fix: avoid double lock in DockerProvider.DaemonHost()

docker.go

@@ -1498,7 +1498,11 @@ func (p *DockerProvider) daemonHostLocked(ctx context.Context) (string, error) {
 		p.hostCache = daemonURL.Hostname()
 	case "unix", "npipe":
 		if core.InAContainer() {
-			ip, err := p.GetGatewayIP(ctx)
+			defaultNetwork, err := p.ensureDefaultNetworkLocked(ctx)
+			if err != nil {
+				return "", fmt.Errorf("ensure default network: %w", err)
+			}
+			ip, err := p.getGatewayIP(ctx, defaultNetwork)
 			if err != nil {
 				ip, err = core.DefaultGatewayIP()
 				if err != nil {
@@ -1598,7 +1602,10 @@ func (p *DockerProvider) GetGatewayIP(ctx context.Context) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("ensure default network: %w", err)
 	}
+	return p.getGatewayIP(ctx, defaultNetwork)
+}
 
+func (p *DockerProvider) getGatewayIP(ctx context.Context, defaultNetwork string) (string, error) {
 	nw, err := p.GetNetwork(ctx, NetworkRequest{Name: defaultNetwork})
 	if err != nil {
 		return "", err
@@ -1624,7 +1631,10 @@ func (p *DockerProvider) GetGatewayIP(ctx context.Context) (string, error) {
 func (p *DockerProvider) ensureDefaultNetwork(ctx context.Context) (string, error) {
 	p.mtx.Lock()
 	defer p.mtx.Unlock()
+	return p.ensureDefaultNetworkLocked(ctx)
+}
 
+func (p *DockerProvider) ensureDefaultNetworkLocked(ctx context.Context) (string, error) {
 	if p.defaultNetwork != "" {
 		// Already set.
 		return p.defaultNetwork, nil

docker_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"flag"
 	"fmt"
 	"io"
 	"log"
@@ -19,12 +20,14 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/strslice"
 	"github.com/docker/docker/client"
 	"github.com/docker/docker/errdefs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/testcontainers/testcontainers-go/exec"
 	"github.com/testcontainers/testcontainers-go/wait"
 )
 
@@ -35,6 +38,7 @@ const (
 	nginxAlpineImage  = "nginx:alpine"
 	nginxDefaultPort  = "80/tcp"
 	nginxHighPort     = "8080/tcp"
+	golangImage       = "golang"
 	daemonMaxVersion  = "1.41"
 )
 
@@ -46,6 +50,65 @@ func init() {
 	}
 }
 
+func TestWithinContainerStage1(t *testing.T) {
+	// TODO: remove this skip check when context rework is merged.
+	if providerType != ProviderDocker {
+		t.Skip("This is a docker-specific test.")
+	}
+	dir, err := os.Getwd()
+	require.NoError(t, err)
+	req := ContainerRequest{
+		Image:      golangImage,
+		WorkingDir: dir,
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hc.Mounts = append(hc.Mounts, mount.Mount{
+				Type:   "bind",
+				Source: dir,
+				Target: dir,
+			}, mount.Mount{
+				Type:   "bind",
+				Source: "/var/run",
+				Target: "/var/run",
+			})
+		},
+		Entrypoint: []string{"sleep", "100"},
+	}
+	container, err := GenericContainer(context.Background(), GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	require.NoError(t, err)
+	// The timeout is necessary because when TestWithinContainersStage2 fails, it hangs forever instead of erroring
+	exitCode, outputReader, err := container.Exec(context.Background(), []string{"go", "test", "-v", "-run", "^TestWithinContainerStage2$", "-timeout", "20s", "-stage2"}, exec.Multiplexed())
+	require.NoError(t, err)
+
+	outputBytes, err := io.ReadAll(outputReader)
+	require.NoError(t, err, "failed to read output")
+	t.Logf("%s", outputBytes)
+
+	require.Zero(t, exitCode, "non-zero exit code, output: %s", outputBytes)
+}
+
+var stage2 = flag.Bool("stage2", false, "Run TestWithinContainerStage2")
+
+// Regression test for deadlock #2897
+func TestWithinContainerStage2(t *testing.T) {
+	if !*stage2 {
+		t.Skip("Skipping test that requires stage2")
+	}
+
+	req := ContainerRequest{
+		Image: nginxImage,
+	}
+	container, err := GenericContainer(context.Background(), GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	require.NoError(t, err)
+	_, err = container.Host(context.Background())
+	require.NoError(t, err)
+}
+
 func TestContainerWithHostNetworkOptions(t *testing.T) {
 	if os.Getenv("XDG_RUNTIME_DIR") != "" {
 		t.Skip("Skipping test that requires host network access when running in a container")