didericis
bab44dbe97
The Firecracker backend's remaining host-Docker dependency is building users' agent Dockerfiles. Move that build *into the orchestrator VM*: give the orchestrator image buildah (rootless, daemonless) so it builds agent images itself, and the host needs no Docker daemon and no root-equivalent `docker` group. An untrusted Dockerfile then builds inside the confined orchestrator VM rather than on the host — strictly more isolated than host `docker build`. - buildah + crun (OCI runtime) + netavark/aardvark-dns (network backend for FROM pulls and RUN egress), installed explicitly since --no-install-recommends strips buildah's helper deps. - vfs storage + chroot isolation (STORAGE_DRIVER/BUILDAH_ISOLATION) so buildah needs neither fuse-overlayfs / an overlay kernel module nor configured subuid maps — it works unconditionally as root in a minimal microVM rootfs. (Slower than overlay; a build-cache pass is deferred.) Bootstrap: the orchestrator rootfs is still produced from this image via host docker export; a later step pulls a pre-built image instead. Verified: the orchestrator image boots as a Firecracker VM and buildah runs inside it as real VM root (reaches the base-image pull; build-time egress wiring is the next step). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
55 lines
2.7 KiB
Docker
55 lines
2.7 KiB
Docker
# Orchestrator control-plane image (PRD 0070, #384) + in-VM agent-image
|
|
# builder (PRD 0069 Stage 3).
|
|
#
|
|
# The per-host orchestrator runs `python3 -m bot_bottle.orchestrator`.
|
|
# The `bot_bottle` package is **stdlib-only** by design, so the control
|
|
# plane itself needs nothing but a Python runtime — none of the
|
|
# gateway's mitmproxy / git / gitleaks payload (that is the separate
|
|
# `bot-bottle-gateway` image, Dockerfile.gateway). Splitting them keeps
|
|
# the secret-dense control plane (it concentrates every bottle's egress
|
|
# tokens — see PRD 0070's "secret concentration") on a minimal
|
|
# dependency surface.
|
|
#
|
|
# The repo is bind-mounted read-only into the container at run time (see
|
|
# `orchestrator/lifecycle.py`), so the source is NOT copied in here: the
|
|
# image is just the runtime. `ensure_running` recreates the container
|
|
# only when the bind-mounted source hash changes (#381), which is why
|
|
# the code stays a mount rather than a baked layer.
|
|
|
|
FROM python:3.12-slim
|
|
|
|
# --- in-VM agent-image builder (PRD 0069 Stage 3) -------------------
|
|
# The Firecracker backend removes the host Docker daemon by building
|
|
# users' agent Dockerfiles *inside the orchestrator VM* with buildah
|
|
# (rootless, daemonless) instead of on the host. The host then needs no
|
|
# Docker daemon and no root-equivalent `docker` group; an untrusted
|
|
# Dockerfile builds inside the confined orchestrator VM, never on the
|
|
# host — strictly more isolated than host `docker build`.
|
|
#
|
|
# `git` lets buildah resolve git-context builds and lets the backend
|
|
# clone/pull; `ca-certificates` is needed for `FROM` pulls over TLS.
|
|
# buildah's runtime helpers (stripped by --no-install-recommends, so
|
|
# listed explicitly): `crun` is the OCI runtime that executes build
|
|
# steps; `netavark` + `aardvark-dns` are the network backend buildah
|
|
# uses to give `FROM` pulls and `RUN` steps network access.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
buildah crun netavark aardvark-dns git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# vfs storage + chroot isolation: buildah then needs neither
|
|
# fuse-overlayfs / an overlay kernel module nor configured subuid maps
|
|
# (newuidmap/newgidmap), so it works unconditionally as root in a
|
|
# minimal microVM rootfs. vfs copies layers rather than stacking them —
|
|
# slower and heavier than overlay; a build-cache optimization (overlay
|
|
# where available, a persistent cache disk) is tracked for later.
|
|
ENV STORAGE_DRIVER=vfs \
|
|
BUILDAH_ISOLATION=chroot
|
|
|
|
# No third-party *Python* deps — the control plane stays stdlib only.
|
|
WORKDIR /app
|
|
|
|
# Documentation only; lifecycle.py overrides the entrypoint to
|
|
# `python3 -m bot_bottle.orchestrator` with the runtime flags.
|
|
ENTRYPOINT ["python3", "-m", "bot_bottle.orchestrator"]
|