fix: eliminate data races detected by -race flag

- Add sync.WaitGroup to DockerHandler to track background goroutines;
  Shutdown now waits for all goroutines to finish before nilling the
  provider, preventing the race between watchEvents/watchConfig/
  watchContainerPolling reads and Shutdown's write to dockerProvider.

- Fix TestProgressIndicator_Animate_TerminalMode: wait for the animate
  goroutine to fully exit before reading the shared bytes.Buffer,
  replacing the racy time.Sleep with a proper done-channel wait.

- Remove t.Parallel() from TestBoot_MissingConfigUsesEmpty,
  TestBoot_WebAuthEnabled_MissingUsername, and
  TestBoot_WebAuthEnabled_MissingPassword which all write to the global
  newDockerHandler variable concurrently.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>

Author: CybotTM

cli/daemon_cov_ext_test.go

@@ -40,7 +40,7 @@ func TestBoot_InvalidLogLevel(t *testing.T) {
 }
 
 func TestBoot_MissingConfigUsesEmpty(t *testing.T) {
-	t.Parallel()
+	// Not parallel - modifies global newDockerHandler
 
 	logger, handler := test.NewTestLoggerWithHandler()
 	lv := &slog.LevelVar{}
@@ -73,7 +73,7 @@ func TestBoot_MissingConfigUsesEmpty(t *testing.T) {
 }
 
 func TestBoot_WebAuthEnabled_MissingUsername(t *testing.T) {
-	t.Parallel()
+	// Not parallel - modifies global newDockerHandler
 
 	tmpDir := t.TempDir()
 	configPath := filepath.Join(tmpDir, "config.ini")
@@ -114,7 +114,7 @@ command = echo test
 }
 
 func TestBoot_WebAuthEnabled_MissingPassword(t *testing.T) {
-	t.Parallel()
+	// Not parallel - modifies global newDockerHandler
 
 	tmpDir := t.TempDir()
 	configPath := filepath.Join(tmpDir, "config.ini")

cli/docker_config_handler.go

@@ -40,6 +40,8 @@ type DockerHandler struct {
 	fallbackPollingActive bool
 	fallbackCancel        context.CancelFunc // To stop fallback polling when events recover
 
+	wg sync.WaitGroup // tracks background goroutines for clean shutdown
+
 	includeStopped bool // When true, ListContainers uses All: true so stopped containers are included
 }
 
@@ -132,17 +134,29 @@ func NewDockerHandler(
 
 	// Start config file watcher (separate from container detection)
 	if c.configPollInterval > 0 {
-		go c.watchConfig()
+		c.wg.Add(1)
+		go func() {
+			defer c.wg.Done()
+			c.watchConfig()
+		}()
 	}
 
 	// Start container detection
 	if c.useEvents {
-		go c.watchEvents()
+		c.wg.Add(1)
+		go func() {
+			defer c.wg.Done()
+			c.watchEvents()
+		}()
 	}
 
 	// Start explicit container polling (if enabled, separate from events)
 	if c.dockerPollInterval > 0 {
-		go c.watchContainerPolling()
+		c.wg.Add(1)
+		go func() {
+			defer c.wg.Done()
+			c.watchContainerPolling()
+		}()
 	}
 
 	return c, nil
@@ -435,6 +449,9 @@ func (c *DockerHandler) Shutdown(ctx context.Context) error {
 		c.cancel()
 	}
 
+	// Wait for all background goroutines to finish before closing provider
+	c.wg.Wait()
+
 	// Close SDK provider if it was created
 	if c.dockerProvider != nil {
 		if err := c.dockerProvider.Close(); err != nil {

cli/progress_cov_ext_test.go

@@ -32,14 +32,22 @@ func TestProgressIndicator_Animate_TerminalMode(t *testing.T) {
 		ticker:     ticker,
 	}
 
-	go progress.animate()
+	animateDone := make(chan struct{})
+	go func() {
+		progress.animate()
+		close(animateDone)
+	}()
 
 	// Let it animate a few frames
 	time.Sleep(50 * time.Millisecond)
 	close(done)
 
-	// Give goroutine time to exit
-	time.Sleep(10 * time.Millisecond)
+	// Wait for animate goroutine to finish before reading buffer
+	select {
+	case <-animateDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("animate goroutine did not exit after done was closed")
+	}
 
 	output := buf.String()
 	assert.NotEmpty(t, output, "animate should have written output")