Add persistent container support by anticomputer · Pull Request #67 · GitHubSecurityLab/seclab-taskflows

anticomputer · 2026-03-18T18:39:48Z

Adds CONTAINER_PERSIST env var to container_shell. When set to true, containers get a deterministic name, survive MCP server exit, and are reused by subsequent tasks. Useful for multi-task taskflows that need shared state across tasks.

When CONTAINER_PERSIST is set to 'true', containers are: - Named deterministically (seclab-persist-{image-slug}) instead of randomly - Started without --rm so they survive MCP server process exit - Reused if already running (new MCP server attaches to existing container) - Not stopped on atexit (container persists for the next task) This enables multi-task taskflows to share state across tasks without rebuilding the environment each time. Set CONTAINER_PERSIST in the taskflow env or toolbox YAML to enable. All container_shell toolbox YAMLs updated to expose CONTAINER_PERSIST.

Copilot

Pull request overview

Adds an opt-in “persistent container” mode for the container_shell MCP server so that a deterministic container can be reused across tasks, enabling shared state in multi-task taskflows.

Changes:

Introduces CONTAINER_PERSIST env var (parsed as a boolean) and persistent lifecycle behavior in container_shell.py.
Adds CONTAINER_PERSIST passthrough to the container shell toolbox YAMLs (base/sast/network/malware).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/seclab_taskflows/mcp_servers/container_shell.py	Adds deterministic naming + reuse logic and skips shutdown for persistent containers.
src/seclab_taskflows/toolboxes/container_shell_base.yaml	Passes `CONTAINER_PERSIST` into the MCP server environment.
src/seclab_taskflows/toolboxes/container_shell_sast.yaml	Passes `CONTAINER_PERSIST` into the MCP server environment.
src/seclab_taskflows/toolboxes/container_shell_network_analysis.yaml	Passes `CONTAINER_PERSIST` into the MCP server environment.
src/seclab_taskflows/toolboxes/container_shell_malware_analysis.yaml	Passes `CONTAINER_PERSIST` into the MCP server environment.

Comments suppressed due to low confidence (1)

src/seclab_taskflows/mcp_servers/container_shell.py:47

docker inspect is invoked without a timeout. If the Docker daemon is unresponsive, this can block the MCP server indefinitely. Please add a reasonable timeout (consistent with the docker run timeout) and handle subprocess.TimeoutExpired so the tool fails fast with a clear error.

    result = subprocess.run(
        ["docker", "inspect", "-f", "{{.State.Running}}", name],
        capture_output=True,
        text=True,
    )

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

src/seclab_taskflows/mcp_servers/container_shell.py

- Use sha256 hash of full image ref (+ optional CONTAINER_PERSIST_KEY) for deterministic container names, avoiding collisions on long prefixes - Add timeouts to all docker subprocess calls (_DOCKER_TIMEOUT = 30s) - Extract _remove_container() helper with failure logging - Use docker inspect --format json + json.loads for _is_running() - Handle TimeoutExpired and JSONDecodeError gracefully - Add CONTAINER_PERSIST_KEY env var to all toolbox YAMLs - Add 11 tests covering persistent container behavior: name hashing, reuse, no --rm flag, stop skip, error logging

Copilot

Pull request overview

This PR adds an opt-in “persistent container” mode to the container_shell MCP server so multi-task taskflows can reuse a deterministic, long-lived Docker container across server restarts.

Changes:

Add CONTAINER_PERSIST / CONTAINER_PERSIST_KEY support and deterministic container naming to container_shell.
Add helper functions for checking container running state and removing leftovers.
Extend toolbox YAMLs and add unit tests covering persistence behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`src/seclab_taskflows/mcp_servers/container_shell.py`	Implements deterministic naming + reuse logic for persistent containers.
`tests/test_container_shell.py`	Adds unit tests for persistent naming, reuse, stop-skip behavior, and helper error paths.
`src/seclab_taskflows/toolboxes/container_shell_base.yaml`	Wires persistence env vars into the base container toolbox.
`src/seclab_taskflows/toolboxes/container_shell_malware_analysis.yaml`	Wires persistence env vars into the malware analysis toolbox.
`src/seclab_taskflows/toolboxes/container_shell_network_analysis.yaml`	Wires persistence env vars into the network analysis toolbox.
`src/seclab_taskflows/toolboxes/container_shell_sast.yaml`	Wires persistence env vars into the SAST toolbox.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

src/seclab_taskflows/mcp_servers/container_shell.py

tests/test_container_shell.py

- docker rm without -f to avoid killing running containers on transient failures - use _DOCKER_TIMEOUT constant for docker run - assert full docker inspect argv in reuse test

Copilot

Pull request overview

Adds support for reusing a deterministic, persistent Docker container across MCP server runs in container_shell, controlled via new environment variables and propagated through the relevant toolboxes.

Changes:

Introduces CONTAINER_PERSIST / CONTAINER_PERSIST_KEY to enable deterministic container naming and reuse.
Updates container lifecycle logic to reuse running persistent containers and skip stopping them on exit.
Adds unit tests for persistent naming, reuse behavior, and helper functions; updates toolboxes to pass through the new env vars.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`src/seclab_taskflows/mcp_servers/container_shell.py`	Implements persistent container naming, reuse checks, and adjusted stop/remove behavior.
`tests/test_container_shell.py`	Adds test coverage for persistent naming/reuse and helper behaviors.
`src/seclab_taskflows/toolboxes/container_shell_base.yaml`	Passes through `CONTAINER_PERSIST` and `CONTAINER_PERSIST_KEY` to the MCP server.
`src/seclab_taskflows/toolboxes/container_shell_malware_analysis.yaml`	Passes through `CONTAINER_PERSIST` and `CONTAINER_PERSIST_KEY` to the MCP server.
`src/seclab_taskflows/toolboxes/container_shell_network_analysis.yaml`	Passes through `CONTAINER_PERSIST` and `CONTAINER_PERSIST_KEY` to the MCP server.
`src/seclab_taskflows/toolboxes/container_shell_sast.yaml`	Passes through `CONTAINER_PERSIST` and `CONTAINER_PERSIST_KEY` to the MCP server.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

tests/test_container_shell.py

anticomputer requested review from JarLob, kevinbackhouse, m-y-mo and p- as code owners March 18, 2026 18:39

Copilot AI review requested due to automatic review settings March 18, 2026 18:39

anticomputer requested a review from sylwia-budzynska as a code owner March 18, 2026 18:39

Copilot started reviewing on behalf of anticomputer March 18, 2026 18:40 View session

Copilot AI reviewed Mar 18, 2026

View reviewed changes

src/seclab_taskflows/mcp_servers/container_shell.py Outdated Show resolved Hide resolved

src/seclab_taskflows/mcp_servers/container_shell.py Show resolved Hide resolved

src/seclab_taskflows/mcp_servers/container_shell.py Outdated Show resolved Hide resolved

p- previously approved these changes Mar 18, 2026

View reviewed changes

anticomputer dismissed p-’s stale review via 2854cad March 18, 2026 19:46

Copilot AI review requested due to automatic review settings March 18, 2026 19:51

anticomputer force-pushed the anticomputer/container-improvements branch from 2854cad to b646bea Compare March 18, 2026 19:51

Copilot AI reviewed Mar 18, 2026

View reviewed changes

address second round of review feedback

d908abf

- docker rm without -f to avoid killing running containers on transient failures - use _DOCKER_TIMEOUT constant for docker run - assert full docker inspect argv in reuse test

p- previously approved these changes Mar 18, 2026

View reviewed changes

fix: use logging.exception in except block to satisfy TRY400 lint

2604fba

Copilot AI review requested due to automatic review settings March 18, 2026 20:32

anticomputer dismissed p-’s stale review via 2604fba March 18, 2026 20:32

Copilot AI reviewed Mar 18, 2026

View reviewed changes

tests/test_container_shell.py Outdated Show resolved Hide resolved

kevinbackhouse previously approved these changes Mar 18, 2026

View reviewed changes

fix: align test with logging.exception change from TRY400 fix

cdb43f3

anticomputer dismissed kevinbackhouse’s stale review via cdb43f3 March 18, 2026 20:49

Kwstubbs requested review from Kwstubbs and removed request for Kwstubbs March 18, 2026 21:05

Kwstubbs approved these changes Mar 18, 2026

View reviewed changes

anticomputer merged commit 4cecfe9 into main Mar 18, 2026
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add persistent container support#67

Add persistent container support#67
anticomputer merged 5 commits intomainfrom
anticomputer/container-improvements

anticomputer commented Mar 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

anticomputer commented Mar 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants