didericis
21054212d4
Second step of PRD 0005. The mitmproxy sidecar from the previous commit now actually runs alongside pipelock when a bottle launches. - BottleBackend gains a non-abstract provision_ca with a default no-op so non-Docker backends aren't forced to implement TLS interception. provision() orchestrates ca → prompt → skills → ssh → git; CA goes first so trust is set up before anything else runs inside the agent. - DockerBottlePlan gains `mitmproxy_plan: MitmproxyProxyPlan`. The prepare step builds it alongside the existing pipelock plan; no new manifest schema or host-side scratch files. - DockerBottleBackend grows self._mitm, threads it through prepare and launch. Mirror of the existing self._proxy pattern. - launch.py brings the mitmproxy sidecar up between pipelock and the agent container, passing pipelock's service-name URL via env. ExitStack callback handles teardown in reverse order. - The agent's HTTPS_PROXY / HTTP_PROXY now point at mitmproxy (not pipelock directly). Three new -e flags inject the CA trust trio (NODE_EXTRA_CA_CERTS / SSL_CERT_FILE / REQUESTS_CA_BUNDLE) at docker run time; Docker propagates those into docker exec so the claude process sees them without per-exec threading. - New provisioner backend/docker/provision/ca.py extracts the CA cert from the running mitmproxy sidecar, copies it into the agent at /usr/local/share/ca-certificates/claude-bottle-mitm.crt, runs update-ca-certificates, and emits a stderr line with the SHA-256 fingerprint (stdlib ssl + hashlib; no subprocess). Cleanup needs no change — `docker ps --filter name=^claude-bottle-` already catches the new claude-bottle-mitm-<slug> containers. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
80 lines
2.7 KiB
Python
80 lines
2.7 KiB
Python
"""DockerBottleBackend — the Docker implementation of BottleBackend.
|
|
|
|
This module is a thin façade. The real work lives in three siblings:
|
|
|
|
- prepare.py — host-side resolution into a DockerBottlePlan
|
|
- launch.py — bring-up + teardown context manager
|
|
- cleanup.py — orphan enumeration, removal, and active listing
|
|
|
|
The base class's `prepare` template runs cross-backend host-side
|
|
validation before calling `_resolve_plan` here.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from contextlib import contextmanager
|
|
from pathlib import Path
|
|
from typing import Generator
|
|
|
|
from .. import BottleBackend, BottleSpec
|
|
from . import cleanup as _cleanup
|
|
from . import launch as _launch
|
|
from . import prepare as _prepare
|
|
from .bottle import DockerBottle
|
|
from .bottle_cleanup_plan import DockerBottleCleanupPlan
|
|
from .bottle_plan import DockerBottlePlan
|
|
from .mitmproxy import DockerMitmproxyProxy
|
|
from .pipelock import DockerPipelockProxy
|
|
from .provision import ca as _ca
|
|
from .provision import git as _git
|
|
from .provision import prompt as _prompt
|
|
from .provision import skills as _skills
|
|
from .provision import ssh as _ssh
|
|
|
|
|
|
class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanupPlan"]):
|
|
"""Docker backend implementation. Selected by CLAUDE_BOTTLE_BACKEND
|
|
(default)."""
|
|
|
|
name = "docker"
|
|
|
|
def __init__(self) -> None:
|
|
self._proxy = DockerPipelockProxy()
|
|
self._mitm = DockerMitmproxyProxy()
|
|
|
|
def _resolve_plan(self, spec: BottleSpec, *, stage_dir: Path) -> DockerBottlePlan:
|
|
return _prepare.resolve_plan(
|
|
spec, stage_dir=stage_dir, proxy=self._proxy, mitm=self._mitm,
|
|
)
|
|
|
|
@contextmanager
|
|
def launch(self, plan: DockerBottlePlan) -> Generator[DockerBottle, None, None]:
|
|
with _launch.launch(
|
|
plan, proxy=self._proxy, mitm=self._mitm, provision=self.provision,
|
|
) as bottle:
|
|
yield bottle
|
|
|
|
def provision_ca(self, plan: DockerBottlePlan, target: str) -> None:
|
|
_ca.provision_ca(plan, target)
|
|
|
|
def provision_prompt(self, plan: DockerBottlePlan, target: str) -> str | None:
|
|
return _prompt.provision_prompt(plan, target)
|
|
|
|
def provision_skills(self, plan: DockerBottlePlan, target: str) -> None:
|
|
_skills.provision_skills(plan, target)
|
|
|
|
def provision_ssh(self, plan: DockerBottlePlan, target: str) -> None:
|
|
_ssh.provision_ssh(plan, target)
|
|
|
|
def provision_git(self, plan: DockerBottlePlan, target: str) -> None:
|
|
_git.provision_git(plan, target)
|
|
|
|
def prepare_cleanup(self) -> DockerBottleCleanupPlan:
|
|
return _cleanup.prepare_cleanup()
|
|
|
|
def cleanup(self, plan: DockerBottleCleanupPlan) -> None:
|
|
_cleanup.cleanup(plan)
|
|
|
|
def list_active(self) -> None:
|
|
_cleanup.list_active()
|