feat(sidecars): bundle image + init supervisor (PRD 0024 chunk 1) #55
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: didericis/bot-bottle#55
Reference in New Issue
Block a user
Delete Branch "prd-0024-chunk-1-bundle-image"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
PRD 0024 chunk 1: ships the
claude-bottle-sidecarsbundle image and its Python init supervisor. No renderer changes — chunk 2 wires the bundle into the docker compose flow behind a feature flag.Dockerfile.sidecarsis a multi-stage build that pulls the pinned pipelock and gitleaks binaries into a mitmproxy-base final image, installsgit+openssh-client, and drops in the project's existing egress addon + supervise server alongside the new init at/app/sidecar_init.py.claude_bottle/sidecar_init.pyis PID 1 in the bundle. It spawns the daemons listed inCLAUDE_BOTTLE_SIDECAR_DAEMONS(or all four by default), forwards SIGTERM/SIGINT with an 8s grace before SIGKILL, and exits with the first-unexpected-child exit code — implementing the "any unexpected death tears down the bundle" semantics PRD 0024 picked as the default for open question 1.claude_bottle/egress_entrypoint.shis the existing Dockerfile.egresssh -cENTRYPOINT extracted verbatim into a script so the supervisor can call it as a normal child.Tests
_selected_daemonsenv-var subset filtering (7 cases including whitespace, ordering, unknown names),_Supervisorend-to-end signal/exit-code semantics including SIGKILL escalation past the grace deadline, and an end-to-endmain()test that runs the supervisor as a real subprocess and sends it SIGTERM.Out of scope for this chunk
Dockerfile.{egress,git-gate,supervise}. Chunk 3.New Dockerfile.sidecars multi-stage build: pulls the pinned pipelock and gitleaks binaries into a mitmproxy-base final image, installs git + openssh-client, and ships the project's egress addon + supervise server alongside a stdlib-Python init at /app/sidecar_init.py. The init supervisor (claude_bottle/sidecar_init.py) is PID 1 in the bundle. It spawns the daemons named in CLAUDE_BOTTLE_SIDECAR_DAEMONS (or all four by default), propagates SIGTERM/SIGINT to children with an 8s grace before SIGKILL, and exits with the first-unexpected-child exit code so a daemon crash tears down the bundle (per PRD 0024 open question 1's default). claude_bottle/egress_entrypoint.sh extracted verbatim from Dockerfile.egress's prior inline sh -c so the supervisor can call it as a normal child. Tests: - unit: _selected_daemons env-var subset behavior (7 cases), _Supervisor signal/exit-code semantics including SIGKILL escalation, and end-to-end main() via subprocess. - integration: builds the image and probes that pipelock, gitleaks, mitmdump, and the supervise Python module are present + executable, plus a no-daemons-selected smoke test of the entrypoint wiring. Skipped under act_runner (200+MB base pulls + multi-stage build). Renderer collapse and the deletion of Dockerfile.{egress,git-gate, supervise} land in chunk 2 + 3. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>