fix(sandbox): retry cold glibc probes

src/lib/agent/base-image-hermes-resolution.test.ts

@@ -99,7 +99,7 @@ describe("Hermes base-image resolver integration", () => {
       (inspectOutputByKey.get(`${format}\0${ref}`) ?? "").trim(),
     );
     dockerMocks.capture.mockImplementation(
-      (args: string[]) => captureByEntrypoint.get(args[3]) ?? "",
+      (args: string[]) => captureByEntrypoint.get(args[args.indexOf("--entrypoint") + 1]) ?? "",
     );
   });
 

src/lib/sandbox-base-image/image-compatibility.test.ts

@@ -21,6 +21,9 @@ import {
 describe("sandbox base-image glibc compatibility", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mocks.dockerCapture.mockImplementation((args: readonly string[]) =>
+      args[0] === "run" ? "ldd (GNU libc) 2.41" : "",
+    );
   });
 
   it.each([
@@ -44,21 +47,61 @@ describe("sandbox base-image glibc compatibility", () => {
   });
 
   it("reads the image glibc version through the Docker adapter", () => {
-    mocks.dockerCapture.mockReturnValue("ldd (GNU libc) 2.41\nCopyright notice");
+    mocks.dockerCapture.mockImplementation((args: readonly string[]) =>
+      args[0] === "run" ? "ldd (GNU libc) 2.41\nCopyright notice" : "",
+    );
 
     expect(getImageGlibcVersion("nemoclaw:test")).toBe("2.41");
     expect(mocks.dockerCapture).toHaveBeenCalledWith(
-      ["run", "--rm", "--entrypoint", "/usr/bin/ldd", "nemoclaw:test", "--version"],
+      [
+        "run",
+        "--rm",
+        "--name",
+        expect.stringMatching(/^nemoclaw-glibc-probe-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/),
+        "--entrypoint",
+        "/usr/bin/ldd",
+        "nemoclaw:test",
+        "--version",
+      ],
       { ignoreError: true, timeout: 20_000 },
     );
   });
 
+  it("retries a probe with missing output and removes its retained container (#8375)", () => {
+    mocks.dockerCapture
+      .mockReturnValueOnce("")
+      .mockReturnValueOnce("")
+      .mockReturnValueOnce("ldd (Debian GLIBC 2.41-12+deb13u3) 2.41");
+
+    expect(getImageGlibcVersion("nemoclaw:cold")).toBe("2.41");
+
+    const probeCalls = mocks.dockerCapture.mock.calls.filter((call) => call[0]?.[0] === "run");
+    expect(probeCalls.map((call) => call[1]?.timeout)).toEqual([20_000, 120_000]);
+    const containerNames = probeCalls.map((call) => call[0]?.[3]);
+    expect(new Set(containerNames)).toHaveProperty("size", 2);
+    const cleanupCalls = mocks.dockerCapture.mock.calls.filter((call) => call[0]?.[0] === "rm");
+    expect(cleanupCalls).toEqual([
+      [["rm", "-f", containerNames[0]], { ignoreError: true, timeout: 20_000 }],
+    ]);
+  });
+
+  it("does not retry non-empty incompatible output", () => {
+    mocks.dockerCapture.mockImplementation((args: readonly string[]) =>
+      args[0] === "run" ? "musl libc (x86_64)\nVersion 1.2.5" : "",
+    );
+
+    expect(getImageGlibcVersion("nemoclaw:musl")).toBeNull();
+    expect(mocks.dockerCapture.mock.calls.filter((call) => call[0]?.[0] === "run")).toHaveLength(1);
+  });
+
   it.each([
     ["ldd (GNU libc) 2.41", "2.39", { ok: true, version: "2.41" }],
     ["ldd (GNU libc) 2.36", "2.39", { ok: false, version: "2.36" }],
     ["musl libc (x86_64)\nVersion 1.2.5", "2.39", { ok: false, version: null }],
   ])("enforces the minimum glibc version %#", (output, minimum, expected) => {
-    mocks.dockerCapture.mockReturnValue(output);
+    mocks.dockerCapture.mockImplementation((args: readonly string[]) =>
+      args[0] === "run" ? output : "",
+    );
 
     expect(imageMeetsMinimumGlibc("nemoclaw:test", minimum)).toEqual(expected);
   });

src/lib/sandbox-base-image/image-compatibility.ts

@@ -1,9 +1,12 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { randomUUID } from "node:crypto";
 import { dockerCapture } from "../adapters/docker";
 import { OPENSHELL_SANDBOX_MIN_GLIBC } from "./types";
 
+const GLIBC_PROBE_TIMEOUTS_MS = [20_000, 120_000] as const;
+
 export function parseGlibcVersion(output: string | null | undefined): string | null {
   const text = String(output || "");
   const firstLine = text.split(/\r?\n/).find((line) => line.trim());
@@ -30,11 +33,34 @@ export function versionGte(left = "0.0.0", right = "0.0.0"): boolean {
 }
 
 export function getImageGlibcVersion(imageRef: string): string | null {
-  const output = dockerCapture(
-    ["run", "--rm", "--entrypoint", "/usr/bin/ldd", imageRef, "--version"],
-    { ignoreError: true, timeout: 20_000 },
-  );
-  return parseGlibcVersion(output);
+  for (const timeout of GLIBC_PROBE_TIMEOUTS_MS) {
+    const containerName = `nemoclaw-glibc-probe-${randomUUID()}`;
+    let output = "";
+    try {
+      output = dockerCapture(
+        [
+          "run",
+          "--rm",
+          "--name",
+          containerName,
+          "--entrypoint",
+          "/usr/bin/ldd",
+          imageRef,
+          "--version",
+        ],
+        { ignoreError: true, timeout },
+      );
+    } finally {
+      if (!output) {
+        dockerCapture(["rm", "-f", containerName], {
+          ignoreError: true,
+          timeout: 20_000,
+        });
+      }
+    }
+    if (output) return parseGlibcVersion(output);
+  }
+  return null;
 }
 
 export function imageMeetsMinimumGlibc(

test/helpers/onboard-script-mocks.cjs

@@ -153,7 +153,11 @@ function mockOnboardRunCapture(command, options = {}) {
   if (isOpenClawSecurityInventoryProbe(command)) {
     return "nemoclaw-security-inventory-ok";
   }
-  if (/^docker run --rm --entrypoint \/usr\/bin\/ldd \S+ --version$/.test(normalized)) {
+  if (
+    normalized.startsWith("docker run ") &&
+    normalized.includes(" --entrypoint /usr/bin/ldd ") &&
+    normalized.endsWith(" --version")
+  ) {
     return "ldd (GNU libc) 2.41";
   }
   return mockSandboxExecCurl(command, options);