Rejected with a rootfs patch leaves a registered-but-empty sandbox name ("already exists", absent from )

[dreamcodez]

Summary

msb run --from-snapshot <snap> --copy-file SRC:DST ... is correctly rejected with invalid config: patches cannot be combined with from_snapshot, but the rejection happens after the sandbox name has been registered. Retrying under the same name then fails with sandbox already exists: sandbox '<name>' already exists; remove it, start the stopped sandbox, or recreate with .replace(), while msb ls, msb ls --stopped, msb inspect <name>, and msb rm -f <name> all report sandbox not found. The name is unusable until msb garbage-collects it (it disappeared on its own some minutes later in my case).

Repro (msb 0.6.17, macOS 15.7 Apple Silicon)

msb run --name base ubuntu:24.04 -- true
msb snapshot create snap --from base
echo hi > /tmp/f

msb run -d --name ghost --from-snapshot snap --copy-file /tmp/f:/tmp/f -- sleep 1
# error: invalid config: patches cannot be combined with from_snapshot

msb run -d --name ghost --from-snapshot snap -- sleep 1
# error: sandbox already exists: sandbox 'ghost' already exists ...

msb ls -q            # (ghost not listed)
msb rm -f ghost      # error: sandbox not found: ghost

Expected

Validate the config before registering the name, or roll the registration back on validation failure, so a rejected run leaves no trace.

Related

Would be nice if --copy-file/--copy-dir were allowed with --from-snapshot (the upper layer is writable anyway); we use a read-only --mount-file instead. Wrapper: https://github.com/OrchidStudio/orchid/pull/6441.

[appcypher]

Would be nice if --copy-file/--copy-dir were allowed with --from-snapshot (the upper layer is writable anyway); we use a read-only --mount-file instead. Wrapper: https://github.com/OrchidStudio/orchid/pull/6441.

could be its own issue. also this should extend to a lot of the creation flags instead of just --copy-*