fix(reaper): only adopt reapers started by this binding

findReaperContainers matched any running Ryuk on the host, so on a CI
host shared between testcontainers-node and another language binding
(e.g. testcontainers-python), Node workers adopted the other binding's
reaper every worker minted a fresh session id and asked the adopted
reaper to watch a session it was never durably told about — leaking
every container created under it.

Narrow the adoption predicate: require org.testcontainers.lang ===
"node" (this library already labels everything it creates with it via
createLabels()) and require a durable org.testcontainers.session-id
label. A reaper whose session cannot be identified is left to the
binding that owns it, and the node run starts its own reaper instead
of silently losing reaping.

Fixes #1442

Signed-off-by: kilisamemarisaaa <1798456934@qq.com>

Co-Authored-By: EvoX <evox@evomap.ai>

Author: kilisamemarisaaa

packages/testcontainers/src/reaper/reaper-discovery.docker.test.ts

@@ -0,0 +1,39 @@
+import { beforeAll, describe, expect, it } from "vitest";
+
+import { ContainerRuntimeClient, getContainerRuntimeClient } from "../container-runtime";
+import { GenericContainer } from "../generic-container/generic-container";
+import { LABEL_TESTCONTAINERS_LANG, LABEL_TESTCONTAINERS_RYUK } from "../utils/labels";
+import { findReaperContainers } from "./reaper";
+
+describe("Reaper discovery against a shared host", () => {
+  let client: ContainerRuntimeClient;
+  let dockerAvailable = true;
+
+  beforeAll(async () => {
+    try {
+      client = await getContainerRuntimeClient();
+      await client.container.list();
+    } catch {
+      dockerAvailable = false;
+    }
+  });
+
+  it("does not adopt a reaper container started by another language binding (#1442)", async () => {
+    if (!dockerAvailable) return;
+
+    const foreignReaper = await new GenericContainer("alpine:3.20")
+      .withCommand(["sleep", "60"])
+      .withLabels({
+        [LABEL_TESTCONTAINERS_RYUK]: "true",
+        [LABEL_TESTCONTAINERS_LANG]: "python",
+      })
+      .start();
+
+    try {
+      const result = await findReaperContainers(client);
+      expect(result.map((container) => container.Id)).not.toContain(foreignReaper.getId());
+    } finally {
+      await foreignReaper.stop({ timeout: 1000 });
+    }
+  });
+});

packages/testcontainers/src/reaper/reaper-discovery.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from "vitest";
+
+import { ContainerInfo } from "dockerode";
+import { ContainerRuntimeClient } from "../container-runtime";
+import { LABEL_TESTCONTAINERS_LANG, LABEL_TESTCONTAINERS_RYUK, LABEL_TESTCONTAINERS_SESSION_ID } from "../utils/labels";
+import { findReaperContainers } from "./reaper";
+
+function stubClient(containers: Partial<ContainerInfo>[]): ContainerRuntimeClient {
+  return { container: { list: async () => containers as ContainerInfo[] } } as unknown as ContainerRuntimeClient;
+}
+
+function reaperFixture(id: string, labels: Record<string, string>, state = "running"): Partial<ContainerInfo> {
+  return {
+    Id: id,
+    State: state,
+    Labels: {
+      [LABEL_TESTCONTAINERS_RYUK]: "true",
+      ...labels,
+    },
+    Created: 123,
+  };
+}
+
+describe("findReaperContainers", () => {
+  it("does not adopt reapers started by other language bindings (#1442)", async () => {
+    const foreignReaper = reaperFixture("foreign", { [LABEL_TESTCONTAINERS_LANG]: "python" });
+    const nodeReaper = reaperFixture("node", {
+      [LABEL_TESTCONTAINERS_LANG]: "node",
+      [LABEL_TESTCONTAINERS_SESSION_ID]: "0123456789ab",
+    });
+
+    const result = await findReaperContainers(stubClient([foreignReaper, nodeReaper]));
+
+    expect(result.map((container) => container.Id)).toEqual(["node"]);
+  });
+
+  it("does not adopt a reaper without an identifiable session id", async () => {
+    const anonymousReaper = reaperFixture("anonymous", { [LABEL_TESTCONTAINERS_LANG]: "node" });
+
+    const result = await findReaperContainers(stubClient([anonymousReaper]));
+
+    expect(result).toEqual([]);
+  });
+
+  it("does not adopt non-running containers or test reapers", async () => {
+    const stoppedReaper = reaperFixture(
+      "stopped",
+      {
+        [LABEL_TESTCONTAINERS_LANG]: "node",
+        [LABEL_TESTCONTAINERS_SESSION_ID]: "0123456789ab",
+      },
+      "exited"
+    );
+    const testReaper = reaperFixture("test", {
+      [LABEL_TESTCONTAINERS_LANG]: "node",
+      [LABEL_TESTCONTAINERS_SESSION_ID]: "0123456789ab",
+      TESTCONTAINERS_RYUK_TEST_LABEL: "true",
+    });
+
+    const result = await findReaperContainers(stubClient([stoppedReaper, testReaper]));
+
+    expect(result).toEqual([]);
+  });
+});

packages/testcontainers/src/reaper/reaper-discovery.ts

@@ -0,0 +1,27 @@
+import { ContainerInfo } from "dockerode";
+
+import { LABEL_TESTCONTAINERS_LANG, LABEL_TESTCONTAINERS_RYUK, LABEL_TESTCONTAINERS_SESSION_ID } from "../utils/labels";
+
+const LABEL_TESTCONTAINERS_RYUK_TEST_LABEL = "TESTCONTAINERS_RYUK_TEST_LABEL";
+
+/**
+ * Decides whether a running Ryuk container can be adopted by this binding's
+ * session. A reaper is only adoptable when this binding can actually own the
+ * session it watches:
+ *
+ * - it must have been started by this library, which labels everything it
+ *   creates with `org.testcontainers.lang: "node"` (see `createLabels()`), and
+ * - it must carry its session id in a durable label. Ryuk containers started
+ *   by other language bindings carry neither, and adopting them used to mint
+ *   a fresh session id per worker that no reaper ever owned — leaking every
+ *   container created under it (see issue #1442).
+ */
+export function isAdoptableReaperContainer(container: ContainerInfo): boolean {
+  return (
+    container.State === "running" &&
+    container.Labels[LABEL_TESTCONTAINERS_RYUK] === "true" &&
+    container.Labels[LABEL_TESTCONTAINERS_RYUK_TEST_LABEL] !== "true" &&
+    container.Labels[LABEL_TESTCONTAINERS_LANG] === "node" &&
+    typeof container.Labels[LABEL_TESTCONTAINERS_SESSION_ID] === "string"
+  );
+}

packages/testcontainers/src/reaper/reaper.ts

@@ -4,8 +4,9 @@ import { userInfo } from "os";
 import { IntervalRetry, log, RandomUuid, withFileLock } from "../common";
 import { ContainerRuntimeClient, ImageName } from "../container-runtime";
 import { GenericContainer } from "../generic-container/generic-container";
-import { LABEL_TESTCONTAINERS_RYUK, LABEL_TESTCONTAINERS_SESSION_ID } from "../utils/labels";
+import { LABEL_TESTCONTAINERS_SESSION_ID } from "../utils/labels";
 import { Wait } from "../wait-strategies/wait";
+import { isAdoptableReaperContainer } from "./reaper-discovery";
 
 /**
  * Resolve the Ryuk reaper image name. Read lazily so that callers (and tests)
@@ -68,16 +69,9 @@ export async function getReaper(client: ContainerRuntimeClient): Promise<Reaper>
   return reaper;
 }
 
-async function findReaperContainers(client: ContainerRuntimeClient): Promise<ContainerInfo[]> {
+export async function findReaperContainers(client: ContainerRuntimeClient): Promise<ContainerInfo[]> {
   const containers = await client.container.list();
-  return containers
-    .filter(
-      (container) =>
-        container.State === "running" &&
-        container.Labels[LABEL_TESTCONTAINERS_RYUK] === "true" &&
-        container.Labels["TESTCONTAINERS_RYUK_TEST_LABEL"] !== "true"
-    )
-    .sort((a, b) => b.Created - a.Created);
+  return containers.filter(isAdoptableReaperContainer).sort((a, b) => b.Created - a.Created);
 }
 
 async function useExistingReaper(reaperContainer: ContainerInfo, sessionId: string, host: string): Promise<Reaper> {