fix(box): CRI RemoveContainer force-removes a running container

Per the CRI spec, RemoveContainer must remove a container even when it is
running (stopping it first), but BoxRuntimeService rejected a running
container with FailedPrecondition ("requires a stopped container"), so
`critest` "should support removing running container [Conformance]"
failed. RemoveContainer now force-stops a running container (timeout 0,
reusing stop_container's workload-stop + sandbox-VM-teardown path and the
multi-container guard) before deleting it.

Verified on the KVM server: the conformance spec now passes. Test
test_remove_container_rejects_running_container updated accordingly
(renamed to ..._force_stops_running_container).

Author: Roy Lin

src/cri/src/runtime_service/mod.rs

@@ -1176,11 +1176,16 @@ impl RuntimeService for BoxRuntimeService {
             return Ok(Response::new(RemoveContainerResponse {}));
         };
 
+        // CRI RemoveContainer force-removes: a still-running container is
+        // stopped first (timeout 0), then deleted — matching containerd/cri-o.
+        // stop_container handles the workload stop + sandbox VM teardown
+        // fallback and the multi-container guard.
         if container.state == ContainerState::Running {
-            return Err(Status::failed_precondition(format!(
-                "RemoveContainer requires a stopped container; container {} is Running",
-                container_id
-            )));
+            self.stop_container(Request::new(StopContainerRequest {
+                container_id: container_id.clone(),
+                timeout: 0,
+            }))
+            .await?;
         }
 
         if let Some(removed) = self.store.remove_container(container_id).await {

src/cri/src/runtime_service/tests.rs

@@ -2650,7 +2650,7 @@ async fn test_remove_container_missing_is_idempotent() {
 }
 
 #[tokio::test]
-async fn test_remove_container_rejects_running_container() {
+async fn test_remove_container_force_stops_running_container() {
     let svc = make_test_service();
     svc.store
         .containers
@@ -2661,17 +2661,16 @@ async fn test_remove_container_rejects_running_container() {
         .mark_started("c-1", 2_000_000_000)
         .await;
 
+    // CRI RemoveContainer force-removes: a running container is stopped first,
+    // then deleted (no VM manager in the test, so the stop reconciles it).
     let result = svc
         .remove_container(Request::new(RemoveContainerRequest {
             container_id: "c-1".to_string(),
         }))
         .await;
 
-    assert!(result.is_err());
-    let err = result.unwrap_err();
-    assert_eq!(err.code(), tonic::Code::FailedPrecondition);
-    assert!(err.message().contains("requires a stopped container"));
-    assert!(svc.store.containers.get("c-1").await.is_some());
+    assert!(result.is_ok());
+    assert!(svc.store.containers.get("c-1").await.is_none());
 }
 
 // ── Container Status ─────────────────────────────────────────────