bug(docker): containerized gateways reuse helper container names openshell-supervisor-extract-1-<seq>, so concurrent starts on one engine can collide #5094

User Story

As an operator running more than one OpenShell gateway on a Docker engine, I want each gateway's helper containers to have unique names, so that two gateways starting, or starting sandboxes, at the same time don't fail.

Problem Statement

temp_extract_container_name() in crates/openshell-core/src/driver_utils.rs builds helper container names from the process ID and a per-process counter:

format!("openshell-supervisor-extract-{pid}-{seq}")

Its comment says this avoids collisions across concurrent gateway starts. That holds only for gateways running directly on the host. A gateway running in a container, as the published ghcr.io/nvidia/openshell/gateway image does, is PID 1 in its own PID namespace. So every containerized gateway on an engine generates the same names, starting at openshell-supervisor-extract-1-0.

The Docker driver uses these names in three places in crates/openshell-driver-docker/src/lib.rs, at ac7f615c and on main:

• supervisor binary extraction at gateway start (extract_runtime_path_archive): openshell-supervisor-extract-1-<seq>;
• workload identity resolution for each sandbox image: …-<seq>-identity;
• host-gateway address resolution: …-<seq>-host-gateway.

Each one calls create_container with a fixed name and returns an error if creation fails. Nothing retries, and nothing falls back to another name. The Podman driver uses the same function.

Impact / Why This Matters

If two gateways on one engine start, or start sandboxes, within the same fraction of a second, the second create_container fails with a name conflict. The gateway start or the sandbox creation then fails with:

• failed to create extractor container from '<image>', or
• create Docker identity resolver container: ….

This hits two deployments applied at the same time on one host, a gateway restarting while another starts, and any test suite that runs gateways in parallel. NVIDIA/NemoClaw keeps its Docker live tests serial for this reason.

Acceptance Criteria

• Helper container names are unique per call across processes and containers, for example with a random suffix or a UUID instead of the PID. Alternatively, creation retries with a fresh name when it returns a conflict.
• The -identity and -host-gateway variants get the same fix.
• Two containerized gateways starting at the same moment on one engine both succeed.

Reproduction Steps

Observed: on one Docker engine, the Docker events for a run of NemoClaw's Docker live suite show every gateway container creating openshell-supervisor-extract-1-0 within about 0.3 s of starting, and creating openshell-supervisor-extract-1-1-identity (or -1-2-identity) when it starts a sandbox. In that run the gateways started one after another, so the names didn't overlap, and no collision was triggered.

To trigger a collision:

1. On one Docker engine, start two containerized gateways at the same moment, or have two running gateways create sandboxes at the same moment.
2. One of the overlapping helper-container creations fails with a name conflict.

The failure above follows from the code; it hasn't been triggered deliberately yet.

Environment

OpenShell v0.1.6 (ac7f615cd12d5cc49cb16eb1f5f10ffeb1e90f47); the same code is on main. Docker driver, gateway image ghcr.io/nvidia/openshell/gateway@sha256:f0b36dba…, linux_arm64.