didericis
4a607ad098
Adopts the firecracker infra-VM pattern for macOS: the orchestrator control plane and the gateway data plane now run in a SINGLE Apple container instead of two. Apple Containers are lightweight VMs with separate kernels, so the prior two-container design had both guests writing one bot-bottle.db over virtiofs, where fcntl locks are not coherent across kernels — concurrent writes (the orchestrator's registry vs the gateway supervise daemon's queue) could corrupt it. One container = one kernel = coherent locking. The DB moves onto a container-only Apple volume (bot-bottle-mac-db), never bind-mounted from the host, so no host process opens the live file either. The host CLI already reaches registry + supervise state over the control-plane HTTP surface (cli/supervise.py uses OrchestratorClient), exactly as firecracker's VM-only DB requires. Two simplifications fall out of the single container: - No DNS dance: the control plane and gateway daemons reach each other over 127.0.0.1, so the orchestrator-before-gateway ordering (a workaround for Apple having no container DNS) is gone, along with the moved-IP recreate logic it needed. - Net -243 lines. Mechanics: the infra container runs from the gateway image with the control-plane source bind-mounted read-only (like the docker orchestrator, so a code change needs no rebuild) and a small sh -c init that starts both processes (mirrors firecracker's _infra_init). Also implements the macOS backend's ensure_orchestrator() and adds it to discover_orchestrator_url, so operator tools (supervise) can bring up / find the control plane on demand — previously the macOS backend died with "no orchestrator control plane". Verified end-to-end on real Apple Container 1.0.0: the single infra container comes up healthy (one address for control plane + gateway), both processes run, the DB is written on the container-only volume, host-side supervise works over HTTP, and a registered agent gets 200 for an allowed host / 403 for a denied one. 1824 unit tests pass with `container` absent (CI parity), pyright clean, pylint 9.89. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
75 lines
2.8 KiB
Python
75 lines
2.8 KiB
Python
"""Unit: Apple Container cleanup/enumeration helpers."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
from bot_bottle.backend.macos_container import cleanup, enumerate as enum_mod
|
|
from bot_bottle.backend.macos_container.bottle_cleanup_plan import (
|
|
MacosContainerBottleCleanupPlan,
|
|
)
|
|
|
|
|
|
class TestMacosContainerCleanup(unittest.TestCase):
|
|
def test_lists_prefixed_containers(self):
|
|
completed = cleanup.subprocess.CompletedProcess(
|
|
args=[],
|
|
returncode=0,
|
|
stdout="bot-bottle-a\nbot-bottle-b\nother\n",
|
|
stderr="",
|
|
)
|
|
with patch.object(cleanup.subprocess, "run", return_value=completed):
|
|
self.assertEqual(
|
|
["bot-bottle-a", "bot-bottle-b"],
|
|
cleanup._list_prefixed_containers(),
|
|
)
|
|
|
|
def test_cleanup_deletes_containers_and_networks(self):
|
|
plan = MacosContainerBottleCleanupPlan(
|
|
containers=("bot-bottle-a",),
|
|
networks=("bot-bottle-net-a",),
|
|
)
|
|
with patch.object(cleanup.subprocess, "run") as run:
|
|
cleanup.cleanup(plan)
|
|
self.assertEqual(
|
|
["container", "delete", "--force", "bot-bottle-a"],
|
|
run.call_args_list[0].args[0],
|
|
)
|
|
self.assertEqual(
|
|
["container", "network", "delete", "bot-bottle-net-a"],
|
|
run.call_args_list[1].args[0],
|
|
)
|
|
|
|
|
|
class TestMacosContainerEnumerate(unittest.TestCase):
|
|
"""The backend launches bottles again (PRD 0070), so enumeration is real
|
|
rather than the disabled-era stub. These must not shell out: `container`
|
|
does not exist on the Linux CI host."""
|
|
|
|
def _enumerate(self, stdout: str, returncode: int = 0):
|
|
completed = enum_mod.subprocess.CompletedProcess(
|
|
args=[], returncode=returncode, stdout=stdout, stderr="",
|
|
)
|
|
with patch.object(enum_mod.subprocess, "run", return_value=completed), \
|
|
patch.object(enum_mod, "read_metadata", return_value=None):
|
|
return enum_mod.enumerate_active()
|
|
|
|
def test_lists_agent_containers_by_slug(self):
|
|
agents = self._enumerate("bot-bottle-dev-abc\nunrelated\n")
|
|
self.assertEqual(["dev-abc"], [a.slug for a in agents])
|
|
self.assertEqual(["macos-container"], [a.backend_name for a in agents])
|
|
|
|
def test_excludes_the_infra_singleton(self):
|
|
"""The infra container shares the bot-bottle- prefix but is
|
|
infrastructure — listing it would invent an agent per host."""
|
|
agents = self._enumerate("bot-bottle-mac-infra\nbot-bottle-dev-abc\n")
|
|
self.assertEqual(["dev-abc"], [a.slug for a in agents])
|
|
|
|
def test_empty_when_the_cli_fails(self):
|
|
self.assertEqual([], self._enumerate("", returncode=1))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|