UN-3699 [FIX] Fix runner DockerException with requests>=2.32 by bumping docker-py to 7.1.0

[kirtimanmishrazipstack]

What

• Bump the runner's docker (docker-py) pin from 6.1.3 to 7.1.0 and regenerate runner/uv.lock.

Why

• Any runner image rebuilt from current main on the Docker container-client path crashes at DockerClient.from_env() with:
  docker.errors.DockerException: Error while fetching server API version: Not supported URL scheme http+docker
• Root cause: docker-py 6.1.3 is incompatible with requests>=2.32. A dependabot bump raised the transitive requests to 2.33.0 (hard-pinned ==2.33.0 by unstract-core; also required >=2.33.0 by workers / x2text-service). docker-py's UnixHTTPAdapter only overrides the old get_connection; requests 2.32+ walks get_connection_with_tls_context, so the internal http+docker:// socket URL reaches urllib3 → URLSchemeUnknown → InvalidURL.
• Only surfaces on a Docker-socket runner rebuilt from source: cloud/k8s uses the Kubernetes container client and never calls from_env(); other devs run older published runner images baked with requests<2.32. It is a latent bug on main for anyone who rebuilds runner.
• Lowering requests is unsatisfiable (other services require >=2.33.0), so the fix bumps the stale consumer instead.

How

• runner/pyproject.toml: docker==6.1.3 → docker==7.1.0.
• runner/uv.lock: regenerated — docker updated; websocket-client drops out (it is now an optional docker extra and the runner uses no websocket features).

Can this PR break any existing features. If yes, please list possible items. If no, please explain why.

• Low risk. The runner uses only stable high-level docker APIs (containers.run / containers.get, images.get, api.pull, container.logs(follow=True)), all unchanged in docker-py 7.x. It uses no exec_run / attach / websocket features, so dropping websocket-client is safe. The Kubernetes container-client path is untouched.

Database Migrations

• None.

Env Config

• None.

Relevant Docs

• docker-py 7.1.0 release notes (adds requests>=2.32 compatibility).

Related Issues or PRs

• UN-3699

Dependencies Versions

• docker (docker-py): 6.1.3 → 7.1.0

Notes on Testing

• Verified docker 7.1.0 + requests 2.33.0 → DockerClient.from_env().ping() == True against a real Docker socket; the runner boots and spawns tool containers again.

Screenshots

Checklist

I have read and understood the Contribution Guidelines.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b86ee6c7-766a-4a84-8a53-cf5193cce37d

📥 Commits

Reviewing files that changed from the base of the PR and between 913bb6a and e525106.

⛔ Files ignored due to path filters (1)

• runner/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• runner/pyproject.toml

---

Summary by CodeRabbit

• Chores
  • Updated a third-party dependency to a newer version for improved compatibility and maintenance.

Walkthrough

The docker dependency version in runner/pyproject.toml was bumped from 6.1.3 to 7.1.0.

Changes

Dependency Update

Layer / File(s)	Summary
Bump docker dependency version runner/pyproject.toml	Updated the docker package pin from 6.1.3 to 7.1.0 in the dependencies list.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and accurately summarizes the main change: bumping docker-py to fix the runner DockerException.
Description check	✅ Passed	The description follows the template and covers the required sections with concrete details on what, why, how, risks, testing, and related items.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch UN-3699-fix-runner-docker-py-compat

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Bumps docker (docker-py) from 6.1.3 to 7.1.0 in the runner to resolve a startup crash (DockerException: Not supported URL scheme http+docker) caused by docker-py 6.x being incompatible with requests>=2.32, which is now hard-pinned by other services in the monorepo.

• runner/pyproject.toml: single-line version pin update docker==6.1.3 → docker==7.1.0.
• runner/uv.lock: regenerated — docker's hashes updated, packaging removed from docker's transitive dep list (still present via other consumers), and websocket-client dropped as it is now an optional extra in docker-py 7.x and the runner does not use any websocket/attach features.

Confidence Score: 5/5

Safe to merge — this is a minimal targeted dependency fix with no code changes and a well-understood root cause.

Only two files change: a one-line version pin in pyproject.toml and the auto-regenerated runner/uv.lock. The high-level docker-py APIs used by the runner (containers.run, containers.get, images.get, api.pull, container.logs) are stable across 6.x to 7.x. The dropped websocket-client transitive dependency is confirmed unused by the runner. The fix directly unblocks a reproducible crash on main for anyone who rebuilds the runner image.

No files require special attention.

Important Files Changed

Filename	Overview
runner/pyproject.toml	Single-line version pin bump: docker==6.1.3 → docker==7.1.0; no other changes
runner/uv.lock	Lock file regenerated: docker entry updated to 7.1.0 with new sdist/wheel hashes; packaging removed from docker's dep list (still present via other packages); websocket-client entry dropped as it is now an optional docker extra unused by the runner

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["requests>=2.32 (required by unstract-core, workers, x2text-service)"]
    B["docker-py 6.1.3\nUnixHTTPAdapter overrides get_connection\n(old requests hook)"]
    C["docker-py 7.1.0\nUnixHTTPAdapter overrides get_connection_with_tls_context\n(requests>=2.32 compatible)"]
    D["DockerClient.from_env()"]
    E["http+docker:// → urllib3\nURLSchemeUnknown / InvalidURL\n💥 Crash"]
    F["Unix socket resolved correctly\n✅ Runner boots"]

    A --> B
    A --> C
    B --> D
    D --> E
    C --> D
    D --> F

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["requests>=2.32 (required by unstract-core, workers, x2text-service)"]
    B["docker-py 6.1.3\nUnixHTTPAdapter overrides get_connection\n(old requests hook)"]
    C["docker-py 7.1.0\nUnixHTTPAdapter overrides get_connection_with_tls_context\n(requests>=2.32 compatible)"]
    D["DockerClient.from_env()"]
    E["http+docker:// → urllib3\nURLSchemeUnknown / InvalidURL\n💥 Crash"]
    F["Unix socket resolved correctly\n✅ Runner boots"]

    A --> B
    A --> C
    B --> D
    D --> E
    C --> D
    D --> F

Loading

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into UN-3699-fix-run..." | Re-trigger Greptile}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Unstract test results

Per-group results

Status	Group	Tier	Passed	Failed	Errors	Skipped	Duration (s)
✅	integration-backend	integration	56	0	0	27	46.6
✅	integration-connectors	integration	1	0	0	7	8.2
✅	unit-backend	unit	118	0	0	0	22.5
✅	unit-connectors	unit	63	0	0	0	10.6
✅	unit-core	unit	27	0	0	0	1.4
✅	unit-platform-service	unit	9	0	0	0	1.4
✅	unit-rig	unit	69	0	0	0	3.7
✅	unit-sdk1	unit	381	0	0	0	23.7
⚪	unit-workers	unit	0	0	0	0	29.7
	TOTAL		724	0	0	34	147.8

Critical paths

⚠️ Critical paths not yet covered

• auth-login — User can log in and obtain a session cookie. (entry: POST /api/v1/auth/login; declared coverage: no groups declared)
• workflow-create-execute — Create a workflow, configure source+destination, execute, poll, fetch result. (entry: POST /api/v1/workflow/{id}/execute/; declared coverage: e2e-workflow)
• api-deployment-run — Deploy a workflow as an API, POST a document, receive structured JSON. (entry: POST /deployment/api/{org}/{name}/; declared coverage: e2e-api-deployment)
• prompt-studio-fetch-response — Prompt Studio: create project, add prompt, run single-pass, get response. (entry: POST /api/v1/prompt-studio/prompt-studio-tool/{id}/fetch_response/; declared coverage: e2e-prompt-studio)
• pipeline-etl-execute — Run an ETL pipeline from source connector to destination. (entry: POST /api/v1/pipeline/{id}/execute/; declared coverage: no groups declared)
• usage-token-tracking — Per-execution token usage is recorded and retrievable. (entry: GET /api/v1/usage/get_token_usage/; declared coverage: no groups declared)
• workflow-execution-fan-out — Multi-file workflow execution fans out to file-processing workers and rejoins. (entry: internal: backend → rabbitmq → workers/file_processing; declared coverage: no groups declared)
• callback-result-delivery — Async results are posted back via the callback worker. (entry: internal: workers/callback → backend /internal endpoints; declared coverage: no groups declared)

✅ Covered critical paths

• adapter-register-llm — covered by integration-backend