start-command 0.38.0 → 0.39.0

package/src/lib/docker-runtime-args.js

@@ -1,7 +1,8 @@
 /**
  * Docker runtime options shared by `docker run`, `[Isolation]` status lines
- * and execution-record metadata: privileged mode, environment, volumes,
- * mounts, networks (issue #150) and resource limits (issue #176).
+ * and execution-record metadata: privileged mode, the init process
+ * (issue #244), environment, volumes, mounts, networks (issue #150) and
+ * resource limits (issue #176).
  */
 
 const { getDockerNetworks } = require('./docker-network-lifecycle');
@@ -31,7 +32,7 @@ function getOnKillResume(options = {}) {
  * mounts, --mount specs, network configuration and resource limits. Returned
  * in a stable order so they can be spliced into the `docker run` argv before
  * the image name.
- * @param {object} options - Options (privileged, env, volumes, mounts, network, networkAliases, resourceLimits)
+ * @param {object} options - Options (privileged, init, env, volumes, mounts, network, networkAliases, resourceLimits)
  * @returns {string[]} Docker CLI arguments
  */
 function buildDockerRuntimeArgs(options = {}) {
@@ -39,6 +40,10 @@ function buildDockerRuntimeArgs(options = {}) {
   if (options.privileged) {
     args.push('--privileged');
   }
+  // tini as PID 1 reaps orphaned processes (issue #244).
+  if (options.init) {
+    args.push('--init');
+  }
   for (const envVar of options.env || []) {
     args.push('-e', envVar);
   }
@@ -94,6 +99,9 @@ function buildDockerRuntimeStatusLines(options = {}) {
   if (options.privileged) {
     lines.push(`[Isolation] Privileged: true`);
   }
+  if (options.init) {
+    lines.push(`[Isolation] Init: true`);
+  }
   const networks = getDockerNetworks(options);
   if (networks.length > 0) {
     lines.push(`[Isolation] Network: ${networks[0]}`);
@@ -145,6 +153,7 @@ function buildDockerRuntimeMetadata(options = {}) {
     labels: options.labels && options.labels.length > 0 ? options.labels : null,
     commandHandoff: options.detached ? true : null,
     privileged: options.privileged || null,
+    init: options.init || null,
     network: networks[0] || null,
     networks: networks.length > 0 ? networks : null,
     networkAliases:

package/src/lib/execution-control.js

@@ -11,6 +11,7 @@ const {
   formatAsNestedLinksNotation,
 } = require('./output-blocks');
 const { getDockerCommand, getDockerSpawnOptions } = require('./docker-cleanup');
+const { prefetchedInspect } = require('./docker-inspect-batch');
 
 const ControlAction = {
   STOP: 'stop',
@@ -148,14 +149,15 @@ function collectProcessIds(record, runner = runCommand) {
       ),
     ];
     addIfPresent(processIds, 'commandPids', commandPids);
+  } else if (isolated === 'docker' && record.containerState === 'removed') {
+    // The container is gone, so there is nothing to ask Docker (#243).
+    addIfPresent(processIds, 'containerId', opts.containerId);
   } else if (isolated === 'docker') {
     addIfPresent(processIds, 'containerId', opts.containerId);
-    const result = runner(getDockerCommand(), [
-      'inspect',
-      '-f',
-      '{{.Id}} {{.State.Pid}}',
-      sessionName,
-    ]);
+    const format = '{{.Id}} {{.State.Pid}}';
+    const result =
+      prefetchedInspect(format, sessionName) ||
+      runner(getDockerCommand(), ['inspect', '-f', format, sessionName]);
     if (result.success && result.stdout.trim()) {
       const [containerId, pidValue] = result.stdout.trim().split(/\s+/);
       addIfPresent(processIds, 'containerId', containerId);

package/src/lib/execution-recovery.js

@@ -336,6 +336,7 @@ function recoverKilledExecution(params = {}) {
   record.options.exitEvidence = {
     mainOom: terminalOom,
     daemonRestart: logged.daemonRestart,
+    ...evidence.sourceOf(logged),
   };
   let recoveryLimits = null;
   if (opts.onKillResumeMemory && terminalOom) {
@@ -490,7 +491,9 @@ function recoverKilledExecution(params = {}) {
     const updated = runner(getDockerCommand(), [
       'update',
       ...resourceLimits.filter((s) =>
-        /^--(?:memory|memory-swap|cpus|cpu-quota|cpu-period)=/.test(s)
+        /^--(?:memory|memory-swap|memory-reservation|cpus|cpu-quota|cpu-period)=/.test(
+          s
+        )
       ),
       containerName,
     ]);

package/src/lib/execution-resume.js

@@ -127,6 +127,7 @@ function buildLaunchOptions(record) {
     useCommandStream: opts.useCommandStream || false,
     shell: opts.shell || 'auto',
     privileged: opts.privileged || false,
+    init: opts.init || false,
     env: opts.env || [],
     volumes: opts.volumes || [],
     mounts: opts.mounts || [],
@@ -535,7 +536,9 @@ async function resumeExecution(store, identifier, deps = {}) {
         args: [
           'update',
           ...resources.resourceLimits.filter((s) =>
-            /^--(?:memory|memory-swap|cpus|cpu-quota|cpu-period)=/.test(s)
+            /^--(?:memory|memory-swap|memory-reservation|cpus|cpu-quota|cpu-period)=/.test(
+              s
+            )
           ),
           plan.sessionName,
         ],

package/src/lib/execution-store.js

@@ -25,6 +25,7 @@ const os = require('os');
 const { execFileSync, spawnSync } = require('child_process');
 const crypto = require('crypto');
 const { atomicWrite } = require('./atomic-write');
+const { decodeStoreContent } = require('./store-decode-cache');
 
 // Synchronous wrapper using Bun's native ESM support
 // This works because Bun handles ESM/CJS interop
@@ -38,6 +39,12 @@ function encodeSync(data) {
   }
 }
 
+const DECODE_LOG = {
+  memory: () => 'Reused the decoded store: the file is unchanged',
+  copy: () => 'Read the decoded copy of the store: the file is unchanged',
+  decode: (content) => `Decoded the store (${content.length} characters)`,
+};
+
 function decodeSync(notation) {
   try {
     const codec = require('lino-objects-codec');
@@ -52,6 +59,8 @@ const DEFAULT_APP_FOLDER = path.join(os.homedir(), '.start-command');
 const LINO_DB_FILE = 'executions.lino';
 const LINKS_DB_FILE = 'executions.links';
 const LOCK_FILE = 'executions.lock';
+// Decoded records as JSON, for the next process (issue #243)
+const DECODED_COPY_FILE = 'executions.decoded.js.json';
 const { LockManager } = require('./store-lock');
 
 /**
@@ -262,6 +271,7 @@ class ExecutionStore {
     this.linoDbPath = path.join(this.appFolder, LINO_DB_FILE);
     this.linksDbPath = path.join(this.appFolder, LINKS_DB_FILE);
     this.lockFilePath = path.join(this.appFolder, LOCK_FILE);
+    this.decodedCopyPath = path.join(this.appFolder, DECODED_COPY_FILE);
     this.useLinks = options.useLinks !== false && isClinkInstalled();
     this.verbose = options.verbose || false;
 
@@ -302,7 +312,14 @@ class ExecutionStore {
         return [];
       }
 
-      const data = decodeSync(content);
+      // Decoded once per content, not once per call (issue #243).
+      const { data, source } = decodeStoreContent(
+        this.linoDbPath,
+        content,
+        decodeSync,
+        { copyPath: this.decodedCopyPath }
+      );
+      this.log(DECODE_LOG[source](content));
       if (!Array.isArray(data)) {
         return [];
       }
@@ -915,4 +932,5 @@ module.exports = {
   LINO_DB_FILE,
   LINKS_DB_FILE,
   LOCK_FILE,
+  DECODED_COPY_FILE,
 };

package/src/lib/exit-evidence.js

@@ -5,6 +5,16 @@ const MAIN_OOM = 'Exit evidence: main-oom (recent cgroup oom_kill delta)';
 const DOCKER_OOM = 'Exit evidence: main-oom (recent Docker oom event)';
 const DAEMON_RESTART =
   'Exit evidence: docker-daemon-restart (Docker service journal)';
+const DAEMON_RESTART_API =
+  'Exit evidence: docker-daemon-restart (Docker API: containers finished together)';
+const DAEMON_RESTART_PREFIX = 'Exit evidence: docker-daemon-restart';
+// dockerd gives every container its stop timeout and kills the rest within its
+// 15 s shutdown timeout, so the containers of one restart finish this close.
+const DAEMON_RESTART_WINDOW_MS = 15000;
+const CONTAINER_STATE_FORMAT =
+  '{{.Id}} {{.State.FinishedAt}} {{.State.StartedAt}} {{.State.ExitCode}} {{.State.OOMKilled}}';
+// Bounds one `docker inspect` call on hosts with many stopped containers.
+const MAX_PEER_CONTAINERS = 256;
 
 function recentOomDelta(sample, finishedAt) {
   const fields = String(sample || '')
@@ -39,6 +49,42 @@ function daemonRestartEvidence(journal, containerId) {
   return Boolean(exited && forced);
 }
 
+/**
+ * Socket-only daemon-restart evidence (issue #241): another container that
+ * finished within the same shutdown window, was not OOM-killed, and was either
+ * stopped by a signal (137/143) or started again afterwards (restart policy;
+ * moby resets its ExitCode to 0 but keeps FinishedAt). `docker events` cannot
+ * be used: its buffer does not survive the restart, while State does.
+ * @param {string} states - `CONTAINER_STATE_FORMAT` lines, one per container
+ */
+function daemonRestartApiEvidence(states, containerId, finishedAt) {
+  const finished = Date.parse(finishedAt);
+  return (
+    Number.isFinite(finished) &&
+    String(states || '')
+      .split('\n')
+      .some((line) => {
+        const [id, peerFinished, peerStarted, exit, oom] = line
+          .trim()
+          .split(/\s+/);
+        const end = Date.parse(peerFinished);
+        if (
+          !/^[a-f0-9]{64}$/.test(id || '') ||
+          id === containerId ||
+          oom !== 'false' ||
+          !Number.isFinite(end) ||
+          end <= 0 ||
+          Math.abs(end - finished) > DAEMON_RESTART_WINDOW_MS
+        ) {
+          return false;
+        }
+        return (
+          exit === '137' || exit === '143' || Date.parse(peerStarted) > end
+        );
+      })
+  );
+}
+
 function recentDockerOom(events, finishedAt) {
   const finished = Date.parse(finishedAt) / 1000;
   return (
@@ -68,6 +114,10 @@ function collectExitEvidence(
   // A local journal cannot diagnose a remote daemon. Require a local socket.
   const local =
     !process.env.DOCKER_HOST || process.env.DOCKER_HOST.startsWith('unix://');
+  const sampledOom =
+    (oomKilled === true || oomKilled === 'true') &&
+    (Number(exitCode) === 137 || Number(exitCode) < 0) &&
+    recentOomDelta(sample, finishedAt);
   if (
     Number(exitCode) === 137 &&
     containerName &&
@@ -114,18 +164,35 @@ function collectExitEvidence(
       if (events.success && recentDockerOom(events.stdout, finishedAt)) {
         return DOCKER_OOM;
       }
+      // Without a host journal (a mounted docker.sock, a remote daemon) the
+      // only record of the restart is the state of the other containers.
+      const peers = sampledOom
+        ? { success: false, stdout: '' }
+        : run(docker, ['ps', '-a', '-q', '--no-trunc']);
+      const ids = peers.stdout
+        .split(/\s+/)
+        .filter(
+          (peer) => /^[a-f0-9]{64}$/.test(peer) && peer !== id.stdout.trim()
+        )
+        .slice(0, MAX_PEER_CONTAINERS);
+      // A container removed after `docker ps` fails inspect with status 1 but
+      // the others are still printed, so the output is used either way.
+      const states = ids.length
+        ? run(docker, ['inspect', '-f', CONTAINER_STATE_FORMAT, ...ids])
+        : { success: false, stdout: '' };
+      if (
+        daemonRestartApiEvidence(states.stdout, id.stdout.trim(), finishedAt)
+      ) {
+        return DAEMON_RESTART_API;
+      }
       if (process.env.START_DEBUG === '1') {
         console.error(
-          `[DEBUG] Exit evidence: container=${id.stdout.trim()} finishedAt=${finishedAt} eventsAvailable=${events.success} oomEvents=${JSON.stringify(events.stdout)} sample=${JSON.stringify(sample || '')}`
+          `[DEBUG] Exit evidence: container=${id.stdout.trim()} finishedAt=${finishedAt} eventsAvailable=${events.success} oomEvents=${JSON.stringify(events.stdout)} peerContainers=${ids.length} peerStates=${JSON.stringify(states.stdout)} sample=${JSON.stringify(sample || '')}`
         );
       }
     }
   }
-  if (
-    (oomKilled === true || oomKilled === 'true') &&
-    (Number(exitCode) === 137 || Number(exitCode) < 0) &&
-    recentOomDelta(sample, finishedAt)
-  ) {
+  if (sampledOom) {
     return MAIN_OOM;
   }
   return 'Exit evidence: unavailable (no attributed exit-time OOM or daemon restart evidence)';
@@ -134,12 +201,72 @@ function collectExitEvidence(
 function fromLog(log) {
   const lines = String(log || '').split('\n');
   const last = lines.filter((line) => line.startsWith('Exit evidence:')).at(-1);
+  const daemonRestart = Boolean(last?.startsWith(DAEMON_RESTART_PREFIX));
   return {
     mainOom: last === MAIN_OOM || last === DOCKER_OOM,
-    daemonRestart: last === DAEMON_RESTART,
+    daemonRestart,
+    // Which source attributed the restart: the host journal or the API.
+    ...(daemonRestart
+      ? { daemonRestartSource: last === DAEMON_RESTART_API ? 'api' : 'journal' }
+      : {}),
   };
 }
 
+/** The stored `daemonRestartSource`, kept only when a restart was attributed. */
+function sourceOf(logged) {
+  return logged?.daemonRestart && logged.daemonRestartSource
+    ? { daemonRestartSource: logged.daemonRestartSource }
+    : {};
+}
+
+// A watcher that shares the daemon with its task (a mounted docker.sock) dies
+// in the same restart and never logs evidence, so `--status` collects it from
+// the container state that survived, once per process (issue #241).
+const lostWatcherEvidence = new Map();
+function collectLostWatcherEvidence(record, state, runner) {
+  const name = record?.options?.sessionName;
+  if (
+    !name ||
+    record.options.exitEvidence ||
+    state?.running !== false ||
+    state.exitCode !== 137 ||
+    !state.finishedAt
+  ) {
+    return null;
+  }
+  const key = `${name}\0${state.finishedAt}`;
+  if (!lostWatcherEvidence.has(key)) {
+    const logged = fromLog(
+      collectExitEvidence(
+        {
+          containerName: name,
+          finishedAt: state.finishedAt,
+          exitCode: state.exitCode,
+          oomKilled: state.oomKilled,
+        },
+        runner
+      )
+    );
+    lostWatcherEvidence.set(key, {
+      mainOom: logged.mainOom,
+      daemonRestart: logged.daemonRestart,
+      ...sourceOf(logged),
+    });
+  }
+  return { ...lostWatcherEvidence.get(key) };
+}
+
+/** Stores the lost watcher's evidence when the log tail carries none. */
+function addLostWatcherEvidence(enriched, record, state, logTail) {
+  const lost =
+    state && !/^Exit evidence:/m.test(logTail || '')
+      ? collectLostWatcherEvidence(record, state)
+      : null;
+  if (lost) {
+    enriched.options = { ...enriched.options, exitEvidence: lost };
+  }
+}
+
 function buildExitEvidenceSnippet(containerName, quotedLogPath) {
   const stderr = process.env.START_DEBUG === '1' ? '2>&1' : '2>/dev/null';
   return `${shellQuote(process.execPath)} ${shellQuote(__filename)} ${shellQuote(containerName)} "$__start_command_cgroup" "$__start_command_finished" "$__start_command_exit" "$__start_command_oom" >> ${quotedLogPath} ${stderr}`;
@@ -149,11 +276,16 @@ module.exports = {
   MAIN_OOM,
   DOCKER_OOM,
   DAEMON_RESTART,
+  DAEMON_RESTART_API,
   recentOomDelta,
+  daemonRestartApiEvidence,
   recentDockerOom,
   daemonRestartEvidence,
   collectExitEvidence,
   fromLog,
+  sourceOf,
+  collectLostWatcherEvidence,
+  addLostWatcherEvidence,
   buildExitEvidenceSnippet,
 };
 if (require.main === module) {

package/src/lib/output-blocks.js

@@ -119,6 +119,7 @@ function parseIsolationMetadata(extraLines) {
     session: null,
     endpoint: null,
     user: null,
+    init: false,
   };
 
   for (const line of extraLines) {
@@ -146,6 +147,12 @@ function parseIsolationMetadata(extraLines) {
       continue;
     }
 
+    // Parse [Isolation] Init: true (docker run --init, issue #244)
+    if (line === '[Isolation] Init: true') {
+      metadata.init = true;
+      continue;
+    }
+
     // Parse [Isolation] Endpoint: user@host
     const endpointMatch = line.match(/\[Isolation\] Endpoint: (.+)/);
     if (endpointMatch) {
@@ -207,6 +214,10 @@ function generateIsolationLines(metadata, containerOrScreenName = null) {
     }
   }
 
+  if (metadata.init) {
+    lines.push(createTimelineLine('init', 'true'));
+  }
+
   if (metadata.user) {
     lines.push(createTimelineLine('user', metadata.user));
   }

package/src/lib/resume-resources.js

@@ -34,7 +34,7 @@ function prepareResumeResources(record, probe, overrides, runner, random) {
   const options = record.options || {};
   if (options.isolated !== 'docker') {
     if (
-      ['memory', 'memorySwap', 'cpus'].some(
+      ['memory', 'memorySwap', 'memoryReservation', 'cpus'].some(
         (k) => overrides[k] !== null && overrides[k] !== undefined
       )
     ) {
@@ -81,7 +81,7 @@ function prepareResumeResources(record, probe, overrides, runner, random) {
   };
   result.update =
     probe.state === 'stopped' &&
-    (['memory', 'memorySwap', 'cpus'].some(
+    (['memory', 'memorySwap', 'memoryReservation', 'cpus'].some(
       (k) => overrides[k] !== null && overrides[k] !== undefined
     ) ||
       Boolean(options.cpuPenaltyConfig));

package/src/lib/status-formatter.js

@@ -14,7 +14,7 @@ const {
   formatTextOptionValue,
 } = require('./status-links-notation');
 const { collectProcessIds } = require('./execution-control');
-const { getDockerCommand, getDockerSpawnOptions } = require('./docker-cleanup');
+const { getDockerCommand } = require('./docker-cleanup');
 const {
   describeExitCode,
   CGROUP_OOM_EXIT_REASON,
@@ -25,136 +25,31 @@ const {
   FATAL_MARKER_TAIL_BYTES,
   readLogTail,
 } = require('./isolation-log-utils');
-const { normalizeDockerTimestamp } = require('./docker-post-mortem');
 const { END_TIME_SOURCE } = require('./detached-finalize');
 const { formatCgroupMemory } = require('./cgroup-memory');
+const { addLostWatcherEvidence } = require('./exit-evidence');
 const {
   attachContainerRemoval,
-  dockerInspect,
   persistContainerRemoval,
 } = require('./container-removal');
-
-/**
- * Inspect the live state of a detached docker container by name.
- *
- * Distinguishes three outcomes that matter for status reporting:
- * - the container exists and is running,
- * - the container exists but has stopped (with a real exit code), and
- * - the container cannot be inspected at all.
- *
- * The last case is crucial on slow Docker-in-Docker hosts (issue #136): right
- * after `docker run -d` returns, `docker inspect <name>` can transiently fail
- * because the container is not visible yet. A failed inspect must NOT be read
- * as "stopped"; it means "unknown", so callers can keep the session running
- * instead of fabricating a terminal `-1` result.
- *
- * @param {string} sessionName - Container name
- * @param {Object|null} [probe] - Receives `sessionNotFound` (issue #225)
- * @returns {{running: boolean, exitCode: number|null, oomKilled: boolean|null}|null} State,
- *   or null when the container cannot be inspected (not found yet, removed, or docker error)
- */
-function inspectDockerState(sessionName, probe = null) {
-  const { stdout, notFound } = dockerInspect(
-    getDockerCommand(),
-    dockerProbeSpawnOptions(),
-    '{{.State.Running}} {{.State.ExitCode}} {{.State.OOMKilled}} ' +
-      '{{.State.StartedAt}} {{.State.FinishedAt}}',
-    sessionName
-  );
-  if (probe) {
-    // "No such container" is a fact, unlike a docker that cannot be reached
-    // (issue #225); it still reads as unknown liveness here (issue #136).
-    probe.sessionNotFound = notFound;
-  }
-  if (stdout === null) {
-    return null;
-  }
-  // Parsed positionally and defensively: an older docker (or a stubbed one)
-  // may answer with fewer fields than the template asks for.
-  const [runningRaw, exitRaw, oomKilledRaw, startedRaw, finishedRaw] = stdout
-    .trim()
-    .split(/\s+/);
-  const exitCode = Number.parseInt(exitRaw, 10);
+const { withDockerInspectBatch } = require('./docker-inspect-batch');
+const {
+  backendExitCode,
+  dockerProbeSpawnOptions,
+  inspectDockerState,
+  isDetachedDockerRecord,
+  readDockerState,
+  resolveOomObservation,
+} = require('./status-probe');
+
+/** How the status probes run docker. */
+function dockerProbe() {
   return {
-    running: runningRaw === 'true',
-    exitCode: Number.isFinite(exitCode) ? exitCode : null,
-    oomKilled:
-      oomKilledRaw === 'true' ? true : oomKilledRaw === 'false' ? false : null,
-    startedAt: normalizeDockerTimestamp(startedRaw),
-    finishedAt: normalizeDockerTimestamp(finishedRaw),
+    dockerCommand: getDockerCommand(),
+    spawnOptions: dockerProbeSpawnOptions(),
   };
 }
 
-function isDetachedDockerRecord(record) {
-  const opts = record.options || {};
-  return (
-    opts.isolated === 'docker' &&
-    opts.isolationMode === 'detached' &&
-    Boolean(opts.sessionName)
-  );
-}
-
-function dockerProbeSpawnOptions() {
-  return getDockerSpawnOptions({
-    encoding: 'utf8',
-    env: process.env,
-    stdio: ['pipe', 'pipe', 'pipe'],
-  });
-}
-
-function readDockerState(record, probe = null) {
-  const opts = record.options || {};
-  if (opts.isolated !== 'docker' || !opts.sessionName) {
-    return null;
-  }
-  const state = inspectDockerState(opts.sessionName, probe);
-  if (
-    record.attempt &&
-    state?.startedAt &&
-    Date.parse(state.startedAt) < Date.parse(record.attempt.startedAt)
-  ) {
-    return null;
-  }
-  return state;
-}
-
-/**
- * Best-effort terminal exit code reported by the isolation backend itself
- * (currently docker via `docker inspect .State.ExitCode`). Returns null when
- * the backend cannot provide a real code, so callers never surface the `-1`
- * sentinel for a session whose real exit code is simply not available yet.
- * A running container has no terminal exit code (docker reports `0` for it),
- * so only a stopped container contributes one.
- * @param {{running: boolean, exitCode: number|null}|null} dockerState - Inspected state
- * @returns {number|null}
- */
-function backendExitCode(dockerState) {
-  return dockerState && !dockerState.running ? dockerState.exitCode : null;
-}
-
-/**
- * Reconcile the OOM observation from the stored record and from `docker inspect`.
- *
- * `State.OOMKilled` is a container-cgroup flag: the kernel sets it when ANY
- * process in the cgroup is OOM-killed and it is never cleared for the life of
- * the container (moby/moby#47618). It is therefore an *observation*, never a
- * verdict about the session (issue #151) — a container that lost one child
- * process keeps running and can still exit `0`. Once observed, the flag stays
- * `true` for the record.
- * @param {Object} record - Execution record
- * @param {{oomKilled: boolean|null}|null} dockerState - Inspected state
- * @returns {boolean|undefined} Observation, or undefined when nothing is known
- */
-function resolveOomObservation(record, dockerState) {
-  if (record.oomKilled === true || dockerState?.oomKilled === true) {
-    return true;
-  }
-  if (record.oomKilled === false || dockerState?.oomKilled === false) {
-    return false;
-  }
-  return undefined;
-}
-
 /**
  * Check if a detached isolation session is still running
  * @param {Object} record - Execution record
@@ -433,6 +328,7 @@ function resolveDetachedStatus(record, logTail, probe = null) {
         (oomKilled === true ? 137 : -1);
     }
     applyEndTime(enriched, dockerState, footer.finishedAt);
+    addLostWatcherEvidence(enriched, record, dockerState, logTail);
   }
 
   return enriched;
@@ -563,10 +459,7 @@ function enrichDetachedStatus(record) {
   const logTail = record
     ? readAttemptLogTail(record, FATAL_MARKER_TAIL_BYTES)
     : null;
-  const probe = {
-    dockerCommand: getDockerCommand(),
-    spawnOptions: dockerProbeSpawnOptions(),
-  };
+  const probe = dockerProbe();
   const resolved = attachContainerRemoval(
     resolveDetachedStatus(record, logTail, probe),
     probe
@@ -920,10 +813,17 @@ function queryStatus(store, identifier, outputFormat) {
     };
   }
   try {
-    // Enrich detached execution status with live session check
-    const enrichedRecord = enrichDetachedStatus(record);
-    persistContainerRemoval(store, record, enrichedRecord);
-    const withProcessIds = attachProcessIds(enrichedRecord);
+    // Enrich detached execution status with live session check; its docker
+    // probes are answered by one inspect (issue #243).
+    const withProcessIds = withDockerInspectBatch(
+      [record],
+      dockerProbe(),
+      () => {
+        const enrichedRecord = enrichDetachedStatus(record);
+        persistContainerRemoval(store, record, enrichedRecord);
+        return attachProcessIds(enrichedRecord);
+      }
+    );
     // Attach currentTime so callers can see how long an executing command has been running
     const withCurrentTime = require('./execution-chain').attachIdentity(
       attachCurrentTime(withProcessIds),
@@ -952,8 +852,12 @@ function listExecutions(store, outputFormat, options = {}) {
   }
 
   try {
+    const all = store.getAll();
+    // One docker inspect for every listed container (issue #243).
     const enriched = sortRecordsByStartTimeDesc(
-      store.getAll().map(prepareRecordForList)
+      withDockerInspectBatch(all, dockerProbe(), () =>
+        all.map(prepareRecordForList)
+      )
     );
     // --running reports the reconciled status, not the stored one: a record
     // whose session already died is listed as executed even if the store still