resolved = resolve_config_from_task(task, &self.ctx, &self.event_sender);
        let proxy_config = resolved.proxy_config();

        let proxy_session = if task.network_isolation && !self.is_nested() {
            let suppress_stdout = self.event_sender.is_some();
            let proxy_logger = TaskLogger::from_path(
                &self
                    .ctx
                    .tsk_env()
                    .task_dir(&task.id)
                    .join("output")
                    .join("agent.log"),
                suppress_stdout,
            );
            match self
                .proxy_manager
                .acquire_proxy(&task.id, &proxy_config, &proxy_logger)
                .await
            {
                Ok(session) => Some(session),
                Err(e) => {
                    return Err(format!(
                        "Failed to ensure proxy is running and healthy: {e}. \
                        The task should be retried later when the proxy is available. \
                        Check the status in Docker."
                    ));
                }
            }
        } else {
            None
        };

        // --- Execute: run the container, capturing its ID for cleanup ---
        let (container_id, dind_storage, result) = self
            .run_container_inner(
                docker_image_tag,
                task,
                agent,
                proxy_session.as_ref().map(|s| s.network_name.as_str()),
                proxy_session.as_ref().map(|_| &proxy_config),
                proxy_session.as_ref().and_then(|s| s.proxy_ip.as_deref()),
            )
            .await;

        // --- Cleanup: always runs regardless of success/failure ---
        if let Some(ref id) = container_id {
            let _ = self.remove_container(id).await;
        }
        if let Some(ref session) = proxy_session {