fix(uninstall): scope Docker cleanup fields

[danielpolimac]

Summary

Uninstall Docker cleanup now scopes broad cleanup to parsed Docker inventory fields instead of matching the whole output line. This keeps cleanup for NemoClaw/OpenShell-owned container names and image repositories, while avoiding third-party containers or images whose registry path or tag merely contains nemoclaw.

Related Issue

Fixes #8496

Changes

• Parse docker ps inventory into ID, image, and container-name fields before selecting broad uninstall cleanup targets.
• Parse docker images inventory into ID and image-reference fields, then match only the repository portion instead of tags or registry path substrings.
• Preserve existing owned cleanup for openshell-* and nemoclaw-* container names, nemoclaw-* local repositories, openshell/* sandbox images, and ghcr.io/nvidia/nemoclaw managed images.
• Add regression coverage for third-party registry paths and image tags that contain nemoclaw but are not NemoClaw-owned cleanup targets.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: Existing uninstall docs already describe scoped NemoClaw/OpenShell Docker cleanup and preserving separate OpenClaw resources; this narrows implementation to that documented behavior.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex reviewed the uninstall cleanup trust boundary; the change narrows Docker deletion predicates to parsed container names and image repositories, adds negative tests for third-party registry/tag over-matches, and does not add new deletion authority.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: src/lib/actions/uninstall/run-plan.ts, src/lib/actions/uninstall/run-plan-docker-scope.test.ts; existing uninstall docs already describe scoped NemoClaw/OpenShell Docker cleanup and preservation of separate OpenClaw resources.
• Agent: Codex CLI

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project cli src/lib/actions/uninstall/run-plan-docker-scope.test.ts src/lib/actions/uninstall/run-plan.test.ts passed 46 tests; npx tsc -p tsconfig.cli.json --noEmit passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: danielpolimac danielpolimac@gmail.com

Summary by CodeRabbit

• Bug Fixes
  • Improved Docker cleanup to target only resources managed by the application.
  • Preserved unrelated containers and images, including registry-backed and similarly named resources.
  • Added support for accurately identifying managed images across supported tags and digests.
• Tests
  • Expanded uninstall coverage for container and image ownership matching.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2062796c-bd16-4e66-ab6b-f5415fd4e77c

📥 Commits

Reviewing files that changed from the base of the PR and between 7aba3cc and 533d6b6.

📒 Files selected for processing (2)

• src/lib/actions/uninstall/run-plan-docker-scope.test.ts
• src/lib/actions/uninstall/run-plan.ts

---

📝 Walkthrough

Walkthrough

Docker uninstall cleanup now parses container and image fields, applies normalized NemoClaw/OpenShell ownership checks, and preserves unrelated registry or tag-matching resources. Tests cover exclusion of unrelated resources and removal of a managed OpenClaw sandbox image.

Changes

Docker cleanup scope

Layer / File(s)	Summary
Docker inventory and ownership matching src/lib/actions/uninstall/run-plan.ts	Docker cleanup extracts bounded image and name fields, removes tags and digests, and matches supported NemoClaw/OpenShell ownership patterns.
Docker scope test coverage src/lib/actions/uninstall/run-plan-docker-scope.test.ts	Tests verify that unrelated registry and tag-matching resources remain, while the managed sandbox image is removed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 533d6

The change narrows uninstall cleanup to owned Docker container names and image repositories while adding regression coverage for third-party matches; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: dongni-yang, laitingsheng, sandl99

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary change: scoping Docker cleanup to parsed fields.
Linked Issues check	✅ Passed	The changes address issue #8496 by narrowing container and image matching to owned names and repositories, with regression tests for unrelated resources.
Out of Scope Changes check	✅ Passed	The implementation and tests directly support the Docker cleanup scoping objective, with no unrelated changes identified.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions match; normalized E2E selections match; severity counts match.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.