fix: harden Docker scan timeout and cancellation in LinuxContainerDetector

[AMaini503]

Problem

The CG task hangs indefinitely during Docker container scanning in CI pipelines (observed 31+ hours on Store.DevX.Nova.Prod). Despite existing timeout mechanisms (480s CLI timeout, per-detector CTS, 10-min detector timeout), the process gets stuck and never exits.

Root cause: Five \DockerService\ methods swallow \OperationCanceledException\ in their catch blocks, preventing CTS-based cancellation from propagating. When the timeout fires, each method catches the OCE, returns false/null, and execution continues to the next Docker call — which also swallows the OCE. The timeout chain is completely broken.

Changes

Fix: Stop swallowing cancellation (the actual bug)

• Add \cancellationToken.ThrowIfCancellationRequested()\ in catch blocks of 5 \DockerService\ methods: \CanPingDockerAsync, \CanRunLinuxContainersAsync, \ImageExistsLocallyAsync, \TryPullImageAsync, \InspectImageAsync\
• Move \CanRunLinuxContainersAsync\ call inside the try/catch in \LinuxContainerDetector.ExecuteDetectorAsync\ (was outside — OCE would escape to \DetectorProcessingService\ and crash the process)

Hardening: Belt-and-suspenders for Docker operations

• RemoveContainerAsync: \Task.WhenAny\ with 30s race timer in the finally block — if remove hangs, we abandon and move on
• stream.Dispose(): Fire-and-forget via \Task.Run\ — if the underlying \socket.Close()\ blocks (Docker daemon in D-state), we don't hang

Diagnostics: Instrumentation for future investigation

• Telemetry flush (\TelemetryRelay.FlushCurrentTelemetry()) before \ReadContainerOutputAsync\ — ensures telemetry is durable before the riskiest operation
• Heartbeat timer (60s interval) in \LinuxContainerDetector\ — confirms process liveness; if heartbeats stop, process died
• ILogger breadcrumbs for container start, removal, and cleanup completion

Scope

All changes are scoped to \LinuxContainerDetector, \LinuxScanner, and \DockerService. No changes to \DetectorProcessingService\ or other detectors.

Testing

• \Microsoft.ComponentDetection.Common.Tests: 214 passed, 0 failed
• Local Docker scan with timeout: exits cleanly

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂

[Copilot]

Pull request overview

Hardens Linux container image scanning to avoid indefinite hangs by improving cancellation propagation in Docker interactions and adding additional diagnostics around long-running operations.

Changes:

• Ensure DockerService methods propagate CTS cancellation by re-throwing when the provided cancellation token is canceled.
• Add a periodic heartbeat log and move CanRunLinuxContainersAsync into the detector try/catch to avoid process crashes on cancellation.
• Add telemetry “checkpoint” flushing and additional best-effort time-bounded container cleanup safeguards.

Show a summary per file

File	Description
src/Microsoft.ComponentDetection.Detectors/linux/LinuxContainerDetector.cs	Adds heartbeat logging and adjusts cancellation handling scope around Docker availability checks.
src/Microsoft.ComponentDetection.Common/Telemetry/TelemetryRelay.cs	Introduces FlushCurrentTelemetry() to flush buffered telemetry without shutting down.
src/Microsoft.ComponentDetection.Common/DockerService.cs	Improves cancellation propagation, adds telemetry flush call before reading container output, and hardens cleanup/stream disposal.

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 4

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.0%. Comparing base (7ce401b) to head (d365d19).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@     Coverage Diff      @@
##   main   #1798   +/-   ##
============================
============================

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.