GH#34285: feat(docker): owner labels, worktree teardown and report-only reaping for disposable Docker resources

[alex-solovyev]

Summary

Adds .agents/scripts/docker-resource-helper.sh (labels, compose-labels, inventory, teardown, reap, report). Six sh.aidevops.* owner labels (owner, repo, ref, worktree, created, ttl-hours default 72). Worktree removal (worktree-helper.sh remove post-removal hook and the worktree-helper.sh clean path) tears down labelled containers/networks/volumes for that worktree via docker_resource_auto_teardown (opt out with AIDEVOPS_DOCKER_TEARDOWN=0). Pulse cleanup_stale_opencode runs reap report-only unless AIDEVOPS_DOCKER_REAP=1, bounded by PULSE_DOCKER_CLEANUP_MAX_SECONDS (30). Reap removes only owner-labelled resources older than 30 min whose worktree is gone AND issue/PR closed (one gh lookup per ref, failure = keep), or TTL-expired with nothing running; containers before networks/volumes; shared networks/volumes kept. Unlabelled resources are only counted by report. wp-plugin-release-helper.sh labels its plugin-check network, volume and containers. New tools/containers/disposable-resources.md (labelled start, teardown, report, address-pool exhaustion and default-address-pools 10.200.0.0/16 size 24), linked from reference/domain-index.md and orbstack.md.

Files Changed

.agents/reference/domain-index.md, .agents/scripts/docker-resource-helper.sh, .agents/scripts/pulse-cleanup.sh, .agents/scripts/tests/test-docker-resource-helper.sh, .agents/scripts/worktree-clean-lib.sh, .agents/scripts/worktree-helper-cmds.sh, .agents/scripts/worktree-helper-integration.sh, .agents/scripts/wp-plugin-release-helper.sh, .agents/tools/containers/disposable-resources.md, .agents/tools/containers/orbstack.md

Runtime Testing

• Risk level: Critical
• Verification: runtime-verified — bash .agents/scripts/tests/test-docker-resource-helper.sh: 10/10 PASS (PATH-stubbed docker+gh: labels, inventory, reap report-only, reap --apply ownership rule incl. negatives for unlabelled, worktree present, ref open, ref lookup failure, running past TTL, fresh <30m, shared network; teardown; worktree hook + opt-out; pulse step report-only vs AIDEVOPS_DOCKER_REAP=1; report; daemon down and hung exit 0 within probe timeout). test-full-loop-merge-worktree-cleanup.sh 27/27 PASS; test-pulse-wrapper-characterization.sh 54/54 PASS; linters-local.sh --changed ALL PASSED. Real daemon: report ran read-only (30 unlabelled containers, 56 volumes untouched); manual labelled network+volume appeared in inventory, teardown refused while the worktree existed, dry-run listed both, apply removed exactly those two; volume count unchanged.

Resolves #34285

---

aidevops.sh v3.39.1 plugin for OpenCode v1.18.34 with claude-opus-5-5 spent 53m and 73,363 tokens on this as a headless worker.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

---

🚫 Excluded labels (none allowed) (1)

• no-review

---

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: marcusquinn/aidevops/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 26fd8871-38da-46dd-a87c-2cf83ffc1d02

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[alex-solovyev]

Completion Summary

• What: Adds .agents/scripts/docker-resource-helper.sh (labels, compose-labels, inventory, teardown, reap, report). Six sh.aidevops.* owner labels (owner, repo, ref, worktree, created, ttl-hours default 72). Worktree removal (worktree-helper.sh remove post-removal hook and the worktree-helper.sh clean path) tears down labelled containers/networks/volumes for that worktree via docker_resource_auto_teardown (opt out with AIDEVOPS_DOCKER_TEARDOWN=0). Pulse cleanup_stale_opencode runs reap report-only unless AIDEVOPS_DOCKER_REAP=1, bounded by PULSE_DOCKER_CLEANUP_MAX_SECONDS (30). Reap removes only owner-labelled resources older than 30 min whose worktree is gone AND issue/PR closed (one gh lookup per ref, failure = keep), or TTL-expired with nothing running; containers before networks/volumes; shared networks/volumes kept. Unlabelled resources are only counted by report. wp-plugin-release-helper.sh labels its plugin-check network, volume and containers. New tools/containers/disposable-resources.md (labelled start, teardown, report, address-pool exhaustion and default-address-pools 10.200.0.0/16 size 24), linked from reference/domain-index.md and orbstack.md.
• Issue: t18649: Docker cleanup: owner labels, post-merge teardown and pulse reaping for disposable test stacks #34285
• Files changed: .agents/reference/domain-index.md, .agents/scripts/docker-resource-helper.sh, .agents/scripts/pulse-cleanup.sh, .agents/scripts/tests/test-docker-resource-helper.sh, .agents/scripts/worktree-clean-lib.sh, .agents/scripts/worktree-helper-cmds.sh, .agents/scripts/worktree-helper-integration.sh, .agents/scripts/wp-plugin-release-helper.sh, .agents/tools/containers/disposable-resources.md, .agents/tools/containers/orbstack.md
• Testing: bash .agents/scripts/tests/test-docker-resource-helper.sh: 10/10 PASS (PATH-stubbed docker+gh: labels, inventory, reap report-only, reap --apply ownership rule incl. negatives for unlabelled, worktree present, ref open, ref lookup failure, running past TTL, fresh <30m, shared network; teardown; worktree hook + opt-out; pulse step report-only vs AIDEVOPS_DOCKER_REAP=1; report; daemon down and hung exit 0 within probe timeout). test-full-loop-merge-worktree-cleanup.sh 27/27 PASS; test-pulse-wrapper-characterization.sh 54/54 PASS; linters-local.sh --changed ALL PASSED. Real daemon: report ran read-only (30 unlabelled containers, 56 volumes untouched); manual labelled network+volume appeared in inventory, teardown refused while the worktree existed, dry-run listed both, apply removed exactly those two; volume count unchanged.
• Key decisions: Post-merge teardown hooks the shared worktree post-removal path (worktree-helper-cmds.sh _remove_finalize_post_removal and worktree-clean-lib.sh) because full-loop-helper-merge-cleanup.sh _merge_cleanup_linked_worktree has no callers; removal goes through worktree-helper.sh remove. Scope recovery recorded on the issue. A docker-missing PATH test was dropped because runtime-env.sh rebuilds PATH with standard dirs; daemon-down and hung cases cover the exit-0 contract.

---

aidevops.sh v3.39.1 plugin for OpenCode v1.18.34 with claude-opus-5-5 spent 54m and 73,493 tokens on this as a headless worker.

---

Merged via PR #34298 to main.
Merged by deterministic merge pass (pulse-wrapper.sh).

[github-actions]

Early-Exit Pipe Readers Under pipefail

This PR adds lines where a writer is piped into an early-exit reader
(grep -q, grep -m1, head) in a script that enables pipefail.
The reader can close the pipe early, the writer gets SIGPIPE (141), and
pipefail reports a false "no match" on large input
(style guide).

.agents/scripts/tests/test-docker-resource-helper.sh:290: early-exit pipe under pipefail: printf '%s\n' "$out" | grep -qE '^--label=sh\.aidevops\.created=[0-9]+$' || rc=1

--- Pipe Early-Exit Check ---
Found 1 violation(s) across 1 file(s).
Run pipe-early-exit-check.sh --fix-hint or see: .agents/reference/shell-style-guide.md § Early-Exit Pipe Readers (SIGPIPE)

Fix: use a here-string, e.g. grep -qF -- "$marker" <<<"$body", or
capture the output to a variable first. Run
pipe-early-exit-check.sh --fix-hint for more patterns.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-actions]

Qlty New-File Smell Gate

✅ Clean — 1 new source file(s) scanned, no smells found.

Base (c49f661)	Head (c0fe318)	New files	Smells
		1	0

New files scanned

• .agents/scripts/docker-resource-helper.sh

[github-actions]

Markdown Lint (changed-line scoped)

No new violations in changed lines (0 pre-existing in touched files — ignored).

Metric	Base (c49f661)	Head (c0fe318)
Total in touched files	—	0
New (in changed lines)	—	0

[github-actions]

Shell Function Complexity Regression Gate

✅ No regression — no new function(s) >100 lines.

Metric	Base (c49f661)	Head (c0fe318)
Total function(s) >100 lines	0	0

[github-actions]

Bash 3.2 Compatibility Regression Gate

✅ No regression — no new bash 3.2-incompatible construct(s).

Metric	Base (c49f661)	Head (c0fe318)
Total bash 3.2-incompatible construct(s)	0	0

[github-actions]

Qlty Smell Regression Gate

✅ No change — smell count unchanged.

Metric	Base (c49f661)	Head (c0fe318)	Delta
Total smells	65	65	+0

[github-actions]

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

SonarCloud: 0 bugs, 0 vulnerabilities, 1 code smells

Sat Oct 10 23:42:08 UTC 2026: Code review monitoring started
Sat Oct 10 23:42:09 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 1
Sat Oct 10 23:44:35 UTC 2026: Codacy analysis completed - issues found (exit 2)

📈 Current Quality Metrics

• BUGS: 0
• CODE SMELLS: 1
• VULNERABILITIES: 0

Generated on: Sat Oct 10 23:44:36 UTC 2026

---

Generated by AI DevOps Framework Code Review Monitoring

[github-actions]

Shell Nesting Depth Regression Gate

✅ No regression — no new file(s) with nesting depth >8.

Metric	Base (c49f661)	Head (c0fe318)
Total file(s) with nesting depth >8	0	0

[github-actions]

File Size Regression Gate

✅ No regression — no new non-README Markdown file(s) >1000 lines at root / >500 elsewhere.

Metric	Base (c49f661)	Head (c0fe318)
Total non-README Markdown file(s) >1000 lines at root / >500 elsewhere	0	0