didericis
d4b27ebf1f
Codex review: the /31 TAP doesn't make source IP unspoofable, and the app-layer token was returned by launch but never delivered or enforced, so a spoofed source could select a victim bottle's policy/tokens. Make the token mandatory and deliver it on each attributed plane (anti-spoof landed separately as the network boundary). Enforcement (control plane): - `Orchestrator.resolve` now requires a matching (source_ip, identity_token) pair (constant-time) — no source-IP-only fallback. `/resolve` fail-closes (403) on a missing/empty/mismatched token. Delivery, per plane (the token is `token_urlsafe`, safe in a URL): - egress: proxy credentials (`HTTPS_PROXY=http://bottle:<token>@gw`). The addon reads `Proxy-Authorization` — from the request (HTTP) or captured at the CONNECT for HTTPS tunnels (keyed by client conn, cleared on disconnect) — validates, and strips it (+ the legacy header) before upstream. - git-http: a URL-scoped `http.<gate>/.extraHeader: x-bot-bottle-identity` in the agent's git config (only over the http transport). - supervise: `mcp add --header x-bot-bottle-identity: <token>` (claude + codex); the server reads the header and passes it to resolve. Wiring: thread `ctx.identity_token` onto the firecracker + docker plans and into the agent env/config at launch. Verified on a KVM host: egress with the correct proxy-cred token returns 200 (HTTP and HTTPS/CONNECT), and no-token / wrong-token return 403; a real `cli.py start --backend=firecracker` launch provisions git config + the supervise MCP header and reaches the agent session, all under mandatory enforcement. Fixed a `claude mcp add` arg-order bug (--header must follow the positional name/url) found by that launch. Transparent proxy for tools that ignore proxy env is deferred to a follow-up (see thread); anti-spoof + host firewall remain the fail-closed boundary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
85 lines
3.0 KiB
Python
85 lines
3.0 KiB
Python
"""DockerBottlePlan — concrete subclass of BottlePlan.
|
|
|
|
Carries the Docker-specific resolved fields produced by
|
|
DockerBottleBackend.prepare. The launch step consumes it without
|
|
further resolution; preflight rendering is inherited from BottlePlan.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass, field
|
|
from pathlib import Path
|
|
|
|
from ...agent_provider import PromptMode
|
|
from .. import BottlePlan
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class DockerBottlePlan(BottlePlan):
|
|
"""Docker-specific resolved fields produced by
|
|
DockerBottleBackend.prepare. Inherits `spec`, `stage_dir`,
|
|
`git_gate_plan`, `egress_plan`, `supervise_plan`, and
|
|
`agent_provision` from BottlePlan."""
|
|
|
|
slug: str
|
|
# name -> value for vars forwarded into the docker-run child process
|
|
# via subprocess env (so values never land on argv or in a file).
|
|
# repr=False keeps secret/interpolated/OAuth values out of any
|
|
# accidental log of the plan dataclass.
|
|
forwarded_env: dict[str, str] = field(repr=False)
|
|
use_runsc: bool
|
|
# Consolidated mode (PRD 0070): the agent reaches git-gate over HTTP at the
|
|
# shared gateway's address (`http://<gateway_ip>:9420`), set at launch.
|
|
# Empty → single-tenant defaults (the `git-gate` alias over git://).
|
|
agent_git_gate_url: str = ""
|
|
# Likewise the supervise MCP endpoint at the gateway (`http://<gw>:9100/`);
|
|
# empty → the single-tenant `supervise` alias.
|
|
agent_supervise_url: str = ""
|
|
# Per-bottle identity token the agent presents on every attributed request
|
|
# (egress proxy credentials, git-gate/supervise headers); set by launch
|
|
# from the orchestrator registration. Empty pre-registration.
|
|
identity_token: str = ""
|
|
|
|
@property
|
|
def container_name(self) -> str:
|
|
return self.agent_provision.instance_name
|
|
|
|
@property
|
|
def git_gate_insteadof_host(self) -> str:
|
|
if self.agent_git_gate_url.startswith("http://"):
|
|
return self.agent_git_gate_url.removeprefix("http://").rstrip("/")
|
|
return super().git_gate_insteadof_host
|
|
|
|
@property
|
|
def git_gate_insteadof_scheme(self) -> str:
|
|
if self.agent_git_gate_url.startswith("http://"):
|
|
return "http"
|
|
return super().git_gate_insteadof_scheme
|
|
|
|
@property
|
|
def image(self) -> str:
|
|
return self.agent_provision.image
|
|
|
|
@property
|
|
def dockerfile_path(self) -> str:
|
|
"""Absolute path to the Dockerfile that builds `image`. Sourced
|
|
from the agent provision plan — the manifest may override per
|
|
bottle; otherwise the provider plugin's bundled Dockerfile."""
|
|
return self.agent_provision.dockerfile
|
|
|
|
@property
|
|
def prompt_file(self) -> Path:
|
|
return self.agent_provision.prompt_file
|
|
|
|
@property
|
|
def agent_command(self) -> str:
|
|
return self.agent_provision.command
|
|
|
|
@property
|
|
def agent_prompt_mode(self) -> PromptMode:
|
|
return self.agent_provision.prompt_mode
|
|
|
|
@property
|
|
def agent_provider_template(self) -> str:
|
|
return self.agent_provision.template
|