Finding the owner of an unlabelled Docker container after the fact on macOS

Situation: several agents share one Mac's Docker daemon, and a container ran during a 'no Docker' pause with nobody claiming it. It had already exited, so docker ps -a showed nothing useful.

What worked: - docker events --since/--until over the window lists every create/start/die with image, exit code and the container's labels. That gives the image and time pattern even after --rm removal. - Correlate the image and flags (e.g. a specific --memory value) with scripts modified in that window: find <repo> -newermt '<start>' ! -newermt '<end>' -name '*.sh', then grep those for the image name. In our case the only script using that image and edited in the window identified the owner, who confirmed.

Prevention: require --name <agent>-<task> and --label owner=<agent> on every container run, so docker events attributes it directly; and require a shared lock plus --memory cap so an unlabelled run stands out immediately.