GRM-166: fix: restrict docker-prune to exited containers

ansible/roles/gitea_runner/molecule/template-content/verify.yml

@@ -48,6 +48,7 @@
         that:
           - "'Type=oneshot' in prune_service.content | b64decode"
           - "'docker rm -f' in prune_service.content | b64decode"
+          - "'status=exited' in prune_service.content | b64decode"
           - "'GITEA-ACTIONS-TASK' in prune_service.content | b64decode"
           - "'docker system prune -af' in prune_service.content | b64decode"
           - "'docker network prune' in prune_service.content | b64decode"

ansible/roles/gitea_runner/templates/docker-prune.service.j2

@@ -5,16 +5,18 @@ Description=Docker prune for Gitea runner resources
 Type=oneshot
 Environment=DOCKER_HOST=unix:///run/user/{{ gitea_runner_uid }}/docker.sock
 Environment=XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
-# Force-remove stale containers (including running ones) left behind by failed
-# molecule tests. "docker container prune -f" only removes stopped containers,
-# so running containers from crashed/interrupted CI jobs accumulate indefinitely,
-# consuming disk and memory. We stop+rm everything first, then prune the rest.
+# Force-remove stale *stopped* containers left behind by failed molecule tests.
+# Implements: REQ-1 (GRM-166) — only containers with status=exited are
+# eligible. RunningFor measures creation time, so a stale molecule instance
+# (e.g. ubuntu-2604) that a new run restarts still looks ">1h old"; removing
+# running containers kills active converges with "No such container"
+# (infra nightly run 5710). Running leftovers are instead reused or destroyed
+# by the next molecule create/destroy cycle.
 # Exclude CI job containers (name starts with GITEA-ACTIONS-TASK) — removing
 # them kills the active CI job and causes "RWLayer is unexpectedly nil" errors.
 # Only remove containers older than 1 hour (grep for "hour/day/week/month/year
-# ago" in RunningFor) to avoid killing molecule test containers that CI jobs
-# are actively using.
-ExecStart=/bin/sh -c 'docker ps -a --format "{% raw %}{{.ID}} {{.Names}} {{.RunningFor}}{% endraw %}" 2>/dev/null | grep -v "GITEA-ACTIONS-TASK" | grep -E "(hour|day|week|month|year)s? ago" | awk "{print $1}" | xargs -r docker rm -f 2>/dev/null || true'
+# ago" in RunningFor) to avoid removing containers a job just created.
+ExecStart=/bin/sh -c 'docker ps -a --filter "status=exited" --format "{% raw %}{{.ID}} {{.Names}} {{.RunningFor}}{% endraw %}" 2>/dev/null | grep -v "GITEA-ACTIONS-TASK" | grep -E "(hour|day|week|month|year)s? ago" | awk "{print $1}" | xargs -r docker rm -f 2>/dev/null || true'
 ExecStart=/usr/bin/docker system prune -af --filter "until={{ gitea_runner_prune_until }}" --volumes
 # Prune networks older than the prune-until threshold to avoid removing
 # networks that molecule tests are actively creating (e.g. 'traefik' network