Repository: containerd/nerdctl

Issue:
[CI]: TestContainerHealthCheckAdvance is flaky
### Description

https://github.com/containerd/nerdctl/actions/runs/15811078048/job/44562430914?pr=4327

```
        +------------------------------------------------------------------------------------------------------------+
        | ➡️      | ⚙️ C:\Users\runneradmin\go\bin\nerdctl.exe container inspect testcontainerhealthcheckadvance-hea |
        |         | lthcheck-using-cmd-shell-format-b70c8418                                                         |
        +------------------------------------------------------------------------------------------------------------+
        |         | Actual content is 147 lines long and has been abbreviated to 50
         |
        |         |                                                                                                  |
        |         | 🟢 [                                                                                             |
        |         |     {                                                                                            |
        |         |         "Id": "2cb068792e63e09b0ca9b6e19af60a5518853d56498a0187bd02384b407df8e8",                |
        |         |         "Created": "2025-06-22T21:51:07.1924498Z",                                               |
        |         |         "Path": "cmd.exe",                                                                       |
        |         |         "Args": [                                                                                |
        |         |             "/s",                                                                                |
        |         |             "/c",                                                                                |
        |         |             "sleep",                                                                             |
        |         |             "3600"                                                                               |
        |         |         ],                                                                                       |
        |         |         "State": {                                                                               |
        |         | ... 97 lines are being ignored...                                                                |
        |         |                 "image_version": "1.36.1-1",                                                     |
        |         |                 "io.containerd.image.config.stop-signal": "SIGTERM",                             |
        |         |                 "nerdctl/auto-remove": "false",                                                  |
        |         |                 "nerdctl/dns": "{\"DNSServers\":null,\"DNSResolvConfOptions\":null,\"DNSSearchDo |
        |         | mains\":null}",                                                                                  |
        |         |                 "nerdctl/extraHosts": "[]",                                                      |
        |         |                 "nerdctl/healthcheck": "{\"Test\":[\"CMD-SHELL\",\"echo shell-format\"],\"Interv |
        |         | al\":1000000000}",                                                                               |
        |         |                 "nerdctl/healthstate": "{\"Status\":\"healthy\",\"FailingStreak\":0}",           |
        |         |                 "nerdctl/host-config": "{\"BlkioWeight\":0,\"CidFile\":\"\",\"Devices\":null}",  |
        |         |                 "nerdctl/log-config": "{\"driver\":\"json-file\",\"address\":\"\\\\\\\\.\\\\pipe |
        |         | \\\\containerd-containerd\"}",                                                                   |
        |         |                 "nerdctl/log-uri": "binary:///C:/Users/runneradmin/go/bin/nerdctl.exe?_NERDCTL_I |
        |         | NTERNAL_LOGGING=C%3A%5CProgramData%5Cnerdctl%5C052055e3",                                        |
        |         |                 "nerdctl/name": "testcontainerhealthcheckadvance-healthcheck-using-cmd-shell-for |
        |         | mat-b70c8418",                                                                                   |
        |         |                 "nerdctl/namespace": "nerdctl-test",                                             |
        |         |                 "nerdctl/network-namespace": "5aa2c098-2534-43b1-b008-38abf9946b7c",             |
        |         |                 "nerdctl/networks": "[\"nat\"]",                                                 |
        |         |                 "nerdctl/platform": "windows(10.0.20348)/amd64",                                 |
        |         |                 "nerdctl/state-dir": "C:\\ProgramData\\nerdctl\\052055e3\\containers\\nerdctl-te |
        |         | st\\2cb068792e63e09b0ca9b6e19af60a5518853d56498a0187bd02384b407df8e8",                           |
        |         |                 "nerdctl/user": "ContainerAdministrator"                                         |
        |         |             }                                                                                    |
        |         |         },                                                                                       |
        |         |         "NetworkSettings": {                                                                     |
        |         |             "Ports": {},                                                                         |
        |         |             "GlobalIPv6Address": "",                                                             |
        |         |             "GlobalIPv6PrefixLen": 0,                                                            |
        |         |             "IPAddress": "",                                                                     |
        |         |             "IPPrefixLen": 0,                                                                    |
        |         |             "MacAddress": "",                                                                    |
        |         |             "Networks": {}                                                                       |
        |         |         }                                                                                        |
        |         |     }                                                                                            |
        |         | ]                                                                                                |
        |         |                                                                                                  |
        +------------------------------------------------------------------------------------------------------------+
        | 🌱      | APPDATA=C:\Users\runneradmin\AppData\Roaming                                                     |
        |         | HOME=C:\Users\runneradmin                                                                        |
        |         | PROGRAMFILES=C:\Program Files                                                                    |
        |         | ProgramData=C:\ProgramData                                                                       |
        |         | ProgramFiles(x86)=C:\Program Files (x86)                                                         |
        |         | ProgramW6432=C:\Program Files                                                                    |
        |         | PATH=C:\hostedtoolcache\windows\go\1.24.4\x64\bin;C:\Program Files\Git\mingw64\bin;C:\Program Fi |
        |         | les\Git\usr\bin;C:\Users\runneradmin\bin;C:\Users\runneradmin\go\bin;C:\hostedtoolcache\windows\ |
        |         | go\1.24.4\x64\bin;C:\Program Files\MongoDB\Server\5.0\bin;C:\aliyun-cli;C:\vcpkg;C:\Program File |
        |         | s (x86)\NSIS;C:\tools\zstd;C:\Program Files\Mercurial;C:\hostedtoolcache\windows\stack\3.5.1\x64 |
        |         | ;C:\cabal\bin;C:\ghcup\bin;C:\mingw64\bin;C:\Program Files\dotnet;C:\Program Files\MySQL\MySQL S |
        |         | erver 8.0\bin;C:\Program Files\R\R-4.4.2\bin\x64;C:\SeleniumWebDrivers\GeckoDriver;C:\SeleniumWe |
        |         | bDrivers\EdgeDriver;C:\SeleniumWebDrivers\ChromeDriver;C:\Program Files (x86)\sbt\bin;C:\Program |
        |         |  Files (x86)\GitHub CLI;C:\Program Files\Git\usr\bin;C:\Program Files (x86)\pipx_bin;C:\npm\pref |
        |         | ix;C:\hostedtoolcache\windows\go\1.24.4\x64\bin;C:\hostedtoolcache\windows\Python\3.9.13\x64\Scr |
        |         | ipts;C:\hostedtoolcache\windows\Python\3.9.13\x64;C:\hostedtoolcache\windows\Ruby\3.3.8\x64\bin; |
        |         | C:\Program Files\OpenSSL\bin;C:\tools\kotlinc\bin;C:\hostedtoolcache\windows\Java_Temurin-Hotspo |
        |         | t_jdk\8.0.452-9\x64\bin;C:\Program Files\ImageMagick-7.1.1-Q16-HDRI;C:\Program Files\Microsoft S |
        |         | DKs\Azure\CLI2\wbin;C:\ProgramData\kind;C:\ProgramData\Chocolatey\bin;C:\Windows\system32;C:\Win |
        |         | dows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Windows\System32\Ope |
        |         | nSSH;C:\Program Files\dotnet;C:\Program Files\PowerShell\7;C:\Program Files\Microsoft\Web Platfo |
        |         | rm Installer;C:\Program Files\TortoiseSVN\bin;C:\Program Files\Microsoft SQL Server\Client SDK\O |
        |         | DBC\170\Tools\Binn;C:\Program Files\Microsoft SQL Server\150\Tools\Binn;C:\Program Files (x86)\W |
        |         | indows Kits\10\Windows Performance Toolkit;C:\Program Files (x86)\WiX Toolset v3.14\bin;C:\Progr |
        |         | am Files\Microsoft SQL Server\130\DTS\Binn;C:\Program Files\Microsoft SQL Server\140\DTS\Binn;C: |
        |         | \Program Files\Microsoft SQL Server\150\DTS\Binn;C:\Program Files\Microsoft SQL Server\160\DTS\B |
        |         | inn;C:\Strawberry\c\bin;C:\Strawberry\perl\site\bin;C:\Strawberry\perl\bin;C:\ProgramData\chocol |
        |         | atey\lib\pulumi\tools\Pulumi\bin;C:\Program Files\CMake\bin;C:\ProgramData\chocolatey\lib\maven\ |
        |         | apache-maven-3.9.10\bin;C:\Program Files\Microsoft Service Fabric\bin\Fabric\Fabric.Code;C:\Prog |
        |         | ram Files\Microsoft SDKs\Service Fabric\Tools\ServiceFabricLocalClusterManager;C:\Program Files\ |
        |         | nodejs;C:\Program Files\Git\cmd;C:\Program Files\Git\mingw64\bin;C:\Program Files\Git\usr\bin;C: |
        |         | \Program Files\GitHub CLI;C:\tools\php;C:\Program Files (x86)\sbt\bin;C:\Program Files\Amazon\AW |
        |         | SCLIV2;C:\Program Files\Amazon\SessionManagerPlugin\bin;C:\Program Files\Amazon\AWSSAMCLI\bin;C: |
        |         | \Program Files\Microsoft SQL Server\130\Tools\Binn;C:\Program Files\LLVM\bin;C:\Users\runneradmi |
        |         | n\.dotnet\tools;C:\Users\runneradmin\.cargo\bin;C:\Users\runneradmin\AppData\Local\Microsoft\Win |
        |         | dowsApps                                                                                         |
        |         | DOCKER_CONFIG=C:\Users\RUNNER~1\AppData\Local\Temp\TestContainerHealthCheckAdvanceHealthcheck_us |
        |         | ing_CMD-SHELL_format2540991560\003                                                               |
        |         | NERDCTL_TOML=C:\Users\RUNNER~1\AppData\Local\Temp\TestContainerHealthCheckAdvanceHealthcheck_usi |
        |         | ng_CMD-SHELL_format2540991560\003\nerdctl.toml                                                   |
        |         | SYSTEMROOT=C:\Windows                                                                            |
        +------------------------------------------------------------------------------------------------------------+
        | ⏰      | <1s (limit: 3m0s)                                                                                |
        +------------------------------------------------------------------------------------------------------------+
        | 📁      | C:\Users\RUNNER~1\AppData\Local\Temp\TestContainerHealthCheckAdvanceHealthcheck_using_CMD-SHELL_ |
        |         | format2540991560\002                                                                             |
        +------------------------------------------------------------------------------------------------------------+
        
    container_health_check_test.go:299: assertion failed: expression is false: strings.Contains(h.Log[0].Output, "shell-format")
```

### Steps to reproduce the issue

_No response_

### Describe the results you received and expected

Not flake.

### What version of nerdctl are you using?

main

### Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

### Host information

_No response_

Hints from issue comments:
@apostasie: Thought necessary, the patch did not fully fix the issue.
Adding additional debug info to the test.

Solution patch:
diff --git a/.github/workflows/job-test-in-container.yml b/.github/workflows/job-test-in-container.yml
index 2257de51..32a00888 100644
--- a/.github/workflows/job-test-in-container.yml
+++ b/.github/workflows/job-test-in-container.yml
@@ -81,6 +81,8 @@ jobs:
           docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
       - if: ${{ inputs.canary }}
         name: "Init (canary): prepare updated test image"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           . ./hack/build-integration-canary.sh
           canary::build::integration
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1881d185..55cf5511 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,6 +33,8 @@ jobs:
         go-version: "1.24"
         check-latest: true
     - name: "Compile binaries"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: make artifacts
     - name: "SHA256SUMS"
       run: |
diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index 526d19ca..b11d4578 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -102,7 +102,7 @@ jobs:
             canary: true
 
     with:
-      timeout: 45
+      timeout: 60
       runner: ${{ matrix.runner }}
       target: ${{ matrix.target }}
       binary: ${{ matrix.binary && matrix.binary || 'nerdctl' }}



Test patch:
diff --git a/cmd/nerdctl/container/container_health_check_test.go b/cmd/nerdctl/container/container_health_check_test.go
index 66d60e30..76a27db5 100644
--- a/cmd/nerdctl/container/container_health_check_test.go
+++ b/cmd/nerdctl/container/container_health_check_test.go
@@ -50,6 +50,7 @@ func TestContainerHealthCheckBasic(t *testing.T) {
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("run", "-d", "--name", data.Identifier(),
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -67,6 +68,7 @@ func TestContainerHealthCheckBasic(t *testing.T) {
 					"--health-interval", "45s",
 					"--health-timeout", "30s",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -95,6 +97,7 @@ func TestContainerHealthCheckBasic(t *testing.T) {
 					"--health-cmd", "echo healthy",
 					"--health-interval", "3s",
 					testutil.CommonImage, "sleep", "2")
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 				helpers.Ensure("stop", data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
@@ -140,6 +143,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-timeout", "2s",
 					"--health-interval", "1s",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -170,6 +174,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-interval", "1s",
 					"--health-retries", "2",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -204,6 +209,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-start-period", "5s",
 					"--health-retries", "2",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -232,6 +238,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-interval", "1s",
 					"--health-retries", "1",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -257,6 +264,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 			Setup: func(data test.Data, helpers test.Helpers) {
 				helpers.Ensure("run", "-d", "--name", data.Identifier(),
 					"--no-healthcheck", testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -280,6 +288,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 				helpers.Ensure("run", "-d", "--name", data.Identifier(),
 					"--health-cmd", "echo shell-format", "--health-interval", "1s",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -310,6 +319,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-interval", "1s",
 					"--health-timeout", "1s",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -340,6 +350,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-interval", "1s",
 					"--health-timeout", "1s",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -368,6 +379,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-cmd", "yes X | head -c 60000",
 					"--health-interval", "1s", "--health-timeout", "2s",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -403,6 +415,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-interval", "1s",
 					"--health-retries", "1",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -434,6 +447,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-cmd", "yes X | head -c 1048576", // 1MB output
 					"--health-interval", "1s", "--health-timeout", "2s",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -466,6 +480,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-timeout", "10s",
 					"--health-retries", "3",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -497,6 +512,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 					"--health-cmd", "ls /foo || exit 1", "--health-retries", "2",
 					"--health-start-period", "30s", // long enough to stay in "starting"
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())
@@ -528,6 +544,7 @@ func TestContainerHealthCheckAdvance(t *testing.T) {
 				helpers.Ensure("run", "-d", "--name", data.Identifier(),
 					"--health-cmd", "ls || exit 1", "--health-retries", "2",
 					testutil.CommonImage, "sleep", nerdtest.Infinity)
+				nerdtest.EnsureContainerStarted(helpers, data.Identifier())
 			},
 			Cleanup: func(data test.Data, helpers test.Helpers) {
 				helpers.Anyhow("rm", "-f", data.Identifier())