Fix WSL detection in non-Docker containers

Cargo.toml

@@ -117,7 +117,6 @@ indoc = { version = "2.0.4" }
 insta = { version = "1.35.1" }
 insta-cmd = { version = "0.6.0" }
 is-macro = { version = "0.3.5" }
-is-wsl = { version = "0.4.0" }
 itertools = { version = "0.14.0" }
 jiff = { version = "0.2.0" }
 jod-thread = { version = "1.0.0" }

crates/ruff_linter/Cargo.toml

@@ -42,7 +42,6 @@ globset = { workspace = true }
 hashbrown = { workspace = true }
 imperative = { workspace = true }
 is-macro = { workspace = true }
-is-wsl = { workspace = true }
 itertools = { workspace = true }
 jiff = { workspace = true }
 libcst = { workspace = true }

crates/ruff_linter/src/rules/flake8_executable/helpers.rs

@@ -2,6 +2,7 @@
 
 use std::os::unix::fs::PermissionsExt;
 use std::path::Path;
+use std::sync::OnceLock;
 
 use anyhow::Result;
 
@@ -10,3 +11,50 @@ pub(super) fn is_executable(filepath: &Path) -> Result<bool> {
     let permissions = metadata.permissions();
     Ok(permissions.mode() & 0o111 != 0)
 }
+
+/// Returns `true` if the current process is running under WSL.
+///
+/// Adapted from is-wsl by Sean Larkin, MIT License.
+pub(super) fn is_wsl() -> bool {
+    static CACHED: OnceLock<bool> = OnceLock::new();
+    *CACHED.get_or_init(detect_wsl)
+}
+
+fn detect_wsl() -> bool {
+    if std::env::consts::OS != "linux" {
+        return false;
+    }
+
+    let has_microsoft_kernel = std::fs::read_to_string("/proc/sys/kernel/osrelease")
+        .or_else(|_| std::fs::read_to_string("/proc/version"))
+        .is_ok_and(|s| s.to_ascii_lowercase().contains("microsoft"));
+
+    if !has_microsoft_kernel {
+        return false;
+    }
+
+    // A container on a WSL2 host still has "microsoft" in the kernel version
+    // string, but the filesystem has proper Unix semantics, so we should not
+    // treat it as WSL.
+    !is_container()
+}
+
+/// Detects whether the current process is running inside a container.
+///
+/// Checks for Docker (`/.dockerenv`), Podman (`/run/.containerenv`), and
+/// various container runtimes via their cgroup paths.
+///
+/// Adapted from is-docker by Sean Larkin, MIT License.
+fn is_container() -> bool {
+    if std::fs::metadata("/.dockerenv").is_ok() || std::fs::metadata("/run/.containerenv").is_ok() {
+        return true;
+    }
+
+    std::fs::read_to_string("/proc/self/cgroup").is_ok_and(|cgroup| {
+        let cgroup = cgroup.to_ascii_lowercase();
+        cgroup.contains("docker")
+            || cgroup.contains("/container")
+            || cgroup.contains("/lxc")
+            || cgroup.contains("kubepods")
+    })
+}

crates/ruff_linter/src/rules/flake8_executable/mod.rs

@@ -32,7 +32,7 @@ mod tests {
     #[test_case(Rule::ShebangNotFirstLine, Path::new("EXE005_2.py"))]
     #[test_case(Rule::ShebangNotFirstLine, Path::new("EXE005_3.py"))]
     fn rules(rule: Rule, path: &Path) -> Result<()> {
-        if is_wsl::is_wsl() {
+        if super::helpers::is_wsl() {
             // these rules are always ignored on WSL, so skip testing them in a WSL environment
             // see https://github.com/astral-sh/ruff/pull/21724 for latest discussion
             return Ok(());

crates/ruff_linter/src/rules/flake8_executable/rules/shebang_missing_executable_file.rs

@@ -5,7 +5,7 @@ use ruff_macros::{ViolationMetadata, derive_message_formats};
 use crate::Violation;
 use crate::checkers::ast::LintContext;
 #[cfg(target_family = "unix")]
-use crate::rules::flake8_executable::helpers::is_executable;
+use crate::rules::flake8_executable::helpers::{is_executable, is_wsl};
 
 /// ## What it does
 /// Checks for executable `.py` files that do not have a shebang.
@@ -50,7 +50,7 @@ pub(crate) fn shebang_missing_executable_file(filepath: &Path, context: &LintCon
     // WSL supports Windows file systems, which do not have executable bits.
     // Instead, everything is executable. Therefore, we skip this rule on WSL.
 
-    if is_wsl::is_wsl() {
+    if is_wsl() {
         return;
     }
     if let Ok(true) = is_executable(filepath) {

crates/ruff_linter/src/rules/flake8_executable/rules/shebang_not_executable.rs

@@ -6,7 +6,7 @@ use ruff_text_size::TextRange;
 use crate::Violation;
 use crate::checkers::ast::LintContext;
 #[cfg(target_family = "unix")]
-use crate::rules::flake8_executable::helpers::is_executable;
+use crate::rules::flake8_executable::helpers::{is_executable, is_wsl};
 
 /// ## What it does
 /// Checks for a shebang directive in a file that is not executable.
@@ -54,7 +54,7 @@ pub(crate) fn shebang_not_executable(filepath: &Path, range: TextRange, context:
     // WSL supports Windows file systems, which do not have executable bits.
     // Instead, everything is executable. Therefore, we skip this rule on WSL.
 
-    if is_wsl::is_wsl() {
+    if is_wsl() {
         return;
     }