Container-aware device identity: inject host device_id + namespace home_user per container

[sumit-badsara]

What

Makes containers report a stable, non-fragmenting identity to the discovery backend — no backend change. Three commits:

1. Inject host device_id. get_device_id() prefers an injected UNBOUND_DEVICE_SERIAL (validated via is_valid_serial()) so a container reports the host device instead of its ephemeral hostname.
2. Log the decision branch. logger.info when the injected serial is accepted, logger.warning when present-but-invalid — so the attribution path is reconstructable from logs.
3. Container-aware gating + per-container profiles (this update):
   • Gate the override on container detection. The injected serial is only honored when in_container() is true, so a stray UNBOUND_DEVICE_SERIAL on a native host can't mask the real auto-detected serial. in_container() combines /.dockerenv, /run/.containerenv, an overlay root mount, and a cgroup-v1 fallback (cgroup v2 shows 0::/ from inside, so the classic /proc/1/cgroup grep alone is unreliable).
   • Namespace home_user per container. All containers on a host share the one injected device_id, and the backend's report-ingest replace key is (device, tool_name, home_user). A plain home_user (ubuntu/root, fixed per image) therefore makes concurrent containers clobber each other's tool data. Inside a container, the report now sends home_user = "<container_id>_<home_user>", giving each container a distinct profile under the shared device. Native hosts are unaffected (home_user stays the real username).

Why

A container is ephemeral. get_device_id() auto-detects the host serial with a hostname fallback; inside a Linux container the Mac serial is unreadable, so it falls back to the per-launch container hostname → a new "device" every launch. Injecting the host serial collapses them onto one device. But once collapsed, multiple containers collide on (device, tool_name, home_user) and overwrite each other — so home_user is namespaced per container to keep distinct profiles without re-fragmenting the device.

container_id resolution & the stability trade-off

get_container_id() resolves to:

1. Injected UNBOUND_CONTAINER_ID — the stable path. The host can derive this from the workspace / devcontainer name so a restarted workspace keeps a single profile (clean upsert).
2. Container hostname — the ephemeral fallback. Unique per docker run, so the same workspace restarted under a fresh hostname creates a new profile (old ones linger). Acceptable for one-shot containers; set UNBOUND_CONTAINER_ID for long-lived / restarted workspaces.

Safety / scope

• All behavior is container-only; native hosts auto-detect their serial and keep a plain home_user.
• No backend change — device_id is already the attribution key, and home_user is passed through verbatim by the ingest path.

Tests

tests/test_device_id_override.py (12 cases): override honored only in-container, ignored on native host, invalid/empty fall through; home_user namespaced in-container and untouched on host; two containers on one device get distinct profiles; in_container() / get_container_id() primitives.

Full suite: 833 passed, 1 skipped. Validated end-to-end in a real OrbStack Ubuntu container against staging (injection honored + container detected; no-injection baseline falls back to hostname).

🤖 Generated with Claude Code

Greptile Summary

This PR makes the discovery tool container-aware: get_device_id() now prefers an injected host serial (UNBOUND_DEVICE_SERIAL) only when running inside a container, and generate_single_tool_report() namespaces home_user with the container ID so concurrent containers on the same host don't clobber each other's backend profile (the ingest replace key is (device, tool_name, home_user)).

• utils.py adds in_container() (multi-signal: dockerenv, overlay mount, cgroup-v1 markers; process-lifetime lru_cache) and get_container_id() (injected env var with hostname fallback).
• ai_tools_discovery.py wires both helpers into get_device_id() (with info/warning logging for each branch) and into generate_single_tool_report() for home_user namespacing.
• 12 new tests cover the override gating, namespacing, distinct-profile guarantee, and helper primitives.

Confidence Score: 5/5

Safe to merge — all new behaviour is gated behind container detection, native hosts are entirely unaffected, and the logic is well-tested.

The container-gating logic is correct and well-covered by tests. Native host code paths are unchanged. The only gap is that the home_user namespacing branch produces no log line when it fires, making post-hoc attribution debugging harder — but this does not affect correctness.

No files require special attention; the single observation is in ai_tools_discovery.py around the home_user namespacing block.

Important Files Changed

Filename	Overview
scripts/coding_discovery_tools/ai_tools_discovery.py	Added container-aware get_device_id() (honors UNBOUND_DEVICE_SERIAL only inside a container, with info/warning logging) and home_user namespacing in generate_single_tool_report() (prepends container ID to prevent profile collisions). The namespacing branch is silent — unlike the device_id path, it emits no log when activated.
scripts/coding_discovery_tools/utils.py	Added in_container() (multi-signal: dockerenv, containerenv, overlay root mount, cgroup-v1 markers; lru_cache-d) and get_container_id() (UNBOUND_CONTAINER_ID env var with hostname fallback; lru_cache-d). Logic is well-documented and correctly handles macOS/Windows by catching all OSError.
tests/test_device_id_override.py	New test file with 12 cases covering serial override (in-container vs native host, valid vs invalid vs missing), home_user namespacing (native unchanged, container namespaced, two containers get distinct profiles), and in_container()/get_container_id() primitives. Cache teardown is correctly handled in setUp/tearDown.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[get_device_id called] --> B{UNBOUND_DEVICE_SERIAL set?}
    B -- No --> Z[auto-detect via extractor]
    B -- Yes --> C{in_container?}
    C -- No --> D[logger.info: env var present but not in container\nauto-detect instead]
    D --> Z
    C -- Yes --> E{is_valid_serial?}
    E -- No --> F[logger.warning: invalid serial\nfalling back]
    F --> Z
    E -- Yes --> G[logger.info: using injected serial\nreturn injected value]

    H[generate_single_tool_report called] --> I{home_user set AND in_container?}
    I -- No --> J[report_home_user = home_user unchanged]
    I -- Yes --> K[container_id = get_container_id\nreport_home_user = container_id + _ + home_user]
    J --> L[build report dict]
    K --> L

Loading

_{Reviews (4): Last reviewed commit: "Gate device override on container detect..." | Re-trigger Greptile}