test(utils): comprehensive test suite for docker_client module (+84 tests)

[manus-use]

Summary

Comprehensive test suite for the manus_agent.utils.docker_client module — 84 fully-mocked tests covering the entire Docker client utilities surface area.

What's tested

Area	Tests	What it covers
DockerConnectionError	2	Structured error fields, exception inheritance
is_transient_docker_error	16	Classification of transient vs non-transient Docker/transport errors (APIError, DockerException, connection resets, timeouts, TLS, EOF, 429/503, conflict exclusion)
docker_retry	9	Exponential backoff, jitter variance, max_delay cap, deadline awareness, non-transient bail-out, single-attempt mode
_is_socket_accessible	4	Non-unix prefix rejection, nonexistent path, regular file vs actual Unix socket
_get_default_docker_hosts	3	Darwin multi-path (Docker Desktop/OrbStack/Colima), Linux standard socket, URL format validation
_check_docker_context	5	No config file, missing currentContext, successful context resolution, name mismatch, malformed JSON
get_docker_client	4	DOCKER_HOST env priority, Docker context fallback, default socket discovery, connection failure cascade
check_docker_available	3	Available (happy path), DockerConnectionError, unexpected error
wait_for_container_running	5	Already running, becomes running after reload, exited container, dead container, timeout
wait_for_container_healthy	5	No healthcheck, already healthy, becomes healthy, unhealthy raises, timeout
safe_kill_remove_container	6	None container noop, kill+remove flow, NotFound early return, kill error recovery, remove error silence
safe_remove_network	4	None noop, normal removal, NotFound silence, other error silence
safe_remove_image	6	None client/image noop, empty image noop, normal removal, NotFound silence, error silence
_diagnose_docker_issue	4	Darwin/Linux no-socket diagnosis, permission denied, connection refused, generic errors
Integration (retry + classification)	3	Multi-failure recovery, conflict non-retry, jitter variance

Why this module

docker_client.py is foundational infrastructure — used by both DockerSandbox and ExploitSandbox for every Docker operation. Its retry/backoff logic, transient error classification, and socket detection have non-trivial edge cases that previously had zero dedicated tests. The retry logic alone has exponential backoff with jitter, deadline awareness, and error classification that determines whether to retry or bail.

Duplicate check

Checked all 50 open PRs — none test utils/docker_client.py:

• test(core-tools): comprehensive test suite for check_cisa_kev, get_nvd_data, get_cwe_details, get_otx_cve_details #89 (check_cisa_kev/get_nvd_data/get_cwe_details/get_otx tests)
• test(tools): comprehensive test suite for search_exploit_db, search_packetstorm, query_threat_intelligence_feeds, obtain_cves #90 (search_exploit_db/packetstorm/threat_feeds/obtain_cves tests)
• test(tools): comprehensive test suite for submit_cves, tool_output_logger, and verify_exploit helpers #93 (submit_cves/tool_output_logger/verify_exploit tests)
• test(cli): comprehensive test suite for manus-agent osv subcommand + README docs #120-tests: comprehensive CLI tests for _run_analyze, _run_remediate, _run_discover (+78 tests) #123, test(cli): comprehensive test suite for manus-agent history subcommand (+39 tests) #132, test(tools): comprehensive test suite for track_vendor_response (+67 tests) #137, test(cli): comprehensive test suite for manus-agent poc-search subcommand (+57 tests) #139, test(tools): comprehensive test suite for http_request truncation wrapper (+36 tests) #140, test(tools): comprehensive test suite for code_execute module (+45 tests) #141 (various CLI and tool tests)

None of the 30 most recent merged PRs include docker_client tests either.

Test characteristics

• 100% mocked — no Docker daemon required, no real HTTP calls
• Zero flaky tests — deterministic time mocking for timeout/deadline tests
• Baseline preserved — 1242 total tests pass (1158 existing + 84 new), 0 failures