fix(sandbox): unpause a paused container during docker-driver recovery by latenighthackathon · Pull Request #7641 · NVIDIA/NemoClaw

latenighthackathon · 2026-07-27T14:38:37Z

Summary

Docker-driver recovery previously reported a paused labeled sandbox as recovered without resuming its container. Recovery now runs docker unpause before reporting success and reports a failed unpause instead of a false recovery.

Related Issue

Closes #7640

Changes

Detect Up ... (Paused) in the existing running-original recovery branch.
Use the existing Docker adapter to unpause the labeled original container and report unpaused-original.
Return recovered: false with the Docker exit status when unpause fails.
Cover successful and failed unpause behavior without changing the existing running and stopped paths.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: Existing sandbox recovery documentation already describes paused containers and docker unpause; this fix adds no command, flag, configuration, or documentation contract.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop security specialist review at PR SHA c072a3978 passed all nine repository security categories with no findings. This is agent review, not human review.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Product scope: Approved independently at PR SHA c072a3978 and base SHA 0b722a4. This fixes the existing supported Docker-driver recovery contract described in #7640 and creates no integration, recipe, image, third-party stack, or other product surface.

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: no-docs-needed
Evidence: src/lib/onboard/docker-driver-sandbox-recovery.ts and its test are the only changed files. Existing docs already describe paused containers and docker unpause. Changed comments and test titles comply with WRITING.md.
Agent: Codex Desktop documentation writer subagent

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit:
Station profile/scenario:
Result:
Supporting evidence:

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project cli src/lib/onboard/docker-driver-sandbox-recovery.test.ts src/lib/actions/sandbox/start.test.ts src/lib/actions/sandbox/gateway-state-drift.test.ts src/lib/actions/sandbox/rebuild-gateway-drift.test.ts passed 4 files and 46 tests at PR SHA c072a3978.
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Exact local review state: PR SHA c072a39788586e71070376e2c22915332bccb9a3; base SHA 0b722a4822bb450e6676786bb81fc2a5c2fc5668. Diff-aware pre-commit, commit-message, and pre-push stages passed against this exact pair.

Signed-off-by: latenighthackathon latenighthackathon@users.noreply.github.com

A docker-paused labeled sandbox reports Status "Up N (Paused)", which starts with "Up", so findLabeledSandboxContainers classified it running and recoverDockerDriverSandbox returned recovered via started-running-original without ever unpausing it. Callers such as the gateway-state recovery path (which, unlike the start action, has no paused pre-check) then reported the sandbox recovered while the next command still hit a frozen container. Detect the paused status in the running-original branch and docker unpause it, mirroring the isPausedStatus/dockerUnpause pre-check already used by src/lib/actions/sandbox/start.ts, so both callers handle paused containers consistently. A failed unpause returns recovered=false with a detail rather than a false success. Signed-off-by: latenighthackathon <latenighthackathon@users.noreply.github.com>

github-code-quality · 2026-07-27T14:39:29Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit c072a39 in the fix/recover-unpause-... branch remains at 96%, unchanged from commit 0b722a4 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit c072a39 in the fix/recover-unpause-... branch remains at 81%, unchanged from commit 0b722a4 in the main branch.

Show a code coverage summary of the most impacted files.

File	`main` 0b722a4	`fix/recover-unpause-...` c072a39	+/-
`src/lib/onboard...der-metadata.ts`	100%	100%	0%
`src/lib/sandbox...rce-identity.ts`	88%	88%	0%
`src/lib/onboard...box-recovery.ts`	86%	89%	+3%

_{Updated July 27, 2026 22:49 UTC}

coderabbitai · 2026-07-27T14:40:22Z

📝 Walkthrough

Walkthrough

Changes

Paused sandbox recovery

Layer / File(s)	Summary
Recovery contract and paused-container detection `src/lib/onboard/docker-driver-sandbox-recovery.ts`	Adds the `unpaused-original` recovery mode, optional `dockerUnpause` dependency, lazy adapter fallback, and paused-status classification.
Paused original unpause flow `src/lib/onboard/docker-driver-sandbox-recovery.ts`, `src/lib/onboard/docker-driver-sandbox-recovery.test.ts`	Unpauses paused original containers, reports unpause failures, preserves non-paused behavior, and tests both outcomes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested labels: area: sandbox, area: onboarding, bug-fix, platform: container

Suggested reviewers: cv, brandonpelfrey

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address the paused-container recovery bug and failure reporting described in `#7640`.
Out of Scope Changes check	✅ Passed	The diff stays focused on Docker-driver recovery logic and its tests, with no clear unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: recovering paused Docker containers by unpausing them.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/recover-unpause-paused-sandbox

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-27T14:43:02Z

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 1 suggestion
Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, the same number of warnings, 1 more suggestion.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume, cloud-onboard

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

senthilr-nv

Reviewed Files changed for PR SHA c072a39 against base SHA 0b722a4. The diff is limited to resuming paused Docker-driver sandbox containers and its success/failure tests. I approve this exact head.

## Summary Add the canonical dated changelog entry for NemoClaw v0.0.97 before the release plan captures `origin/main`. The entry groups the user-visible and maintainer-facing changes since v0.0.96 while preserving the Deferred dual-Station status, experimental runtime-identity boundary, and pending physical IGX validation. ## Changes - Add `docs/changelog/2026-07-28.mdx` with the parser-safe MDX SPDX comment and exact `## v0.0.97` heading. - Summarize the 43 merged PRs in the release range, omitting internal-only changes from the public entry and linking each grouped change to its most specific published documentation. - Keep the experimental Okta reference explicitly opt-in and outside normal onboarding, keep the two-Station path Deferred, and state that physical IGX Orin validation remains pending. ### Source summary - [#7440](#7440), [#7443](#7443), and [#7445](#7445) -> `docs/changelog/2026-07-28.mdx`: Document read-only host readiness reports and fail-closed platform qualification. - [#7030](#7030) -> `docs/changelog/2026-07-28.mdx`: Document the Deferred trusted two-Station vLLM evaluation. - [#7265](#7265) -> `docs/changelog/2026-07-28.mdx`: Document the bounded experimental direct-runner Okta runtime-identity reference. - [#7711](#7711) and [#7648](#7648) -> `docs/changelog/2026-07-28.mdx`: Document compatible-endpoint reasoning effort and retired NVIDIA Build model paths. - [#7746](#7746), [#7763](#7763), and [#7681](#7681) -> `docs/changelog/2026-07-28.mdx`: Document safe compatible-provider creation, replacement refusal, and narrow OpenShell bridge URL handling. - [#7641](#7641), [#7690](#7690), [#7631](#7631), and [#7710](#7710) -> `docs/changelog/2026-07-28.mdx`: Document paused-container recovery, recreation journaling, pre-mutation uninstall checks, and source-checkout OpenShell selection. - [#7624](#7624) and [#7762](#7762) -> `docs/changelog/2026-07-28.mdx`: Document Jetson release diagnostics and bounded render-device group propagation. - [#7639](#7639), [#7760](#7760), [#7721](#7721), and [#7761](#7761) -> `docs/changelog/2026-07-28.mdx`: Document Telegram, MCP media-type, Hermes image-mode, and locked-restart fixes. - [#7653](#7653) and [#7680](#7680) -> `docs/changelog/2026-07-28.mdx`: Document Deep Agents policy tasks and the bounded Claude Code OAuth path. - [#7679](#7679) -> `docs/changelog/2026-07-28.mdx`: Document the checksum-bound libssh2 and Python HTMLParser backports. - [#7655](#7655), [#7651](#7651), [#7664](#7664), [#7666](#7666), [#7670](#7670), [#7719](#7719), and [#7741](#7741) -> `docs/changelog/2026-07-28.mdx`: Document exact candidate E2E evidence, Launchable selection, diagnostic consolidation, and trusted WSL validation. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `test/changelog-docs.test.ts` validates the dated changelog contract, MDX header, heading uniqueness, and release-entry structure. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: The committed `docs/changelog/2026-07-28.mdx` blob exactly matches the reviewed file. Completeness, factual accuracy, link shape, parser-safe MDX header, one-sentence-per-line style, `.docs-skip` compliance, and bounded product claims passed. - Agent: Codex Desktop documentation writer subagent   ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable; this PR changes only the dated changelog. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run test/changelog-docs.test.ts` passed 6/6. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — not applicable to this doc-only release entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — completed with 0 errors and 2 pre-existing Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — native changelog entries use the required parser-safe MDX SPDX comment and intentionally have no frontmatter. --- Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>  ## Summary by CodeRabbit * **New Features** * Added improved host readiness reporting and Jetson onboarding guidance. * Added controls for reasoning effort with compatible endpoints and enhanced managed MCP discovery. * Improved Deep Agents task publication and preset support. * **Bug Fixes** * Hardened provider switching, sandbox recovery, uninstall behavior, and Telegram connectivity. * Improved container image integrity checks, media-type handling, and checksum validation. * Enhanced vLLM evaluation behavior and release diagnostics. * **Documentation** * Added the NemoClaw v0.0.97 changelog.

cv added the v0.0.97 label Jul 27, 2026

senthilr-nv self-assigned this Jul 27, 2026

senthilr-nv added bug-fix PR fixes a bug or regression area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery platform: container Affects Docker, containerd, Podman, or images labels Jul 27, 2026

senthilr-nv added 2 commits July 27, 2026 15:24

Merge remote-tracking branch 'upstream/main' into codex/pr7641-refresh

2bbddde

Merge remote-tracking branch 'upstream/main' into codex/pr7641-refresh

c072a39

senthilr-nv approved these changes Jul 27, 2026

View reviewed changes

senthilr-nv merged commit 07553d7 into main Jul 27, 2026
75 of 76 checks passed

senthilr-nv deleted the fix/recover-unpause-paused-sandbox branch July 27, 2026 22:58

cjagwani added v0.0.98 and removed v0.0.97 labels Jul 28, 2026

github-actions Bot added the v0.0.97 label Jul 28, 2026

cjagwani mentioned this pull request Jul 28, 2026

docs: add v0.0.97 changelog #7768

Merged

23 tasks

This was referenced Jul 29, 2026

fix(release): resolve recovery, Hermes, and inference E2E blockers #7778

Merged

fix(status): recover visible post-reboot sandbox #7848

Merged

Navigation Menu

Uh oh!

fix(sandbox): unpause a paused container during docker-driver recovery - #7641

fix(sandbox): unpause a paused container during docker-driver recovery#7641
senthilr-nv merged 3 commits into
mainfrom
fix/recover-unpause-paused-sandbox

latenighthackathon commented Jul 27, 2026 •

edited by senthilr-nv

Loading

Uh oh!

github-code-quality Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

senthilr-nv left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

latenighthackathon commented Jul 27, 2026 • edited by senthilr-nv Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Documentation Writer Review

DGX Station Hardware Evidence

Verification

Uh oh!

github-code-quality Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings reported

Model lanes

E2E guidance

Uh oh!

senthilr-nv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

latenighthackathon commented Jul 27, 2026 •

edited by senthilr-nv

Loading

github-code-quality Bot commented Jul 27, 2026 •

edited

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading