container: don't copy stdin from a background TTY

cli/command/container/attach.go

@@ -103,7 +103,7 @@ func RunAttach(ctx context.Context, dockerCLI command.Cli, containerID string, o
 
 	var in io.ReadCloser
 	if options.Stdin {
-		in = dockerCLI.In()
+		in = stdinForAttach(dockerCLI.In())
 	}
 
 	if opts.Proxy && !c.Config.Tty {

cli/command/container/background.go

@@ -0,0 +1,16 @@
+package container
+
+import (
+	"io"
+
+	"github.com/docker/cli/cli/streams"
+)
+
+// stdinForAttach returns stdin for hijacking, or nil when copying it would
+// spin (a background job whose stdin is still the controlling TTY).
+func stdinForAttach(in *streams.In) io.ReadCloser {
+	if stdinFromBackgroundJob(in) {
+		return nil
+	}
+	return in
+}

cli/command/container/background_test.go

@@ -0,0 +1,22 @@
+package container
+
+import (
+	"os"
+	"testing"
+
+	"github.com/docker/cli/cli/streams"
+	"gotest.tools/v3/assert"
+)
+
+func TestStdinForAttachNonTTY(t *testing.T) {
+	r, w, err := os.Pipe()
+	assert.NilError(t, err)
+	t.Cleanup(func() {
+		_ = r.Close()
+		_ = w.Close()
+	})
+
+	in := streams.NewIn(r)
+	got := stdinForAttach(in)
+	assert.Equal(t, got, in)
+}

cli/command/container/background_unix.go

@@ -0,0 +1,25 @@
+//go:build !windows
+
+package container
+
+import (
+	"golang.org/x/sys/unix"
+
+	"github.com/docker/cli/cli/streams"
+)
+
+// stdinFromBackgroundJob reports whether stdin is a TTY whose foreground
+// process group is not us. Reading that TTY from a background job (for
+// example `docker run -i ... &`) produces SIGTTIN; the CLI catches every
+// signal for forwarding, so the default stop-in-background does not fire
+// and the read retries in a tight loop.
+func stdinFromBackgroundJob(in *streams.In) bool {
+	if in == nil || !in.IsTerminal() {
+		return false
+	}
+	fg, err := unix.IoctlGetInt(int(in.FD()), unix.TIOCGPGRP)
+	if err != nil {
+		return false
+	}
+	return unix.Getpgrp() != fg
+}

cli/command/container/background_windows.go

@@ -0,0 +1,7 @@
+package container
+
+import "github.com/docker/cli/cli/streams"
+
+func stdinFromBackgroundJob(_ *streams.In) bool {
+	return false
+}

cli/command/container/exec.go

@@ -144,7 +144,7 @@ func interactiveExec(ctx context.Context, dockerCli command.Cli, execOptions *cl
 	)
 
 	if execOptions.AttachStdin {
-		in = dockerCli.In()
+		in = stdinForAttach(dockerCli.In())
 	}
 	if execOptions.AttachStdout {
 		out = dockerCli.Out()

cli/command/container/run.go

@@ -277,7 +277,7 @@ func attachContainer(ctx context.Context, dockerCli command.Cli, containerID str
 		in        io.ReadCloser
 	)
 	if options.Stdin {
-		in = dockerCli.In()
+		in = stdinForAttach(dockerCli.In())
 	}
 	if options.Stdout {
 		out = dockerCli.Out()

cli/command/container/signals.go

@@ -44,7 +44,7 @@ func ForwardAllSignals(ctx context.Context, apiClient client.ContainerAPIClient,
 				break
 			}
 		}
-		if sig == "" {
+		if sig == "" || sig == "TTIN" || sig == "TTOU" {
 			continue
 		}
 

cli/command/container/start.go

@@ -112,7 +112,7 @@ func RunStart(ctx context.Context, dockerCli command.Cli, opts *StartOptions) er
 		var in io.ReadCloser
 
 		if options.Stdin {
-			in = dockerCli.In()
+			in = stdinForAttach(dockerCli.In())
 		}
 
 		resp, errAttach := dockerCli.Client().ContainerAttach(ctx, c.Container.ID, options)