Fix _is_inside_docker() false positive on systemd cgroups v2 hosts (part of #886)

[4gust]

Summary

Fixes the container-detection false positive described in #886.

msal/oauth2cli/authcode.py::_is_inside_docker() decides whether the OAuth2 authorization-code callback server binds to 0.0.0.0 (all interfaces, when inside a container so docker run -p can reach it) or 127.0.0.1 (loopback only, on a normal host).

The previous heuristic treated any /proc/1/cgroup path other than "/" as "inside docker". On modern systemd hosts using cgroups v2, PID 1 lives in /init.scope (not /), so ordinary Linux desktops/servers were misdetected as containers and the auth-code callback server was bound to 0.0.0.0 — listening on all network interfaces. That exposes the localhost OAuth callback (which receives authorization codes) to the local network, contrary to RFC 8252 §8.3.

Change

_is_inside_docker() now returns True only for genuine container markers:

• the runtime-created files /.dockerenv (Docker, incl. Docker Desktop on Mac) or /run/.containerenv (Podman), or
• a docker / containerd / kubepods / lxc / libpod token in PID 1's cgroup path.

Real Docker/Podman/Kubernetes containers are still detected, so the legitimate docker run -p 127.0.0.1:{port}:{port} port-forwarding scenario is preserved. Non-container hosts now correctly bind to loopback.

Tests

Adds TestIsInsideDocker in tests/test_authcode.py covering: systemd cgroups v2 host, cgroups v1 host, /.dockerenv, /run/.containerenv, docker cgroup path, kubepods cgroup path, and non-Linux. All 15 tests in the file pass.

Scope / compatibility

• No public API, CLI, config, or wire-format changes.
• Behavior change is limited to correctly binding to loopback on non-container Linux hosts (a security improvement).

Not included (deferred — needs maintainer input)

Issue #886 also requests IPv6 support for the callback listener (so localhost → ::1 browsers succeed). That part involves a cross-platform design decision (bind ::1 vs. dual-stack :: with IPV6_V6ONLY=0 vs. running two servers) and is intentionally left out of this low-risk PR.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

This PR tightens the Linux container-detection heuristic used by msal.oauth2cli.authcode.AuthCodeReceiver to choose the callback listener bind address, fixing a cgroups v2 / systemd false-positive that could cause the local OAuth2 redirect listener to bind to 0.0.0.0 on non-container hosts (exposing the loopback callback on the LAN).

Changes:

• Update _is_inside_docker() to treat only runtime marker files (/.dockerenv, /run/.containerenv) or known container cgroup tokens as “inside a container”, avoiding cgroups v2 /init.scope false positives.
• Add unit tests for _is_inside_docker() covering cgroups v1/v2 host cases, marker files, known container cgroup paths, and non-Linux behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
msal/oauth2cli/authcode.py	Refines _is_inside_docker() to reduce false positives on systemd cgroups v2 hosts while preserving real container detection signals.
tests/test_authcode.py	Adds focused unit tests for the updated container-detection behavior, including regression coverage for the cgroups v2 /init.scope case.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.