[Bug]: Unhandled Docker stderr warnings break container inspection during network reachability check on ARM64 macOS

[shkatara]

Bug Description

When running vcluster create in Docker driver mode on ARM64 macOS (Apple Silicon), if Docker emits a platform architecture mismatch warning on stderr (e.g. when an amd64 alpine network test image is cached locally), vcluster captures the warning text along with the container ID.

vcluster then passes the multi-line string directly to docker inspect, causing a fatal crash with a confusing error: no such object: WARNING: ... error.

---

Environment

• vCluster CLI Version: v0.36.1
• OS / Arch: macOS (darwin/arm64)
• Docker Engine / Provider: OrbStack / Docker Desktop on Apple Silicon (linux/arm64/v8)

---

Steps to Reproduce

1. On an ARM64 Mac, pull or cache an amd64 alpine image:

   docker pull --platform linux/amd64 alpine

2. Run vcluster create:

   vcluster create demo

---

Actual Behavior

The command fails fatally with an unhelpful error message:

19:44:41 info Ensuring environment for vCluster demo...
19:44:42 fatal failed to configure network: failed to configure load balancer: failed to check if docker network is reachable: failed to inspect test network container: 
error: no such object: WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm64/v8) and no specific platform was requested
23e586d93b4ca2d51a8d21e27ad14807b1fefb4445adc275adcb03093a76b216
: exit status 1

---

Expected Behavior

1. vcluster should separate stdout (which contains the container ID) from stderr (which contains Docker warnings) when executing helper container commands.
2. vcluster should validate that captured container IDs match standard 12/64-character hex strings (^[a-f0-9]{12,64}$) before attempting docker inspect.
3. Optionally, vcluster should pass --platform matching the host architecture when spawning helper network test containers.

---

Suggested Fix

In the Docker network reachability checker package:

1. Use dedicated stdout and stderr buffers for exec.Command("docker", ...) rather than CombinedOutput().
2. Extract the container ID exclusively from stdout.
3. Provide a clear, actionable error message if container creation fails, guiding users on architecture mismatch issues.

[shkatara]

Issue Analysis & Technical Update

Gist & Problem Summary

When creating a virtual cluster in Docker driver mode, vcluster executes short-lived helper containers to perform pre-flight checks (verifying network reachability, detecting host DNS, and checking container sockets).

If a user's host has a non-native CPU architecture image cached locally (e.g. an amd64 helper image cached on an ARM64 Mac, or an arm64 helper image cached on an AMD64 Linux VM), Docker CLI outputs architecture mismatch warning messages:
WARNING: The requested image's platform does not match the detected host platform...

Because vcluster captured raw output expecting only container IDs, it prepended the warning text to the container ID string and attempted to inspect a container named WARNING: ..., causing a fatal crash:
fatal failed to configure network: failed to inspect test network container: error: no such object: WARNING: ...

---

Cross-Platform Empirical Verification

Testing confirmed this bug is cross-platform and impacts both ARM64 and AMD64 hosts:

• macOS ARM64 Host: Having an amd64 helper image cached locally crashes vcluster create.
• Linux AMD64 Host: Having an arm64 helper image cached locally crashes vcluster create.

---

High-Level Solution (PR Submitted)

1. Host-Native Platform Enforcement: Explicitly specify the host's native platform (linux/arm64 or linux/amd64) when invoking helper containers, ensuring Docker always pulls and executes native binaries without architecture mismatch warnings.
2. Robust Output Stream Isolation: Separate standard output from error streams and filter out system log prefixes (such as image pull progress or engine warnings) before parsing container IDs.