fix: read exec exit code only after draining the output stream (#3766)

A created-but-not-yet-started exec is reported by the daemon as
{Running:false, ExitCode:null}, which the Docker Go SDK flattens to
exit code 0. Inspecting immediately after attach could land in the
pre-start window and return 0 for a command still running.

Drain the hijacked stream to EOF before inspecting: the daemon closes
the stream only once the exec process has exited, making the subsequent
Running:false a real terminal state. The output is buffered internally
so callers still read it from the returned reader unchanged. On context
cancellation Exec returns ctx.Err() promptly; the deferred hijack.Close
unblocks the reader goroutine.

Also closes the hijacked response, which was previously leaked.

Co-authored-by: Dean Balandin <dbalandin@island.io>

Author: dean-island

docker.go

@@ -3,6 +3,7 @@ package testcontainers
 import (
 	"archive/tar"
 	"bufio"
+	"bytes"
 	"context"
 	"encoding/binary"
 	"errors"
@@ -586,15 +587,39 @@ func (c *DockerContainer) Exec(ctx context.Context, cmd []string, options ...tce
 	if err != nil {
 		return 0, nil, fmt.Errorf("container exec attach: %w", err)
 	}
+	defer hijack.Close()
 
-	processOptions.Reader = hijack.Reader
+	// A not-yet-started exec inspects as {Running:false, ExitCode:null->0}, which
+	// is indistinguishable from "exited 0". The daemon closes the stream only once
+	// the process ends, so drain to EOF before inspecting; buffer it so callers
+	// can still read the output from the returned reader.
+	var buf bytes.Buffer
+	drained := make(chan error, 1) // buffered so the goroutine can finish after we return on ctx cancel
+	go func() {
+		_, copyErr := io.Copy(&buf, hijack.Reader)
+		drained <- copyErr
+	}()
+
+	select {
+	case copyErr := <-drained:
+		if copyErr != nil {
+			return 0, nil, fmt.Errorf("container exec read: %w", copyErr)
+		}
+	case <-ctx.Done():
+		return 0, nil, ctx.Err()
+	}
+
+	processOptions.Reader = bytes.NewReader(buf.Bytes())
 
 	// second loop to process the multiplexed option, as now we have a reader
 	// from the created exec response.
 	for _, o := range options {
 		o.Apply(processOptions)
 	}
 
+	// The daemon marks the exec stopped asynchronously after closing the stream,
+	// so a single immediate inspect can still observe Running:true; poll until it
+	// reports terminal.
 	var exitCode int
 	for {
 		execResp, err := cli.ExecInspect(ctx, response.ID, client.ExecInspectOptions{})
@@ -607,7 +632,11 @@ func (c *DockerContainer) Exec(ctx context.Context, cmd []string, options ...tce
 			break
 		}
 
-		time.Sleep(100 * time.Millisecond)
+		select {
+		case <-ctx.Done():
+			return 0, nil, ctx.Err()
+		case <-time.After(100 * time.Millisecond):
+		}
 	}
 
 	return exitCode, processOptions.Reader, nil

docker_exec_test.go

@@ -71,6 +71,29 @@ func TestExecWithOptions(t *testing.T) {
 	}
 }
 
+func TestExecReturnsNonZeroExitCodeAndOutput(t *testing.T) {
+	// Regression for exit codes read before the output stream drained: a
+	// created-but-not-yet-started exec reports {Running:false, ExitCode:null},
+	// which the SDK flattens to 0, so an inspect landing in the pre-start window
+	// returned 0 for a command that ultimately failed. Draining the stream to EOF
+	// first makes the subsequent inspect a real terminal state. The race needs
+	// daemon load to reproduce (~1 hit per few thousand concurrent execs); this
+	// asserts the correct code and full output for a short-lived failing command.
+	ctx := context.Background()
+
+	ctr, err := Run(ctx, nginxAlpineImage)
+	CleanupContainer(t, ctr)
+	require.NoError(t, err)
+
+	code, reader, err := ctr.Exec(ctx, []string{"sh", "-c", "echo MARKER; exit 7"}, tcexec.Multiplexed())
+	require.NoError(t, err)
+	require.Equal(t, 7, code)
+
+	b, err := io.ReadAll(reader)
+	require.NoError(t, err)
+	require.Contains(t, string(b), "MARKER")
+}
+
 func TestExecWithMultiplexedResponse(t *testing.T) {
 	ctx := context.Background()