fix(sandbox): tolerate partial docker inspect failures (#1282)

Author: zhangjaycee

rock/utils/system.py

@@ -130,7 +130,10 @@ def _get_docker_used_host_ports() -> set[int]:
         )
         if inspect.returncode != 0:
             logger.debug(f"docker inspect failed ({inspect.returncode}): {inspect.stderr.strip()}")
-            return used
+            # Containers can disappear after ``docker ps`` and before this
+            # command runs. Docker still writes the successfully inspected
+            # containers to stdout, so retain that partial snapshot instead
+            # of discarding every port because one stale ID failed.
         for line in inspect.stdout.splitlines():
             line = line.strip()
             if not line or line == "null":

tests/unit/utils/test_system.py

@@ -0,0 +1,29 @@
+import json
+import subprocess
+
+from rock.utils import system
+
+
+def test_get_docker_used_host_ports_keeps_partial_inspect_results(monkeypatch):
+    """A container removed during the scan must not hide surviving ports."""
+    responses = iter(
+        [
+            subprocess.CompletedProcess(
+                args=["docker", "ps", "-aq"],
+                returncode=0,
+                stdout="live-container\nstale-container\n",
+                stderr="",
+            ),
+            subprocess.CompletedProcess(
+                args=["docker", "inspect"],
+                returncode=1,
+                stdout=json.dumps({"22555/tcp": [{"HostIp": "", "HostPort": "42463"}]}),
+                stderr="error: no such object: stale-container",
+            ),
+        ]
+    )
+
+    monkeypatch.setattr(system.subprocess, "run", lambda *args, **kwargs: next(responses))
+    system._DOCKER_USED_PORTS.clear()
+
+    assert system._get_docker_used_host_ports() == {42463}