fix(BA-5519): read container net stats from /proc/[pid]/net/dev with netns fallback

[fregataa]

Summary

• Replace netstat_ns() + setns() with direct /proc/[container_pid]/net/dev reading for container network stats in cgroup mode
• Root cause: agent runs as daemon subprocess → ProcessPoolExecutor unavailable → thread pool fallback → setns() changes thread namespace but psutil reads /proc/self/net/dev (process-level = host namespace)
• Remove dead code: netstat_ns(), netstat_ns_work(), unused imports (multiprocessing, ProcessPoolExecutor, nsenter)

Fixes BA-5519

Test plan

• Verify container net_rx/net_tx values match docker stats output
• Verify /proc/[container_pid]/net/dev shows only container interfaces (lo, eth0)
• Verify PID=0 case (stopped container) returns 0 with warning log
• Run existing unit tests for agent intrinsic plugins

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the agent’s container network-stat collection in CGROUP mode to avoid unreliable per-thread namespace switching by reading /proc/<container_pid>/net/dev directly.

Changes:

• Replace netstat_ns()/setns()/psutil-based namespace reads with a /proc/<pid>/net/dev parser (read_proc_net_dev()).
• Update MemoryPlugin CGROUP-mode net stat collection to use container PID from container.show()["State"]["Pid"].
• Refactor unit tests to target PID-based net stat collection and remove the old namespace-switching test coverage.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
src/ai/backend/agent/docker/intrinsic.py	Introduces /proc/<pid>/net/dev parsing and switches MemoryPlugin CGROUP net stats to use container PID instead of SandboxKey/netns.
tests/unit/agent/test_docker_intrinsic.py	Updates tests for PID-based net stats, adds PID validation cases, and removes netns work tests (but still contains outdated netns-based fixtures/tests that need updating).

Comments suppressed due to low confidence (1)

tests/unit/agent/test_docker_intrinsic.py:196

• memory_cgroup_context mocks current_loop().run_in_executor to always return 0, but sysfs_impl() now awaits run_in_executor(..., read_proc_net_dev, pid) and unpacks a (rx, tx) tuple. With the current mock this will raise during tuple-unpacking. Adjust the mock to call the provided function (fn(*args)) or return a (0, 0) tuple for read_proc_net_dev while still returning an int for get_scratch_size.

            patch(
                "ai.backend.agent.docker.intrinsic.read_proc_net_dev",
                return_value=(0, 0),
            ),
            patch(
                "ai.backend.agent.docker.intrinsic.current_loop",
            ) as mock_loop,
        ):
            mock_container_instance = AsyncMock()
            mock_container_instance.show.return_value = mock_container_data
            mock_container_cls.return_value = mock_container_instance
            mock_loop.return_value.run_in_executor = AsyncMock(return_value=0)
            yield ctx

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[seedspirit]

The logic seems fine, but I think we'll need @HyeockJinKim's review as well.

[seedspirit]

I think this test can be generalized with parametrize