Fix A: the container sampler keeps Docker's stderr in its error (a live run on 9202 logged only 'exit status 1'). Commit only.

controller/cmd/controller/main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"flag"
@@ -3446,7 +3447,17 @@ func (a *stackAdapter) StartStackServices(name string, services []string) error
 // ContainerSamples (R-1270 follow-up, fix A) reads each container of the stack: running, its RestartCount, its health
 // ("" without a healthcheck) — the stable-start rule's sample (backup.containerSampler). Read-only docker calls.
 func (a *stackAdapter) ContainerSamples(name string) ([]backup.ContainerSample, error) {
-	out, err := dockerexec.Command("docker", "ps", "-a", "-q", "--no-trunc", "--filter", "label=com.docker.compose.project="+name).Output()
+	run := func(args ...string) ([]byte, error) {
+		cmd := dockerexec.Command("docker", args...)
+		var stderr bytes.Buffer
+		cmd.Stderr = &stderr
+		out, err := cmd.Output()
+		if err != nil {
+			return nil, fmt.Errorf("docker %s: %v: %s", args[0], err, strings.TrimSpace(stderr.String()))
+		}
+		return out, nil
+	}
+	out, err := run("ps", "-a", "-q", "--no-trunc", "--filter", "label=com.docker.compose.project="+name)
 	if err != nil {
 		return nil, err
 	}
@@ -3454,8 +3465,7 @@ func (a *stackAdapter) ContainerSamples(name string) ([]backup.ContainerSample,
 	if len(ids) == 0 {
 		return nil, nil
 	}
-	args := append([]string{"inspect", "-f", "{{.Id}} {{.State.Status}} {{.RestartCount}} {{if .State.Health}}{{.State.Health.Status}}{{end}}"}, ids...)
+	out, err = run(append([]string{"inspect", "-f", "{{.Id}} {{.State.Status}} {{.RestartCount}} {{if .State.Health}}{{.State.Health.Status}}{{end}}"}, ids...)...)
-	out, err = dockerexec.Command("docker", args...).Output()
 	if err != nil {
 		return nil, err
 	}