didericis
86a9b499bc
Second step of PRD 0006. With pipelock now doing the bumping, the agent's TLS library has to trust pipelock's per-bottle CA — or every CONNECT to api.anthropic.com is a self-signed-cert error. - BottleBackend.provision gains a non-abstract `provision_ca` with a default no-op (so non-Docker backends aren't forced to implement TLS interception) and orchestrates ca → prompt → skills → ssh → git. CA install runs first so the agent's trust store is rebuilt before anything else in the agent makes a TLS call. - New backend/docker/provision/ca.py: docker-cp's the CA cert into the agent at /usr/local/share/ca-certificates/..., `update-ca-certificates`, then emits a one-line stderr log with the SHA-256 fingerprint (stdlib `ssl` + `hashlib`; no subprocess for crypto). Module-level constants AGENT_CA_PATH and AGENT_CA_BUNDLE are imported by launch.py so the env trio set at docker run time matches the paths the provisioner writes. - launch.py: rebinds `plan` after `dataclasses.replace`s on the pipelock proxy plan so provision_ca (which reads `plan.proxy_plan.ca_cert_host_path`) sees the populated CA paths. Three new -e flags on the agent's docker run for the NODE_EXTRA_CA_CERTS / SSL_CERT_FILE / REQUESTS_CA_BUNDLE trio. - Dockerfile: adds curl to the apt-get install line. curl natively respects HTTPS_PROXY and sends CONNECT directly — the agent doesn't need OS-level DNS for external hostnames (pipelock resolves them on its side of the bumped tunnel). This is the "simple HTTPS request" path the earlier turn needed and Node's stdlib https.request couldn't provide. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
74 lines
2.6 KiB
Python
74 lines
2.6 KiB
Python
"""DockerBottleBackend — the Docker implementation of BottleBackend.
|
|
|
|
This module is a thin façade. The real work lives in three siblings:
|
|
|
|
- prepare.py — host-side resolution into a DockerBottlePlan
|
|
- launch.py — bring-up + teardown context manager
|
|
- cleanup.py — orphan enumeration, removal, and active listing
|
|
|
|
The base class's `prepare` template runs cross-backend host-side
|
|
validation before calling `_resolve_plan` here.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from contextlib import contextmanager
|
|
from pathlib import Path
|
|
from typing import Generator
|
|
|
|
from .. import BottleBackend, BottleSpec
|
|
from . import cleanup as _cleanup
|
|
from . import launch as _launch
|
|
from . import prepare as _prepare
|
|
from .bottle import DockerBottle
|
|
from .bottle_cleanup_plan import DockerBottleCleanupPlan
|
|
from .bottle_plan import DockerBottlePlan
|
|
from .pipelock import DockerPipelockProxy
|
|
from .provision import ca as _ca
|
|
from .provision import git as _git
|
|
from .provision import prompt as _prompt
|
|
from .provision import skills as _skills
|
|
from .provision import ssh as _ssh
|
|
|
|
|
|
class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanupPlan"]):
|
|
"""Docker backend implementation. Selected by CLAUDE_BOTTLE_BACKEND
|
|
(default)."""
|
|
|
|
name = "docker"
|
|
|
|
def __init__(self) -> None:
|
|
self._proxy = DockerPipelockProxy()
|
|
|
|
def _resolve_plan(self, spec: BottleSpec, *, stage_dir: Path) -> DockerBottlePlan:
|
|
return _prepare.resolve_plan(spec, stage_dir=stage_dir, proxy=self._proxy)
|
|
|
|
@contextmanager
|
|
def launch(self, plan: DockerBottlePlan) -> Generator[DockerBottle, None, None]:
|
|
with _launch.launch(plan, proxy=self._proxy, provision=self.provision) as bottle:
|
|
yield bottle
|
|
|
|
def provision_ca(self, plan: DockerBottlePlan, target: str) -> None:
|
|
_ca.provision_ca(plan, target)
|
|
|
|
def provision_prompt(self, plan: DockerBottlePlan, target: str) -> str | None:
|
|
return _prompt.provision_prompt(plan, target)
|
|
|
|
def provision_skills(self, plan: DockerBottlePlan, target: str) -> None:
|
|
_skills.provision_skills(plan, target)
|
|
|
|
def provision_ssh(self, plan: DockerBottlePlan, target: str) -> None:
|
|
_ssh.provision_ssh(plan, target)
|
|
|
|
def provision_git(self, plan: DockerBottlePlan, target: str) -> None:
|
|
_git.provision_git(plan, target)
|
|
|
|
def prepare_cleanup(self) -> DockerBottleCleanupPlan:
|
|
return _cleanup.prepare_cleanup()
|
|
|
|
def cleanup(self, plan: DockerBottleCleanupPlan) -> None:
|
|
_cleanup.cleanup(plan)
|
|
|
|
def list_active(self) -> None:
|
|
_cleanup.list_active()
|