didericis/bot-bottle
1
0
Fork 0
Code Issues 33 Pull Requests 3 Actions Packages Releases Wiki Activity

feat(docker): split orchestrator and gateway into separate containers (PRD 0070)
tracker-policy-pr / check-pr (pull_request) Successful in 6s
Details
test / integration-docker (pull_request) Successful in 13s
Details
test / unit (pull_request) Failing after 37s
Details
lint / lint (push) Successful in 57s
Details
test / integration-firecracker (pull_request) Successful in 3m19s
Details
test / coverage (pull_request) Has been skipped
Details
test / publish-infra (pull_request) Has been skipped
Details

Browse Source 
Now that #469 got the DB off the data plane, the docker backend runs the
control plane and data plane as two containers instead of the combined
`bot-bottle-infra` container:

  * bot-bottle-orchestrator — the lean control-plane container (image
    Dockerfile.orchestrator, `-m bot_bottle.orchestrator`). Joins the new
    `bot-bottle-orchestrator` control network (`--internal`) only, plus a
    host-loopback publish for the CLI. Sole opener of bot-bottle.db; holds the
    signing key; no CA, no gateway daemons.
  * bot-bottle-orch-gateway — the data-plane container (DockerGateway),
    dual-homed on the agent `bot-bottle-gateway` network AND the control
    network, so it resolves the orchestrator by name
    (http://bot-bottle-orchestrator:8099) while agents — never on the control
    network — have no route to the control plane (the L3 block, not just the
    JWT). Holds the gateway JWT + the mitmproxy CA.

DockerInfraService now orchestrates the pair (builds gateway + orchestrator
images, brings up the orchestrator then the gateway) and exposes gateway_name;
the launch flow attributes agents against the gateway container. DockerGateway
gains a control_network it joins after run. rotate_ca / the CA read target the
gateway container. The combined Dockerfile.infra is no longer built by docker
(firecracker/macOS still use it until their splits).

pyright 0 errors; unit suite green (2273). Integration tests updated for the
two-container shape but need a real-docker run to validate the networking.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
didericis
2026-07-25 02:32:05 -04:00
parent 7e9ad8a78d
commit d62d19a2e7
8 changed files with 298 additions and 243 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bot_bottle/orchestrator/rotate_ca.py
+4 -4
View File
@@ -26,11 +26,11 @@ from pathlib import Path
from ..backend.docker.util import run_docker
from ..paths import host_gateway_ca_dir
from ..gateway import GATEWAY_NAME, rotate_gateway_ca
from ..backend.docker.infra import INFRA_NAME
# The containers whose mitmproxy would still be serving the old CA from memory:
# the consolidated infra container and the standalone per-host gateway.
_GATEWAY_CONTAINERS = (INFRA_NAME, GATEWAY_NAME)
# The container whose mitmproxy would still be serving the old CA from memory:
# the per-host gateway (the data plane holds the CA; the split-out orchestrator
# never does).
_GATEWAY_CONTAINERS = (GATEWAY_NAME,)
def _out(msg: str) -> None: