Files

T

didericis-claude 01bbf84973 feat(firecracker): implement consolidated orchestrator launch (PRD 0070)

Replace the per-bottle Docker sidecar bundle with the shared per-host
orchestrator + gateway, mirroring what the Docker backend already has.

- Add `bot_bottle/backend/firecracker/consolidated_launch.py`:
  `_FirecrackerOrchestratorService` (subclasses `OrchestratorService`,
  overrides `_gateway()` to return a `DockerGateway` with host port
  bindings so Firecracker VMs can reach it via their TAP link);
  `launch_consolidated()` registers the bottle by guest IP (attribution
  key), provisions git-gate into the shared gateway, and returns the
  shared CA + orchestrator URL for teardown; `teardown_consolidated()`
  deregisters and cleans up.

- Rewrite `bot_bottle/backend/firecracker/launch.py`: removes the
  per-bottle sidecar bundle (`_start_sidecar_bundle`, `_stage_git_gate`,
  etc.) and `_mint_certs`; wires `launch_consolidated()` instead. The VM
  still sends to `host_tap_ip:PORT` — Docker's PREROUTING DNAT + the nft
  `ct status dnat accept` rule in the forward chain route the traffic to
  the shared gateway container.

- Extend `DockerGateway` with `host_port_bindings` so the Firecracker
  gateway publishes its ports on the host (`0.0.0.0:PORT`).

- Parameterise `OrchestratorService` with `orchestrator_name` /
  `orchestrator_label` so Docker and Firecracker orchestrators can
  coexist on the same host (`bot-bottle-orchestrator` vs
  `bot-bottle-fc-orchestrator`).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-14 09:08:10 +00:00

canaries

chore: delete pipelock files and strip from manifest layer

2026-06-04 21:11:14 +00:00

integration

test(orchestrator): skip multitenant isolation under act_runner

2026-07-14 03:15:26 -04:00

unit

feat(firecracker): implement consolidated orchestrator launch (PRD 0070)

2026-07-14 09:08:10 +00:00

__init__.py

…

_docker.py

style: pass explicit check= to every subprocess.run call

2026-05-12 10:13:56 -04:00

fixtures.py

refactor(manifest): split Manifest into ManifestIndex + Manifest single-value type

2026-06-22 23:54:02 -04:00

README.md

docs: remove pipelock references from README, examples, and test docs

2026-06-06 05:08:59 +00:00

README.md

Tests

Plain-Python test suite using stdlib unittest. No external dependencies. Unit tests run anywhere Python 3 is present; integration tests need Docker and skip cleanly otherwise.

Layout

tests/
  fixtures.py                       # JSON manifest builders (shared)
  _docker.py                        # docker-availability skip helper (shared)
  unit/
    test_egress.py
    test_egress_addon_core.py
    test_manifest_egress.py
    test_dlp_detectors.py
    test_manifest_runtime.py
    ...                             # many others; see unit/ directory
  integration/
    test_sidecar_bundle_image.py
    test_sidecar_bundle_compose.py
    test_dry_run_plan.py
    test_orphan_cleanup.py
    ...
  canaries/                         # opt-in; see below (currently empty)

Classification falls out of the directory — no hand-maintained list to keep in sync.

Running

python -m unittest discover -t . -s tests/unit -v         # unit only
python -m unittest discover -t . -s tests/integration -v  # integration only
python -m unittest discover -t . -s tests -v              # both (recursive)
python -m unittest tests.unit.test_manifest_egress        # one file

Discovery is invoked with -t . (top-level dir = repo root) so the bot_bottle package on sys.path resolves correctly.

What the integration tests cover

test_dry_run_plan.py — cli.py start --dry-run --format=json emits a structured plan that contains the resolved egress allowlist and the bottle's runtime, and creates zero Docker resources.
test_orphan_cleanup.py — network_remove is idempotent against missing resources, so the EXIT trap can call it unconditionally.
test_sidecar_bundle_image.py — builds Dockerfile.sidecars and probes that gitleaks / mitmdump / supervise are all reachable inside the bundle.
test_sidecar_bundle_compose.py — end-to-end compose-up of an agent + bundle pair; verifies the agent reaches the bundle via the legacy network aliases.

Canaries

tests/canaries/ holds upstream-regression checks gated on BOT_BOTTLE_RUN_CANARIES=1 and not part of the per-push suite. They're invoked by the scheduled canaries workflow. Currently no canaries are defined.

BOT_BOTTLE_RUN_CANARIES=1 python -m unittest discover -t . -s tests/canaries -v

What's NOT covered

bot_bottle/ssh.py end-to-end (would need a fake SSH host inside the container).
A live SSH-through-git-gate tunnel against a real Tailscale-style IP.
DLP false-positive measurements.
TLS handling / cert pinning behavior.

Adding a test

Pick the directory: tests/unit/ for a pure unit test, tests/integration/ for one that needs Docker.
Filename: test_<topic>.py.

Boilerplate:

import unittest

from bot_bottle.<module> import <symbol>

class TestThing(unittest.TestCase):
    def test_x(self):
        ...

if __name__ == "__main__":
    unittest.main()

For Docker-dependent tests, decorate the class with @skip_unless_docker() from tests._docker.