didericis
716928315e
Rewire DockerBottleBackend.launch to the consolidated model, replacing the
per-bottle sidecar bundle. VALIDATED END-TO-END on real docker:
test_sandbox_escape passes all 5 attacks (egress DLP + git-gate gitleaks)
through the shared gateway.
launch now:
- mints git-gate dynamic keys (if any), then launch_consolidated() to
register the bottle + provision its git-gate state into the gateway and
get the agent's attach context (pinned source IP, gateway address);
- installs the SHARED gateway CA (gateway.ca_cert_pem) into the agent;
- renders the agent-only consolidated compose on the gateway network at the
pinned IP, proxied through the gateway;
- points the agent's git-gate insteadOf (http://<gw>:9420) and supervise
MCP (http://<gw>:9100) at the gateway (DockerBottlePlan.agent_git_gate_url
/ agent_supervise_url);
- teardown = compose down + teardown_consolidated (dereg + deprovision).
Dropped the per-bottle networks, per-bottle egress CA, and bundle service.
Fixes surfaced by the real e2e (couldn't be caught by unit mocks):
- provision_git_gate installs the bottle-agnostic pre-receive/access hooks
into the gateway (were cp'd per-bundle before);
- source-IP allocation reads the *actual* container IPs on the network
(gateway + orchestrator + agents), not just gateway + registry — the
orchestrator container sits on the network and was colliding.
Unit tests for the old bundle launch rewritten against the new collaborators.
NOTE for reviewers: the gateway/bundle image (bot-bottle-sidecars) must be
rebuilt when its flat sources change — `ensure_built` only builds-if-missing,
so a stale image silently runs the OLD single-tenant daemons. A content-hash
/ --rebuild path is a follow-up.
pyright 0 errors; pylint 9.83/10; unit suite green (1760 tests; the 13
test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise);
test_sandbox_escape green on real docker.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
81 lines
2.8 KiB
Python
81 lines
2.8 KiB
Python
"""DockerBottlePlan — concrete subclass of BottlePlan.
|
|
|
|
Carries the Docker-specific resolved fields produced by
|
|
DockerBottleBackend.prepare. The launch step consumes it without
|
|
further resolution; preflight rendering is inherited from BottlePlan.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass, field
|
|
from pathlib import Path
|
|
|
|
from ...agent_provider import PromptMode
|
|
from .. import BottlePlan
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class DockerBottlePlan(BottlePlan):
|
|
"""Docker-specific resolved fields produced by
|
|
DockerBottleBackend.prepare. Inherits `spec`, `stage_dir`,
|
|
`git_gate_plan`, `egress_plan`, `supervise_plan`, and
|
|
`agent_provision` from BottlePlan."""
|
|
|
|
slug: str
|
|
# name -> value for vars forwarded into the docker-run child process
|
|
# via subprocess env (so values never land on argv or in a file).
|
|
# repr=False keeps secret/interpolated/OAuth values out of any
|
|
# accidental log of the plan dataclass.
|
|
forwarded_env: dict[str, str] = field(repr=False)
|
|
use_runsc: bool
|
|
# Consolidated mode (PRD 0070): the agent reaches git-gate over HTTP at the
|
|
# shared gateway's address (`http://<gateway_ip>:9420`), set at launch.
|
|
# Empty → single-tenant defaults (the `git-gate` alias over git://).
|
|
agent_git_gate_url: str = ""
|
|
# Likewise the supervise MCP endpoint at the gateway (`http://<gw>:9100/`);
|
|
# empty → the single-tenant `supervise` alias.
|
|
agent_supervise_url: str = ""
|
|
|
|
@property
|
|
def container_name(self) -> str:
|
|
return self.agent_provision.instance_name
|
|
|
|
@property
|
|
def git_gate_insteadof_host(self) -> str:
|
|
if self.agent_git_gate_url.startswith("http://"):
|
|
return self.agent_git_gate_url.removeprefix("http://").rstrip("/")
|
|
return super().git_gate_insteadof_host
|
|
|
|
@property
|
|
def git_gate_insteadof_scheme(self) -> str:
|
|
if self.agent_git_gate_url.startswith("http://"):
|
|
return "http"
|
|
return super().git_gate_insteadof_scheme
|
|
|
|
@property
|
|
def image(self) -> str:
|
|
return self.agent_provision.image
|
|
|
|
@property
|
|
def dockerfile_path(self) -> str:
|
|
"""Absolute path to the Dockerfile that builds `image`. Sourced
|
|
from the agent provision plan — the manifest may override per
|
|
bottle; otherwise the provider plugin's bundled Dockerfile."""
|
|
return self.agent_provision.dockerfile
|
|
|
|
@property
|
|
def prompt_file(self) -> Path:
|
|
return self.agent_provision.prompt_file
|
|
|
|
@property
|
|
def agent_command(self) -> str:
|
|
return self.agent_provision.command
|
|
|
|
@property
|
|
def agent_prompt_mode(self) -> PromptMode:
|
|
return self.agent_provision.prompt_mode
|
|
|
|
@property
|
|
def agent_provider_template(self) -> str:
|
|
return self.agent_provision.template
|