fix(docker): clean up orphaned container when docker run fails (salvage #7440)

[benbarclay]

Salvages #7440 by @Tranquil-Flow. Closes #7440. Fixes #7439.

Problem

When docker run -d fails after Docker has already created the container object — exit 125 when the daemon isn't ready, or a timeout mid image-pull — the code raised before self._container_id was set, so the container leaked permanently in Created state.

Reported in #7439: "110+ orphaned containers accumulated over 3 days from hourly cron-scheduled gateway sessions hitting a Docker Desktop startup race."

The orphan reaper added in #33645 (reap_orphan_containers) does not cover this case — it filters status=exited, but a failed-create orphan is in Created state, so it slips through and is never reaped.

Fix

Wrap the docker run -d call in try/except and docker rm -f the container by its known name before re-raising.

try:
    result = subprocess.run(run_cmd, ..., check=True)
except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as e:
    logger.warning("docker run failed for %s, cleaning up orphaned container: %s", container_name, e)
    subprocess.run([self._docker_exe, "rm", "-f", container_name], capture_output=True, timeout=10)
    raise

Why this is a reconstruction, not a cherry-pick

@Tranquil-Flow's branch (Apr 2026) predated the cross-process container-reuse + labels rework on main, so a cherry-pick conflicted on the surrounding block. I reconstructed the same intent against current main, including their two regression tests — adapted to mock the new reuse docker ps probe (returns empty → falls through to a fresh docker run) and _get_active_profile_name.

Verification (adversarial)

Reverted only the product change to origin/main's docker.py, kept the new tests, ran them:

FAILED test_failed_docker_run_cleans_up_orphaned_container - assert 0 == 1 ("docker rm should be called once")
FAILED test_docker_run_timeout_cleans_up_orphaned_container - assert 0 == 1

With the fix applied, both pass; full tests/tools/test_docker_environment.py is 65/65 green. Proves the tests genuinely catch the bug rather than being tautologies.

[github-actions]

🔎 Lint report: salvage/7440-orphan-on-run-fail vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9840 on HEAD, 9840 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5102 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.