[Jabe03]

Stop safe mode containers on cancel and cap concurrent runs

Follow-up to #30. Needed by kind2-mc/kind2-language-server#22, which cancels out-of-date parses: without this, cancelling a safe mode run stops the docker client but can leave the container running.

Changes

• Shared docker run command: getDockerRunCommand() builds the resource limits and the Kind 2/solver mounts once, for checks, the interpreter and checkAvailable().
• --init: the container runs an init process as PID 1, so signals reach Kind 2 and orphaned solver processes are reaped.
• Killing containers: each safe mode run gets a unique --name (kind2-api-<uuid>). If the run is cancelled or the process is still alive when it ends, the API runs docker kill on that container before destroying the client process. Destroying the client alone doesn't reliably stop the container (for example on Windows).
• Concurrent run cap: a semaphore shared by every Kind2Api instance limits how many safe mode runs happen at once (default 2, set with the new static setSafeModeMaxRuns(int)). Waiting runs still respond to their monitor's cancellation.
• checkAvailable() in safe mode now runs Kind 2 inside the container, and waits for the process instead of reading exitValue() before it has exited.
• --no_include is only passed when safe mode is on (it used to be passed as --no_include false when safe mode was explicitly off).
• The two interpret overloads now share one runInterpreter method.
• After review: the docker kill timeout now applies; finished runs get a short grace period instead of being killed; setSafeModeMaxRuns resizes the limit in place, so it also applies to waiting runs; slots are held with try-with-resources; the interpreter stops waiting for a slot after 60 s; one helper builds the Kind 2 command prefix; the interpreter reads stderr and reports it when no trace comes back; programs are sent as UTF-8.
• After the second review: the interpreter reports stderr only when stdout has no usable output, and wraps parse errors in Kind2Exception; checkAvailable takes a run slot, names its container and times out after 30 s; after a kill, the container is also removed with docker rm -f once the client has exited (covers a cancel that lands while Docker is still creating it); execute(String)/execute(Program) stop waiting for a slot after 60 s; cleanup clears the interrupt flag while it waits; safeMode is read once per run; one slot-holding pattern; ApiUtil.readAll decodes UTF-8.

Outside safe mode the command line is unchanged.

Testing

• ./gradlew clean build passes.
• Second review: each fix tested with real containers and the fake kind2 (plus a docker wrapper that delays kill or splits run into create + start), reproducing the problem on the previous head where possible: Created container left after an early cancel (2/2 before, 0 after), slot released 2 s before docker kill ended on an interrupted thread, harmless stderr hiding the result, garbled non-ASCII paths, checkAvailable hanging on a stuck docker run.
• With real containers and a statically linked fake kind2 (sleeps, then prints a trace): finished checks and interpreter runs call no docker kill, a cancelled check is killed with no container left, raising and lowering the limit while runs wait takes effect right away, and the interpreter gives up after 60 s when no slot is free.
• Cancelling a safe mode run through Kind2Api (setSafeMode(true)) left no running containers and no leftover z3 processes in 4 of 4 tries.

🤖 Generated with Claude Code

[Jabe03]

Review of the safe mode run lifecycle. I'll address each comment with its own commit and reply here.

Not raised here: a cancel that arrives before Docker creates the container (pending issue 3 in the safe mode notes), since how to handle it hasn't been decided yet.

[daniel-larraz]

Review of the safe mode run management and interpreter error reporting. I checked each finding against the code; gson behavior was tested against 2.8.6.

The two worth fixing first are on the new interpreter error-reporting path: harmless stderr now replaces the empty result (L407), and parse failures escape as raw gson exceptions (L398). The rest are lower severity: cleanup/race edge cases, and a few smaller consistency and robustness points.

🤖 Generated with Claude Code