[Containerapp] Secure Docker executable resolution

[Greedygre (Greedygre)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes
️✔️ None

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az containerapp up --source <path> --registry-server <registry>.azurecr.io

az containerapp patch list|apply|interactive

On Windows, launching Docker by a bare executable name can select an untrusted docker.exe from the current working directory. This change uses Azure CLI Core's get_safe_executable_path("docker") helper and passes its absolute result to every local Docker subprocess used by the buildpack and patch flows.

The ACR login retry receives the same resolved path through DOCKER_COMMAND. Its temporary environment and command_kwargs changes are restored exactly, including removing keys that were originally absent.

This PR depends on the Azure CLI Core release containing Azure/azure-cli#34212. The Containerapp minimum Core version remains unchanged for now and must be updated to that released version before this PR is merged.

Validation:

• Containerapp unit tests against Azure CLI Core dev commit 5f64a805d8: passed, 36 tests.
• Core TestSafeExecutablePath: passed, 5 tests.
• Pylint checks excluding unavailable local import dependencies: passed, 10.00/10.
• Flake8, Python py_compile, and git diff --check: passed.
• python scripts/ci/test_index.py -q: passed, 9 tests with 2 skipped.

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
  • The local azdev environment is not configured. Equivalent pylint and flake8 checks passed against the Core dev source.
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
• My extension version conforms to the Extension version schema
  • No extension version change is included in this PR.

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.
  • N/A: containerapp is an existing extension.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

This PR intentionally does not change the extension version or src/index.json.

[Copilot]

🟡 Changes recommended

ACR retry cleanup does not fully restore command state when overridden keys were initially absent.

1 open finding

• Restore absent command keys by removing them, not setting None · New

What changed in this PR

Secures Docker invocation by resolving and validating an absolute executable path.

Changes:

• Adds trusted Docker path resolution for build and patch flows.
• Pins Docker for ACR login retries and restores temporary state.
• Adds unit tests and release notes.

File	Description
HISTORY.rst	Documents Docker path hardening.
test_utils.py	Tests path resolution and push behavior.
test_containerapp_patch_unit.py	Tests patch Docker invocation.
custom.py	Uses resolved Docker path for patches.
_utils.py	Resolves and validates Docker paths.
_up_utils.py	Uses the path for pushes and ACR retries.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[x-engineering-agent]

Hi Greedygre (@Greedygre),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[Yong Zhang (yonzhan)]

containerapp