309 lines
12 KiB
Python
309 lines
12 KiB
Python
"""Docker host-side primitives used by DockerBottleBackend: the lean
|
|
`run_docker` subprocess wrapper, probing for docker on PATH, slugifying agent
|
|
names, checking image/container existence, and building images."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
from datetime import datetime, timezone
|
|
import shutil
|
|
import subprocess
|
|
from typing import Iterator
|
|
|
|
from ... import resources
|
|
from ...log import die, info
|
|
from ...util import slugify as _slugify
|
|
|
|
|
|
def slugify(name: str) -> str:
|
|
"""Compatibility wrapper; new generic callers import ``bot_bottle.util``."""
|
|
return _slugify(name)
|
|
|
|
|
|
def run_docker(
|
|
argv: list[str], *, env: dict[str, str] | None = None,
|
|
) -> subprocess.CompletedProcess[str]:
|
|
"""Run a `docker` command, capturing stdout/stderr as text. Never raises on
|
|
a non-zero exit — callers inspect `returncode` / `stderr` so they can stay
|
|
fail-closed or tolerate idempotent no-ops (e.g. removing an already-absent
|
|
container).
|
|
|
|
`env` sets the child process environment — used to hand a secret to a bare
|
|
`--env NAME` flag (docker inherits its value from this process) so the value
|
|
never lands on argv or in `docker inspect`'s recorded command line."""
|
|
return subprocess.run(
|
|
argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
|
|
check=False, env=env,
|
|
)
|
|
|
|
|
|
# Cap on the suffix the container-name conflict logic will try before
|
|
# giving up: base, base-2, ..., base-MAX_CONTAINER_SUFFIX.
|
|
MAX_CONTAINER_SUFFIX = 100
|
|
|
|
|
|
def container_name_candidates(base: str) -> Iterator[str]:
|
|
"""Yield `base`, then `base-2`, `base-3`, ... up to
|
|
`base-MAX_CONTAINER_SUFFIX`. Both the prepare-time probe and the
|
|
launch-time race retry walk this sequence."""
|
|
yield base
|
|
for suffix in range(2, MAX_CONTAINER_SUFFIX + 1):
|
|
yield f"{base}-{suffix}"
|
|
|
|
|
|
def runsc_available() -> bool:
|
|
"""Return True if the Docker daemon has the gVisor (`runsc`) runtime
|
|
registered. Called once per prepare; the result lives on the plan."""
|
|
r = run_docker(["docker", "info", "--format", "{{json .Runtimes}}"])
|
|
return r.returncode == 0 and "runsc" in r.stdout
|
|
|
|
|
|
def require_docker() -> None:
|
|
"""Fail with an install pointer if `docker` is not on PATH."""
|
|
if shutil.which("docker") is None:
|
|
info("Docker is required but was not found on PATH.")
|
|
info("macOS: install Docker Desktop https://docs.docker.com/desktop/install/mac-install/")
|
|
info("Linux: install Docker Engine https://docs.docker.com/engine/install/")
|
|
die("docker not found")
|
|
|
|
|
|
def image_exists(ref: str) -> bool:
|
|
return run_docker(["docker", "image", "inspect", ref]).returncode == 0
|
|
|
|
|
|
def container_exists(name: str) -> bool:
|
|
"""Returns True if a container (running or stopped) with the given
|
|
name exists. Uses `docker ps -a -q -f name=^<name>$` so substring
|
|
matches don't false-positive."""
|
|
result = run_docker(["docker", "ps", "-a", "-q", "-f", f"name=^{name}$"])
|
|
return result.returncode == 0 and bool(result.stdout.strip())
|
|
|
|
|
|
def force_remove_container(name: str) -> None:
|
|
"""`docker rm -f` the named container if it exists. No-op if it
|
|
doesn't — and the rm itself is best-effort (errors swallowed) so
|
|
this is safe to register as a teardown callback."""
|
|
if container_exists(name):
|
|
run_docker(["docker", "rm", "-f", name])
|
|
|
|
|
|
def docker_exec_root(container: str, argv: list[str]) -> None:
|
|
"""Run `docker exec -u 0` in the named container, check=True. Used
|
|
by SSH provisioning to chown/chmod files that need root."""
|
|
subprocess.run(
|
|
["docker", "exec", "-u", "0", container, *argv],
|
|
stdout=subprocess.DEVNULL,
|
|
check=True,
|
|
)
|
|
|
|
|
|
def docker_exec(container: str, argv: list[str], *, user: str = "") -> None:
|
|
"""Run `docker exec` in the named container, dying with the
|
|
command's own stderr on failure. Pass `user=\"0\"` to run as root."""
|
|
cmd = ["docker", "exec"]
|
|
if user:
|
|
cmd += ["-u", user]
|
|
cmd += [container, *argv]
|
|
result = run_docker(cmd)
|
|
if result.returncode != 0:
|
|
die(
|
|
f"docker exec in {container} failed: "
|
|
f"{(result.stderr or '').strip() or '<no stderr>'}"
|
|
)
|
|
|
|
|
|
def docker_cp(src: str, dest: str) -> None:
|
|
"""Run `docker cp`, dying with the command's own stderr on failure."""
|
|
result = run_docker(["docker", "cp", src, dest])
|
|
if result.returncode != 0:
|
|
die(f"docker cp {src} -> {dest} failed: "
|
|
f"{(result.stderr or '').strip() or '<no stderr>'}")
|
|
|
|
|
|
def build_image(
|
|
ref: str,
|
|
context: str,
|
|
*,
|
|
dockerfile: str = "",
|
|
build_args: dict[str, str] | None = None,
|
|
) -> None:
|
|
"""Invokes `docker build` every call. Layer cache makes no-change
|
|
rebuilds cheap; running every time means Dockerfile edits land
|
|
without manual `docker rmi`.
|
|
|
|
`dockerfile` is an optional path (relative to `context`, or
|
|
absolute) for callers that need to build from a non-default
|
|
Dockerfile in the same context — e.g. `Dockerfile.git-gate`.
|
|
|
|
Set `BOT_BOTTLE_NO_CACHE=1` (the `start --no-cache` flag) to force
|
|
`--no-cache`. The npm/curl installers some provider Dockerfiles
|
|
shell out to can silently no-op on a transient network failure —
|
|
e.g. an `optionalDependencies` fetch for a platform-native binary —
|
|
and Docker will then cache that broken layer indefinitely."""
|
|
info(f"building image {ref} from {context} (layer cache keeps repeat builds fast)")
|
|
args = ["docker", "build", "-t", ref]
|
|
if os.environ.get("BOT_BOTTLE_NO_CACHE") == "1":
|
|
args.append("--no-cache")
|
|
if dockerfile:
|
|
args.extend(["-f", dockerfile])
|
|
effective_build_args = resources.image_build_args(
|
|
dockerfile,
|
|
context=context,
|
|
) if dockerfile else {}
|
|
effective_build_args.update(build_args or {})
|
|
for name, value in effective_build_args.items():
|
|
args.extend(["--build-arg", f"{name}={value}"])
|
|
args.append(context)
|
|
subprocess.run(args, check=True)
|
|
|
|
|
|
def image_id(ref: str) -> str:
|
|
"""Return the exact content-addressed ID for a local image.
|
|
|
|
This is used when one locally built image is another Dockerfile's base:
|
|
passing the ID prevents a mutable tag from being resolved between builds.
|
|
"""
|
|
result = run_docker(["docker", "image", "inspect", "--format", "{{.Id}}", ref])
|
|
image = result.stdout.strip()
|
|
if result.returncode != 0 or not image.startswith("sha256:"):
|
|
detail = (result.stderr or result.stdout or "").strip()
|
|
die(f"could not resolve exact image ID for {ref!r}: {detail or '<no detail>'}")
|
|
return image
|
|
|
|
|
|
def pinned_local_image_ref(ref: str) -> str:
|
|
"""Give a local image a content-derived tag and verify the tag resolves
|
|
back to the same image ID.
|
|
|
|
BuildKit treats a bare ``sha256:...`` ID in ``FROM`` as a registry
|
|
repository name. A tag whose complete suffix is the local image ID remains
|
|
resolvable by BuildKit, while the post-tag inspection keeps the handoff
|
|
fail-closed.
|
|
"""
|
|
image = image_id(ref)
|
|
digest = image.removeprefix("sha256:")
|
|
if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
|
|
die(f"could not derive a local base tag from invalid image ID {image!r}")
|
|
|
|
repository = ref.split("@", 1)[0]
|
|
last_slash = repository.rfind("/")
|
|
last_colon = repository.rfind(":")
|
|
if last_colon > last_slash:
|
|
repository = repository[:last_colon]
|
|
pinned_ref = f"{repository}:sha256-{digest}"
|
|
|
|
result = run_docker(["docker", "image", "tag", image, pinned_ref])
|
|
if result.returncode != 0:
|
|
detail = (result.stderr or result.stdout or "").strip()
|
|
die(f"could not tag exact local image {image}: {detail or '<no detail>'}")
|
|
if image_id(pinned_ref) != image:
|
|
die(f"content-derived local tag {pinned_ref!r} did not resolve to {image}")
|
|
return pinned_ref
|
|
|
|
|
|
def verify_agent_image(image: str, argv: tuple[str, ...]) -> None:
|
|
"""Run `argv` inside a throwaway container of a freshly built agent
|
|
image and die loudly if it fails, instead of shipping an image
|
|
whose CLI only breaks at first real use. No-op when the provider
|
|
hasn't declared a smoke test (`AgentProviderRuntime.smoke_test`)."""
|
|
if not argv:
|
|
return
|
|
result = run_docker(["docker", "run", "--rm", "--entrypoint", argv[0], image, *argv[1:]])
|
|
if result.returncode != 0:
|
|
detail = (result.stderr or result.stdout or "").strip()
|
|
die(
|
|
f"agent image {image!r} failed its post-build smoke test "
|
|
f"({' '.join(argv)}): {detail}\n"
|
|
f"Try rebuilding from scratch: bot-bottle start --no-cache"
|
|
)
|
|
|
|
|
|
# def build_image_with_cwd(
|
|
# derived: str,
|
|
# base: str,
|
|
# workspace: "WorkspacePlan",
|
|
# ) -> None:
|
|
# """Build a thin derived image that copies the workspace into
|
|
# the plan's guest path and sets the plan's workdir."""
|
|
# import os
|
|
#
|
|
# cwd = str(workspace.host_path)
|
|
# if not os.path.isdir(cwd):
|
|
# die(f"cwd not found at {cwd}")
|
|
# info(f"building image {derived} from {base} with {cwd} -> {workspace.guest_path}")
|
|
# with tempfile.TemporaryDirectory(prefix="bot-bottle-cwd.") as tmp:
|
|
# context_dir = os.path.join(tmp, "context")
|
|
# staged_workspace = os.path.join(context_dir, "workspace")
|
|
# shutil.copytree(
|
|
# cwd,
|
|
# staged_workspace,
|
|
# symlinks=True,
|
|
# ignore=shutil.ignore_patterns(".git"),
|
|
# )
|
|
# dockerfile = (
|
|
# f"FROM {base}\n"
|
|
# f"COPY --chown=node:node workspace/. {workspace.guest_path}\n"
|
|
# f"WORKDIR {workspace.workdir}\n"
|
|
# )
|
|
# subprocess.run(
|
|
# ["docker", "build", "-t", derived, "-f", "-", context_dir],
|
|
# input=dockerfile,
|
|
# text=True,
|
|
# check=True,
|
|
# )
|
|
|
|
|
|
def commit_container(container_name: str, image_tag: str) -> None:
|
|
"""Run `docker commit <container_name> <image_tag>` to snapshot the
|
|
running container's filesystem state as a local Docker image."""
|
|
result = run_docker(["docker", "commit", container_name, image_tag])
|
|
if result.returncode != 0:
|
|
die(
|
|
f"docker commit {container_name!r} → {image_tag!r} failed: "
|
|
f"{(result.stderr or '').strip() or '<no stderr>'}"
|
|
)
|
|
info(f"committed {container_name!r} → {image_tag!r}")
|
|
|
|
|
|
def image_created_at(ref: str) -> datetime | None:
|
|
"""Return Docker's image Created timestamp as an aware UTC datetime, or
|
|
None when the field is absent or unparseable. Callers should skip the
|
|
stale check when None is returned."""
|
|
r = subprocess.run(
|
|
["docker", "image", "inspect", "--format", "{{.Created}}", ref],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
if r.returncode != 0:
|
|
die(
|
|
f"docker image inspect for {ref!r} failed: "
|
|
f"{(r.stderr or '').strip() or '<no stderr>'}"
|
|
)
|
|
raw = r.stdout.strip()
|
|
if not raw:
|
|
return None
|
|
try:
|
|
return _parse_docker_timestamp(raw)
|
|
except ValueError:
|
|
return None
|
|
|
|
|
|
def _parse_docker_timestamp(raw: str) -> datetime:
|
|
text = raw.strip()
|
|
if text.endswith("Z"):
|
|
text = text[:-1] + "+00:00"
|
|
dot = text.find(".")
|
|
if dot != -1:
|
|
tz_plus = text.find("+", dot)
|
|
tz_minus = text.find("-", dot)
|
|
tz_candidates = [pos for pos in (tz_plus, tz_minus) if pos != -1]
|
|
if tz_candidates:
|
|
tz_pos = min(tz_candidates)
|
|
frac = text[dot + 1:tz_pos]
|
|
text = text[:dot + 1] + frac[:6].ljust(6, "0") + text[tz_pos:]
|
|
dt = datetime.fromisoformat(text)
|
|
if dt.tzinfo is None:
|
|
dt = dt.replace(tzinfo=timezone.utc)
|
|
return dt.astimezone(timezone.utc)
|