fix: serialize cross-service Docker port allocation under xdist

[cofin]

Problem

DockerService.run() protects each service name with its own xdist file lock, but different services can still call client.containers.run(... ports={container_port: None}) concurrently on separate workers.

On rootless Docker, one SQLSpec pytest -n 4 --dist=loadgroup run started several native pytest-databases services at once. Docker allocated adjacent host ports 33313-33322, while the MSSQL container failed on 33316:

RootlessKit PortManager.AddPort(): listen tcp4 0.0.0.0:33316:
bind: address already in use

There was no second pytest process. The concurrent starts were different service names from the same run. Because mssql_service is session-scoped, the one startup failure cascaded into every MSSQL test.

Issue #131 / PR #133 added host_port support to DockerService.run, but only the PostgreSQL-family fixture surface exposes port overrides. MSSQL, MySQL, Oracle, GizmoSQL, CockroachDB, RustFS, and other native service fixtures still use dynamic allocation and cannot opt into a pinned port.

Suggested fix

Serialize only the container-creation/port-allocation critical section across service names when xdist is active, using a global file lock under the pytest-databases temp directory. Keep the existing per-name lock for service reuse and lifecycle behavior.

Alternatively, expose an optional host-port fixture consistently for every Docker service, though a global creation lock is less configuration and protects all current and future services.

Environment

• pytest-databases 0.19.0
• pytest-xdist 3.8.0
• docker-py 7.x
• Linux rootless Docker / RootlessKit
• Python 3.10

[cofin]

A second failure mode reproduced while validating the downstream workaround: a separate pytest session can delete another active session's containers.

Docker journal timeline:

• 18:20:53: SQLSpec MSSQL family starts pytest_databases_mssql.
• MSSQL tests pass through the first 37% of the family.
• 18:22:45: the MSSQL shim is deleted.
• 18:22:46: another pytest session starts pytest_databases_gizmosql.
• 18:23:32 and 18:23:35: that session starts pytest_databases_gizmosql-duckdb and pytest_databases_gizmosql-sqlite.
• The still-running MSSQL family then receives login timeouts because its service container no longer exists.

DockerService.__enter__() calls _stop_all_containers() once per pytest session, scoped only by that session's control file. The cleanup selects every container carrying the global pytest_databases label, so independent repositories/sessions sharing one Docker daemon can kill each other's live services.

The upstream fix likely needs a per-session ownership label and cleanup restricted to that owner, while retaining an explicit stale-container cleanup path. A global creation lock alone addresses the RootlessKit allocation race but not this cross-session lifecycle collision.

[provinzkraut]

I don't think I understand this. We don't assign the port directly, leaving it up to docker to find an available port. Are you saying that docker has a race condition there?

If so, that would be a bug in docker, not on our side. The current design is intentional, as it tries to avoid global locks and instead rely on docker to figure out how to safely find a free port.