{"record":{"id":"0912d2cee35516f2","repo":"vxcontrol/pentagi","slug":"container-inspection-failed-w","errorCode":null,"errorMessage":"container inspection failed: %w","messagePattern":"container inspection failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/pkg/docker/client.go","lineNumber":880,"sourceCode":"\t\t\t\tcase database.ContainerStatusStarting, database.ContainerStatusRunning:\n\t\t\t\t\twg.Add(1)\n\t\t\t\t\tgo removeContainer(container.LocalID.String, container.ID)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\twg.Wait()\n\tlogger.Info(\"cleanup finished\")\n\n\treturn nil\n}\n\nfunc (dc *dockerClient) IsContainerRunning(ctx context.Context, containerID string) (bool, error) {\n\tinspectResult, err := dc.client.ContainerInspect(ctx, containerID, client.ContainerInspectOptions{})\n\tif err != nil {\n\t\tif !cerrdefs.IsNotFound(err) {\n\t\t\treturn false, fmt.Errorf(\"container inspection failed: %w\", err)\n\t\t}\n\t\t// a removed container is missing, not an inspection failure\n\t\treturn false, nil\n\t}\n\n\tinspection := inspectResult.Container\n\tif inspection.State == nil {\n\t\t// the daemon always populates State for a successfully inspected\n\t\t// container; treat the unexpected absence as \"not running\" rather\n\t\t// than panicking on the field access below.\n\t\treturn false, nil\n\t}\n\n\t// Check both Running state and health status if available\n\tisOperational := inspection.State.Running\n\tif inspection.State.Health != nil && inspection.State.Health.Status != \"\" {\n\t\tisOperational = isOperational && inspection.State.Health.Status != \"unhealthy\"\n\t}","sourceCodeStart":862,"sourceCodeEnd":898,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/docker/client.go#L862-L898","documentation":"IsContainerRunning inspects the container to read its state; a non-NotFound inspect error is wrapped with this message. NotFound is deliberately treated as 'not running' with no error, so this error always means a real daemon/communication failure.","triggerScenarios":"dc.client.ContainerInspect returns a non-NotFound error: Docker daemon unreachable or restarting, malformed containerID, permission denied on the Docker socket, or an API version mismatch between the SDK and dockerd.","commonSituations":"Docker daemon restart mid-flow; backend container missing access to /var/docker.sock; DOCKER_HOST pointing at a dead TCP endpoint; SDK/daemon API version skew after a Docker upgrade; containerID containing invalid characters (e.g. a name with a newline from tool output).","solutions":["Check daemon reachability with `docker info` / `docker ps` from the backend environment","Validate the containerID is a proper 64-hex ID or valid name (strip whitespace/ANSI from tool output before calling)","Verify Docker socket permissions and DOCKER_HOST configuration","Confirm SDK and daemon API versions are compatible after upgrades"],"exampleFix":"// before\nid := strings.TrimSpace(toolOutput)\nrunning, err := dc.IsContainerRunning(ctx, id)\n// after\nid := strings.TrimSpace(toolOutput)\nif id == \"\" || !validContainerIDRe.MatchString(id) {\n    return false, fmt.Errorf(\"invalid container id %q\", id)\n}\nrunning, err := dc.IsContainerRunning(ctx, id)","handlingStrategy":"validation","validationCode":"var validContainerIDRe = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$`)\nfunc validContainerID(id string) bool {\n    return validContainerIDRe.MatchString(strings.TrimSpace(id))\n}","typeGuard":"func isInspectable(err error) bool { return !cerrdefs.IsNotFound(err) }","tryCatchPattern":"running, err := dc.IsContainerRunning(ctx, id)\nif err != nil {\n    // daemon-level failure, not 'container missing'\n    log.WithError(err).Error(\"cannot determine container state\")\n    return err\n}","preventionTips":["Sanitize container IDs coming from tool/LLM output before API calls","Verify DOCKER_HOST and socket permissions in the backend environment","Treat NotFound as 'not running', everything else as an infrastructure alert","Keep SDK and daemon API versions aligned after upgrades"],"tags":["docker","inspection","go"],"backgroundTag":"docker-inspect-failed","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}