kitchen-docker 3.4.0 → 3.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7cacd3efc6d10490456e00f5d077a3a1eb8f96bb5aef71c6c93b8d2044823a1f
-  data.tar.gz: f6c3337ecdc3da7c134da8506472e7237b85a9784dd63fb5b46fa996303539b6
+  metadata.gz: 2d994f876f76b4950f4f85521fba2ed15fe2ed54d06b9993d464a578f2fd9c69
+  data.tar.gz: d942290a8f115d5b0937421b747ec3f413e180fd55cfc8af245524b8337b27d5
 SHA512:
-  metadata.gz: ec737baa038bf371481c82599263ed09cf98921f687da8cb45e52f1becd13d75417fb545d72338806c533dee99d4b1a39d4c47618e8c15709487937557c30c75
-  data.tar.gz: e8434376fb8dd607f224de53137d18ee4f9c644c1205b7341cbe3bcc43c7c07ad2aa575fb0ba5cdc7350ee721d6b0fcf6cb781f73421b2251cbfede68f154a0d
+  metadata.gz: 7db4fee864798aa758a3e253f433db4e120d7247e8b5125e34764cf393f4836c9885eb3df2eff767501a6910c2f895b4efab467b8a24f7e1ad6120cc58eeede2
+  data.tar.gz: f80f60d52168ea008378af1cb66530136bf1e53b6474b75877a9275ff336f0ae632f754833f3e3db7aadd2c0f3910d64269fd39be0bb3a90baf5367d6708f115

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.4.0"
+  ".": "3.4.1"
 }

data/CHANGELOG.md

@@ -6,6 +6,15 @@ Future CHANGELOG notes will be in GitHub release notes
 
 * Docs: document the last four options and split contributor docs ([#463](https://github.com/test-kitchen/kitchen-docker/pull/463)) ([4818bce](https://github.com/test-kitchen/kitchen-docker/commit/4818bce))
 
+## [3.4.1](https://github.com/test-kitchen/kitchen-docker/compare/v3.4.0...v3.4.1) (2026-08-30)
+
+
+### Bug Fixes
+
+* quote container paths interpolated into docker exec command lines ([#496](https://github.com/test-kitchen/kitchen-docker/issues/496)) ([ae3a754](https://github.com/test-kitchen/kitchen-docker/commit/ae3a754046cdb7c6d9fdb8622a6cef818643ad56))
+* read the image id from a quiet build ([#489](https://github.com/test-kitchen/kitchen-docker/issues/489)) ([ddc58b5](https://github.com/test-kitchen/kitchen-docker/commit/ddc58b50a16b7236ed047071228f5641092060a1))
+* report this gem's own version to kitchen diagnose ([#490](https://github.com/test-kitchen/kitchen-docker/issues/490)) ([e28171d](https://github.com/test-kitchen/kitchen-docker/commit/e28171d268ab0a4950c0d553fcee12688663e626))
+
 ## [3.4.0](https://github.com/test-kitchen/kitchen-docker/compare/v3.3.5...v3.4.0) (2026-08-23)
 
 

data/README.md

@@ -205,7 +205,7 @@ platforms:
 | `dockerfile` | *(none)* | Path to your own Dockerfile, used instead of the generated one. Rendered as [ERB](#using-a-custom-dockerfile). |
 | `build_context` | `true` locally, `false` for a remote daemon | Send the working directory to the daemon as build context. Required for `ADD` and `COPY`; slow against a remote daemon. |
 | `build_options` | *(none)* | Extra flags for `docker build`, as a string or a map. |
-| `build_tempdir` | working directory | Where the generated Dockerfile is written, relative to `build_context`. |
+| `build_tempdir` | working directory | Directory the generated Dockerfile is written to. A relative path is resolved against the working directory, and the path must be inside the build context, since `docker build -f` is given it relative to the working directory. |
 | `use_cache` | `true` | Use Docker's build cache. `false` adds `--no-cache`. |
 | `remove_images` | `false` | Remove the built image on `kitchen destroy`. |
 | `package_name` | the instance name, tagged `latest` | Image `kitchen package` commits the container to. |
@@ -237,7 +237,9 @@ platforms:
 | `tty` | `false` | Pass `-t`, allocating a pseudo-TTY. |
 | `env_variables` | *(none)* | Environment variables set in the container, as a map. |
 | `wait_for_transport` | `true` | Wait for the transport to answer before converging. Set `false` for containers that do not stay up. |
-| `detach` | `false` | Run provisioner commands with `docker exec -d`, returning immediately instead of waiting for them. The container itself is always started detached, regardless of this setting, and `kitchen login` ignores it so the shell stays usable. |
+
+The container itself is always started detached — see [`detach`](#transport-configuration)
+under the transport for how provisioner commands are run.
 
 ### Networking
 
@@ -314,6 +316,7 @@ These options go under `transport:`, not `driver:`.
 | `working_dir` | *(none)* | Working directory inside the container (`-w`). |
 | `temp_dir` | `/tmp`, or `$env:TEMP` on Windows | Directory used to stage uploaded files. |
 | `env_variables` | *(none)* | Environment variables for each command. |
+| `detach` | `false` | Run provisioner commands with `docker exec -d`, returning immediately instead of waiting for them to finish. `kitchen login` ignores it, so the shell stays usable. |
 | `privileged` | `false` | Run commands with `--privileged`. |
 | `interactive` | `false` | Pass `-i`. |
 | `tty` | `false` | Pass `-t`. |

data/lib/kitchen/docker/container/linux.rb

@@ -84,7 +84,10 @@ module Kitchen
           debug("Executing temp script #{remote_path}/#{filename} on container")
           remote_path = replace_env_variables(@config, remote_path)
 
-          container_exec(@config, "/bin/bash #{remote_path}/#{filename}")
+          # Escaped because the exec command line is assembled as one string:
+          # a temp_dir with a space in it was split before docker saw it, and
+          # bash was handed the first half of the directory as the script.
+          container_exec(@config, "/bin/bash #{Shellwords.escape("#{remote_path}/#{filename}")}")
         rescue => e
           raise "Failed to execute command on Linux container. #{e}"
         ensure

data/lib/kitchen/docker/container/windows.rb

@@ -69,7 +69,11 @@ module Kitchen
           # Replace any environment variables used in the path and execute script file
           debug("Executing temp script #{remote_path}\\#{filename} on container")
           remote_path = replace_env_variables(@config, remote_path)
-          cmd = build_powershell_command("-File #{remote_path}\\#{filename}")
+          # Quoted because PowerShell's -File takes exactly one argument. An
+          # unquoted path with a space in it -- which $env:TEMP has whenever the
+          # user's name does -- left PowerShell looking for a script named
+          # after the first word of the directory.
+          cmd = build_powershell_command(%{-File "#{remote_path}\\#{filename}"})
 
           container_exec(@config, cmd)
         rescue => e

data/lib/kitchen/docker/docker_version.rb

@@ -18,6 +18,6 @@ module Kitchen
   # Everything belonging to the kitchen-docker plugin.
   module Docker
     # The version of the kitchen-docker gem.
-    DOCKER_VERSION = "3.4.0".freeze
+    DOCKER_VERSION = "3.4.1".freeze
   end
 end

data/lib/kitchen/docker/helpers/cli_helper.rb

@@ -107,7 +107,7 @@ module Kitchen
         # @param cmd [String] the command to run
         # @param options [Hash] shell-out options
         # @return [String] combined stdout and stderr
-        # @raise [Kitchen::ShellCommandFailed] if the command exits non-zero
+        # @raise [Kitchen::ShellOut::ShellCommandFailed] if the command exits non-zero
         def run_command(cmd, options = {})
           if options.fetch(:use_sudo, false)
             cmd = "#{options.fetch(:sudo_command, "sudo -E")} #{cmd}"

data/lib/kitchen/docker/helpers/container_helper.rb

@@ -155,6 +155,17 @@ module Kitchen
 
         # Creates a directory inside the container, on Linux or Windows.
         #
+        # The path is escaped for the shell, because it comes from the
+        # transport's +temp_dir+ and a `docker exec` command line is assembled
+        # as one string. A directory with a space in it was torn in two before
+        # docker ever saw it, and `mkdir -p` obligingly created both halves --
+        # neither of them the directory that was asked for. Every upload that
+        # followed then went to a path that did not exist.
+        #
+        # The PowerShell branch already quotes the path itself, and its
+        # argument is reassembled by PowerShell rather than split by a shell,
+        # so it is left as it is.
+        #
         # @param state [Hash] instance state naming the container
         # @param path [String] the directory to create; environment variable
         #   references are expanded first
@@ -162,7 +173,7 @@ module Kitchen
         # @raise [RuntimeError] if the directory cannot be created
         def create_dir_on_container(state, path)
           path = replace_env_variables(state, path)
-          cmd = "mkdir -p #{path}"
+          cmd = "mkdir -p #{Shellwords.escape(path)}"
 
           if state[:platform].include?("windows")
             psh = "-Command if(-not (Test-Path '#{path}')) { New-Item -Path '#{path}' -Force }"

data/lib/kitchen/docker/helpers/image_helper.rb

@@ -27,6 +27,9 @@ module Kitchen
         include Kitchen::Docker::Helpers::CliHelper
         include Kitchen::Docker::Helpers::ContainerHelper
 
+        # An id on a line of its own, which is all `docker build -q` prints.
+        QUIET_BUILD_IMAGE_ID = /\A(sha256:[[:xdigit:]]{64})\z/
+
         # Pulls the built image's id out of `docker build` output.
         #
         # Scanned in reverse, and against several patterns, because the wording has
@@ -37,6 +40,13 @@ module Kitchen
         # @raise [Kitchen::ActionFailed] if no id could be found
         def parse_image_id(output)
           output.split("\n").reverse_each do |line|
+            line = line.strip
+            # `docker build -q` prints the id and nothing else -- none of the
+            # wording below appears -- so a build with `build_options: -q` had
+            # no line any of these matched and failed with "Could not parse
+            # Docker build output for image ID" (#225).
+            return Regexp.last_match(1) if line.match(QUIET_BUILD_IMAGE_ID)
+
             if line =~ /writing image (sha256:[[:xdigit:]]{64})(?: \d*\.\ds)? done/i
               img_id = line[/writing image (sha256:[[:xdigit:]]{64})(?: \d*\.\ds)? done/i, 1]
               return img_id

data/lib/kitchen/driver/docker.rb

@@ -23,6 +23,7 @@ require "kitchen/driver/base"
 
 require_relative "../docker/container/linux"
 require_relative "../docker/container/windows"
+require_relative "../docker/docker_version"
 require_relative "../docker/helpers/cli_helper"
 require_relative "../docker/helpers/container_helper"
 
@@ -37,6 +38,13 @@ module Kitchen
       include Kitchen::Docker::Helpers::ContainerHelper
       include ShellOut
 
+      # Reported by `kitchen diagnose`, which is what a bug report is asked to
+      # include. The version is this gem's own: the transport used to report
+      # Kitchen::VERSION, which is Test Kitchen's, so a diagnose said the
+      # plugin was at whatever version Test Kitchen happened to be.
+      kitchen_driver_api_version 2
+      plugin_version Kitchen::Docker::DOCKER_VERSION
+
       default_config :binary,        "docker"
       default_config :build_options, nil
       default_config :build_tempdir, Dir.pwd

data/lib/kitchen/transport/docker.rb

@@ -15,6 +15,7 @@ require "kitchen"
 
 require_relative "../docker/container/linux"
 require_relative "../docker/container/windows"
+require_relative "../docker/docker_version"
 
 require_relative "../docker/helpers/inspec_helper"
 
@@ -31,8 +32,11 @@ module Kitchen
       # Raised when a docker command against the container fails.
       class DockerFailed < TransportFailed; end
 
-      # kitchen_transport_api_version 1
-      plugin_version Kitchen::VERSION
+      # Reported by `kitchen diagnose`. plugin_version was Kitchen::VERSION,
+      # which is Test Kitchen's version rather than this gem's, so a diagnose
+      # reported the transport as 4.1.1 while kitchen-docker was at 3.3.4.
+      kitchen_transport_api_version 1
+      plugin_version Kitchen::Docker::DOCKER_VERSION
 
       default_config :binary,        "docker"
       default_config :env_variables, nil
@@ -79,6 +83,8 @@ module Kitchen
       # than from Test Kitchen's configuration.
       #
       # @param state [Hash] instance state naming the container
+      # @param block [Proc, nil] forwarded to the connection's constructor, which
+      #   yields the new connection to it; the connection is not closed afterwards
       # @yieldparam connection [Connection] if a block is given
       # @return [Connection]
       def connection(state, &block)

data/spec/container_helper_spec.rb

@@ -333,6 +333,89 @@ describe Kitchen::Docker::Helpers::ContainerHelper do
     end
   end
 
+  describe "#create_dir_on_container" do
+    def dir_maker(state)
+      helper.tap do |h|
+        @commands = []
+        allow(h).to receive(:replace_env_variables) { |_s, path| path }
+        allow(h).to receive(:docker_command) { |cmd, _opts = {}| @commands << cmd; "" }
+      end
+    end
+
+    it "creates the directory inside the container" do
+      dir_maker(nil).create_dir_on_container({ container_id: "abc", platform: "ubuntu-24.04" }, "/tmp")
+      expect(argv(@commands.first)).to include_consecutive("mkdir", "-p", "/tmp")
+    end
+
+    it "expands an environment variable reference before creating it" do
+      h = helper
+      allow(h).to receive(:container_env_variables).and_return("TEMP" => "/var/tmp")
+      allow(h).to receive(:docker_command) { |cmd, _opts = {}| @cmd = cmd; "" }
+      h.create_dir_on_container({ container_id: "abc", platform: "ubuntu-24.04" }, "$TEMP/kitchen")
+      expect(argv(@cmd)).to include_consecutive("mkdir", "-p", "/var/tmp/kitchen")
+    end
+
+    # A temp_dir with a space in it reached `mkdir -p` unquoted, so the shell
+    # tore it in two and mkdir made two directories -- neither of them the one
+    # asked for. Every later upload then landed somewhere that did not exist.
+    it "keeps a path containing a space as one argument" do
+      dir_maker(nil).create_dir_on_container({ container_id: "abc", platform: "ubuntu-24.04" },
+        "/var/tmp/kitchen docker")
+      expect(argv(@commands.first)).to include_consecutive("mkdir", "-p", "/var/tmp/kitchen docker")
+    end
+
+    it "uses PowerShell on a Windows container" do
+      dir_maker(nil).create_dir_on_container({ container_id: "abc", platform: "windows-2022" }, 'C:\\Temp')
+      expect(@commands.first).to include("powershell").and include("New-Item")
+    end
+
+    it "says which directory it could not create" do
+      h = helper
+      allow(h).to receive(:replace_env_variables) { |_s, path| path }
+      allow(h).to receive(:docker_command).and_raise("boom")
+      expect { h.create_dir_on_container({ container_id: "abc", platform: "ubuntu-24.04" }, "/tmp/kitchen") }
+        .to raise_error(RuntimeError, %r{Failed to create directory /tmp/kitchen})
+    end
+  end
+
+  describe "#container_exec" do
+    it "runs the command through docker exec" do
+      h = helper
+      allow(h).to receive(:docker_command) { |cmd, _opts = {}| @cmd = cmd; "output" }
+      expect(h.container_exec({ container_id: "abc" }, "echo hi")).to eq "output"
+      expect(argv(@cmd)).to include_consecutive("exec", "abc", "echo", "hi")
+    end
+
+    it "names the container operation when the command fails" do
+      h = helper
+      allow(h).to receive(:docker_command).and_raise("boom")
+      expect { h.container_exec({ container_id: "abc" }, "echo hi") }
+        .to raise_error(RuntimeError, /Failed to execute command on Docker container/)
+    end
+  end
+
+  describe "#run_container" do
+    it "returns the id docker printed for the container it started" do
+      h = helper(instance_name: "kitchen-test")
+      allow(h).to receive(:docker_command).and_return(DockerOutput::RUN_CLEAN)
+      expect(h.run_container({ image_id: "sha256:abc" }, 22)).to eq DockerOutput::RUN_CONTAINER_ID
+    end
+
+    it "publishes the port it was given" do
+      h = helper
+      allow(h).to receive(:docker_command) { |cmd, _opts = {}| @cmd = cmd; DockerOutput::RUN_CLEAN }
+      h.run_container({ image_id: "sha256:abc" }, 22)
+      expect(argv(@cmd)).to include_consecutive("-p", "22")
+    end
+
+    it "publishes no port when there is none, as for a Windows container" do
+      h = helper
+      allow(h).to receive(:docker_command) { |cmd, _opts = {}| @cmd = cmd; DockerOutput::RUN_CLEAN }
+      h.run_container(image_id: "sha256:abc")
+      expect(argv(@cmd)).not_to include("-p")
+    end
+  end
+
   describe "#copy_file_to_container" do
     let(:state) { { container_id: "abc", platform: "ubuntu-24.04" } }
 

data/spec/docker_spec.rb

@@ -17,6 +17,24 @@
 require "spec_helper"
 
 describe Kitchen::Driver::Docker do
+  # `kitchen diagnose` is what bug reports are asked to include, so what it
+  # says about the plugin has to be true. The transport reported
+  # Kitchen::VERSION, which is Test Kitchen's version, and the driver reported
+  # nothing at all.
+  describe "plugin metadata" do
+    it "reports this gem's version, not Test Kitchen's" do
+      expect(described_class.diagnose[:version]).to eq Kitchen::Docker::DOCKER_VERSION
+    end
+
+    it "does not report Test Kitchen's version" do
+      expect(described_class.diagnose[:version]).not_to eq Kitchen::VERSION
+    end
+
+    it "declares the driver API version it is written against" do
+      expect(described_class.diagnose[:api_version]).to eq 2
+    end
+  end
+
   describe "#config_to_options" do
     let(:config) {}
     subject { described_class.new.send(:config_to_options, config) }

data/spec/image_helper_spec.rb

@@ -16,6 +16,30 @@ require "spec_helper"
 
 describe Kitchen::Docker::Helpers::ImageHelper do
   describe "#parse_image_id" do
+    # From #225. `docker build -q` prints the id on a line of its own and
+    # nothing else -- no "writing image", no "naming to", no "successfully
+    # built" -- so every pattern the parser had missed it, and a build with
+    # `build_options: -q` failed with "Could not parse Docker build output for
+    # image ID" rather than producing an instance.
+    context "with a quiet build" do
+      it "reads the id docker printed on its own" do
+        expect(helper.parse_image_id(DockerOutput::BUILD_QUIET))
+          .to eq DockerOutput::BUILD_QUIET_IMAGE_ID
+      end
+
+      it "reads it when docker also wrote a warning to stderr" do
+        expect(helper.parse_image_id("WARNING: something happened\n#{DockerOutput::BUILD_QUIET}"))
+          .to eq DockerOutput::BUILD_QUIET_IMAGE_ID
+      end
+
+      it "does not mistake a digest that is part of a longer line for the id" do
+        # Ordinary build output is full of "... sha256:... done" lines. Only a
+        # line that is nothing but a digest is the quiet form.
+        expect { helper.parse_image_id("#6 exporting manifest sha256:#{"a" * 64} done\n") }
+          .to raise_error(Kitchen::ActionFailed)
+      end
+    end
+
     # Docker has changed how it reports the built image's id several times, and
     # each change has broken this parser. Every format the driver claims to
     # support gets a case here, against output copied from a real build.

data/spec/linux_container_spec.rb

@@ -211,6 +211,33 @@ describe Kitchen::Docker::Container::Linux do
       c.execute("echo hi")
       expect(uploaded).to eq "echo hi"
     end
+
+    # The staged script is run by path, and that path is built from temp_dir,
+    # which the user sets.
+    def ran_in(temp_dir)
+      c = container(temp_dir: temp_dir)
+      allow(c).to receive(:create_dir_on_container)
+      allow(c).to receive(:replace_env_variables) { |_cfg, path| path }
+      allow(c).to receive(:upload)
+      ran = nil
+      allow(c).to receive(:container_exec) { |_cfg, cmd| ran = cmd }
+      c.execute("echo hi")
+      ran
+    end
+
+    it "runs the staged script with bash" do
+      ran = ran_in("/tmp")
+      expect(argv(ran).first).to eq "/bin/bash"
+      expect(argv(ran).last).to match(%r{\A/tmp/docker-[0-9a-f-]+\.sh\z})
+    end
+
+    # Interpolated unquoted, a temp_dir with a space in it reached `docker
+    # exec` as two arguments, and bash was handed the first half of the
+    # directory as the script to run.
+    it "keeps a temp_dir containing a space as one argument" do
+      expect(argv(ran_in("/var/tmp/kitchen docker")).last)
+        .to match(%r{\A/var/tmp/kitchen docker/docker-[0-9a-f-]+\.sh\z})
+    end
   end
 
   describe "#generate_keys" do

data/spec/support/docker_output.rb

@@ -81,6 +81,15 @@ module DockerOutput
 
   BUILD_LEGACY_IMAGE_ID = "1a2b3c4d5e6f".freeze
 
+  # `docker build -q` on Docker 29.7.2. Quiet mode prints the id and nothing
+  # else -- no step lines, no exporting lines, none of the wording the other
+  # fixtures here are built around. Reachable through the driver as
+  # `build_options: -q`.
+  BUILD_QUIET = "sha256:ab86ce908a36ffb7de411a72550e416a4d8c268570a0f7313c284c79344d6c0f\n".freeze
+
+  BUILD_QUIET_IMAGE_ID =
+    "sha256:ab86ce908a36ffb7de411a72550e416a4d8c268570a0f7313c284c79344d6c0f".freeze
+
   # `docker run -d`, the ordinary case: the id and nothing else.
   RUN_CONTAINER_ID = "b89e1e8b07664a1ee0bd09decb833146eaf9cc810a152950e3576a56745944db".freeze
   RUN_CLEAN = "#{RUN_CONTAINER_ID}\n".freeze

data/spec/transport_docker_spec.rb

@@ -15,6 +15,26 @@
 require "spec_helper"
 require "kitchen/transport/docker"
 
+describe Kitchen::Transport::Docker do
+  # `kitchen diagnose` is what bug reports are asked to include, so what it
+  # says about the plugin has to be true.
+  describe "plugin metadata" do
+    it "reports this gem's version, not Test Kitchen's" do
+      expect(described_class.diagnose[:version]).to eq Kitchen::Docker::DOCKER_VERSION
+    end
+
+    it "does not report Test Kitchen's version" do
+      # It did: `plugin_version Kitchen::VERSION` made a diagnose say the
+      # transport was at Test Kitchen's version rather than this gem's.
+      expect(described_class.diagnose[:version]).not_to eq Kitchen::VERSION
+    end
+
+    it "declares the transport API version it is written against" do
+      expect(described_class.diagnose[:api_version]).to eq 1
+    end
+  end
+end
+
 describe Kitchen::Transport::Docker::Connection do
   let(:options) do
     {

data/spec/windows_container_spec.rb

@@ -64,6 +64,60 @@ describe Kitchen::Docker::Container::Windows do
     end
   end
 
+  describe "#execute" do
+    def staged(config = {})
+      c = container({ temp_dir: 'C:\\Temp' }.merge(config))
+      allow(c).to receive(:create_dir_on_container)
+      allow(c).to receive(:replace_env_variables) { |_cfg, path| path }
+      allow(c).to receive(:upload)
+      allow(c).to receive(:container_exec) { |_cfg, cmd| @ran = cmd }
+      c
+    end
+
+    around do |example|
+      Dir.mktmpdir { |dir| Dir.chdir(dir) { example.run } }
+    end
+
+    it "runs the staged script with powershell" do
+      staged.execute("Write-Host hi")
+      expect(@ran).to start_with "powershell -ExecutionPolicy Bypass -NoLogo "
+      expect(@ran).to match(/-File .*docker-[0-9a-f-]+\.ps1/)
+    end
+
+    it "stages the script under the configured temp_dir" do
+      staged.execute("Write-Host hi")
+      expect(@ran).to include 'C:\\Temp\\docker-'
+    end
+
+    it "accepts a temp_dir written with forward slashes" do
+      # Kitchen configuration is YAML that is often shared with Linux suites,
+      # so the separator is normalised rather than rejected.
+      staged(temp_dir: "C:/Temp").execute("Write-Host hi")
+      expect(@ran).to include 'C:\\Temp\\docker-'
+    end
+
+    # A Windows temp_dir routinely contains a space -- $env:TEMP under a user
+    # whose name has one does. PowerShell's -File takes exactly one argument,
+    # so an unquoted path left it looking for a script named after the first
+    # word.
+    it "quotes a script path containing a space" do
+      staged(temp_dir: 'C:\\Users\\Foo Bar\\Temp').execute("Write-Host hi")
+      expect(@ran).to include('-File "C:\\Users\\Foo Bar\\Temp\\docker-').and end_with('.ps1"')
+    end
+
+    it "removes the staged script once the command has run" do
+      staged.execute("Write-Host hi")
+      expect(Dir.glob(".kitchen/temp/docker-*.ps1")).to be_empty
+    end
+
+    it "removes the staged script when the command fails" do
+      c = staged
+      allow(c).to receive(:container_exec).and_raise("command exploded")
+      expect { c.execute("Write-Host hi") }.to raise_error(/Failed to execute command/)
+      expect(Dir.glob(".kitchen/temp/docker-*.ps1")).to be_empty
+    end
+  end
+
   describe "the contract it shares with the Linux container" do
     # The two classes share almost no code but must agree on the state they
     # populate, because the driver and transport read the same keys whichever

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-docker
 version: !ruby/object:Gem::Version
-  version: 3.4.0
+  version: 3.4.1
 platform: ruby
 authors:
 - Sean Porter
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-23 00:00:00.000000000 Z
+date: 2026-08-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: test-kitchen