From 7626ad2c970576192794029a289680d461fb4520 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Tue, 28 Jul 2026 18:56:15 -0500 Subject: [PATCH 1/2] fix(agent): stop docker image-pull output from leaking into version log detectVolumeVersion used CombinedOutput, which merges the probe container's stdout with docker's own stderr diagnostics. When the helper image wasn't cached, that stderr carried a full multi-line image-pull transcript, which then got treated as the detected "version" string and interpolated into a single log.Infof call -- producing a garbled, multi-line log entry like: upgraded remote agent from Unable to find image 'busybox:latest' locally latest: Pulling from library/busybox ... Status: Downloaded newer image for busybox:latest to v0.0.0 Output() only captures stdout, so the detected version is just whatever the container's script actually printed. --- pkg/agent/delivery/local_docker.go | 5 ++++- pkg/agent/delivery/local_docker_test.go | 25 +++++++++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/pkg/agent/delivery/local_docker.go b/pkg/agent/delivery/local_docker.go index bae75e844..0b66aee50 100644 --- a/pkg/agent/delivery/local_docker.go +++ b/pkg/agent/delivery/local_docker.go @@ -163,7 +163,10 @@ func (d *LocalDockerDelivery) detectVolumeVersion(ctx context.Context, volumeNam "sh", "-c", script, } - out, err := d.cmd(ctx, args...).CombinedOutput() + // Stdout only: stderr carries docker's own diagnostics, including a full + // image-pull transcript when the helper image isn't cached yet, which + // CombinedOutput would fold into the detected "version" string. + out, err := d.cmd(ctx, args...).Output() if err != nil { log.Debugf("failed to detect agent version in volume: %v", err) return "" diff --git a/pkg/agent/delivery/local_docker_test.go b/pkg/agent/delivery/local_docker_test.go index 6f512e595..0d24cdf65 100644 --- a/pkg/agent/delivery/local_docker_test.go +++ b/pkg/agent/delivery/local_docker_test.go @@ -264,6 +264,31 @@ func TestDetectVolumeVersion_ReturnsEmptyOnFailure(t *testing.T) { assert.Empty(t, ver) } +func TestDetectVolumeVersion_IgnoresStderrNoise(t *testing.T) { + tmpDir := t.TempDir() + + // Simulates docker writing an image-pull transcript to stderr (as it + // does when the helper image isn't cached) alongside the script's real + // stdout output. Only the stdout content should be returned. + scriptPath := filepath.Join(tmpDir, "fake-docker.sh") + script := "#!/bin/sh\n" + + "case \"$1\" in\n" + + " run)\n" + + " echo \"Unable to find image 'busybox:latest' locally\" >&2\n" + + " echo \"latest: Pulling from library/busybox\" >&2\n" + + " echo \"v1.2.3\"\n" + + " ;;\n" + + " *) exit 1 ;;\n" + + "esac\n" + require.NoError(t, os.WriteFile(scriptPath, []byte(script), 0o600)) + // #nosec G302 -- test script must be executable + require.NoError(t, os.Chmod(scriptPath, 0o755)) + + d := &LocalDockerDelivery{DockerCommand: scriptPath} + ver := d.detectVolumeVersion(context.Background(), "test-vol") + assert.Equal(t, "v1.2.3", ver) +} + func TestDetectVolumeVersion_ReturnsEmptyWhenNoBinary(t *testing.T) { tmpDir := t.TempDir() From 62ddfe09e34e74e5a2566b99a48a64a35eae156b Mon Sep 17 00:00:00 2001 From: Samuel K Date: Tue, 28 Jul 2026 22:06:38 -0500 Subject: [PATCH 2/2] style: trim comments --- pkg/agent/delivery/local_docker.go | 3 --- pkg/agent/delivery/local_docker_test.go | 4 ---- 2 files changed, 7 deletions(-) diff --git a/pkg/agent/delivery/local_docker.go b/pkg/agent/delivery/local_docker.go index 0b66aee50..090eeba35 100644 --- a/pkg/agent/delivery/local_docker.go +++ b/pkg/agent/delivery/local_docker.go @@ -163,9 +163,6 @@ func (d *LocalDockerDelivery) detectVolumeVersion(ctx context.Context, volumeNam "sh", "-c", script, } - // Stdout only: stderr carries docker's own diagnostics, including a full - // image-pull transcript when the helper image isn't cached yet, which - // CombinedOutput would fold into the detected "version" string. out, err := d.cmd(ctx, args...).Output() if err != nil { log.Debugf("failed to detect agent version in volume: %v", err) diff --git a/pkg/agent/delivery/local_docker_test.go b/pkg/agent/delivery/local_docker_test.go index 0d24cdf65..74323c462 100644 --- a/pkg/agent/delivery/local_docker_test.go +++ b/pkg/agent/delivery/local_docker_test.go @@ -266,10 +266,6 @@ func TestDetectVolumeVersion_ReturnsEmptyOnFailure(t *testing.T) { func TestDetectVolumeVersion_IgnoresStderrNoise(t *testing.T) { tmpDir := t.TempDir() - - // Simulates docker writing an image-pull transcript to stderr (as it - // does when the helper image isn't cached) alongside the script's real - // stdout output. Only the stdout content should be returned. scriptPath := filepath.Join(tmpDir, "fake-docker.sh") script := "#!/bin/sh\n" + "case \"$1\" in\n" +