Plugin container - docker network issues on macos

[tleyden]

No description provided.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• code-rabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a40c33e2-997a-4bd0-9b4c-a0f25bfd132a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch plugin_containers_fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR updates Plugin MCP container networking and shutdown behavior. The main changes are:

• Adds per-plugin network names and network_isolation config.
• Joins configured networks for Docker and native macOS container runs.
• Adds macOS Docker isolation rejection and non-isolated network handling.
• Improves startup inventory logging and container command logging.
• Stops managed containers concurrently with bounded stop time.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

T-Rex Logs

What T-Rex did

• The non-isolated open network test completed successfully with exit code 0.
• All 11 ensure-container tests completed successfully with exit code 0.
• All 37 brain3-core unit tests completed successfully with exit code 0.
• A gateway E2E compile blocker was observed due to a missing libclang in whisper-rs-sys.
• The Docker/container CLI absence was observed as expected and is not treated as a bug.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
crates/platform/src/config/brain3_yaml.rs	Adds plugin network and network_isolation parsing with macOS Docker validation.
crates/core/src/application/ensure_container.rs	Generalizes network preparation and validates internal-network support before network mutation.
crates/platform/src/container/docker.rs	Builds Docker runs with configured networks, non-isolated network reuse, bridge attachment, command logging, and bounded stops.
crates/platform/src/container/macos_container.rs	Mirrors the generalized network handling for the native macOS container runtime.
crates/platform/src/runtime/bootstrap.rs	Stops plugin and primary containers concurrently during managed runtime shutdown.

_{Reviews (4): Last reviewed commit: "fix e2e tests" | Re-trigger Greptile}

[greptile-apps]

Existing Plugin Networks Missing

When an upgraded brain3.yaml plugin entry does not have the new network field, this required check rejects only that entry and the gateway continues without its plugin client. Previously working plugin tools can disappear after upgrade instead of getting a migrated network name or a startup error that stops the bad config.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Docker Default Drops Plugins

On macOS, an existing platform: docker plugin that omits the new network_isolation field defaults to true and then fails this validation path. The loader skips that plugin while the gateway keeps running, so its tools disappear unless the user discovers and adds network_isolation: false.