didericis
b676ce3156
test / integration-docker (pull_request) Successful in 18s
tracker-policy-pr / check-pr (pull_request) Successful in 22s
test / unit (pull_request) Failing after 42s
lint / lint (push) Successful in 57s
test / integration-firecracker (pull_request) Successful in 3m22s
test / coverage (pull_request) Has been skipped
test / publish-infra (pull_request) Has been skipped
The single Apple container existed only because two guests writing one bot-bottle.db over virtiofs would race incoherent fcntl locks; #469 removed that (the data plane no longer opens the DB), so the macOS backend now runs the planes as two containers like docker: * bot-bottle-mac-orchestrator — lean control plane on the host-only `bot-bottle-mac-control` network only (image Dockerfile.orchestrator, `-m bot_bottle.orchestrator`). Sole mounter of the container-only DB volume; holds the signing key. The CLI + gateway reach it at its control-network address. * bot-bottle-mac-infra — the gateway, triple-homed on the NAT egress net, the host-only agent net, and the control net. Resolves the orchestrator by IP (Apple has no container DNS) via BOT_BOTTLE_ORCHESTRATOR_URL; holds the CA + gateway JWT. Agents sit on the agent network only, so they have no route to the control plane. ensure_networks gains the control network; MacosInfraService brings up the orchestrator then the gateway; probe_orchestrator_url + ca_cert_pem target the right containers. pyright 0 errors; unit suite green (2274). Needs a real Apple-container host to validate the networking. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
60 lines
2.2 KiB
Python
60 lines
2.2 KiB
Python
"""Shared network/image constants for the macOS consolidated infra container.
|
|
|
|
The gateway data plane no longer runs as its own Apple container — it shares a
|
|
single per-host **infra container** with the control plane (see `infra`),
|
|
because two Apple-Container guests writing one `bot-bottle.db` over virtiofs
|
|
would race incoherent `fcntl` locks. This module holds the pieces both the
|
|
infra service and the launch/provision glue need: the network names, the
|
|
gateway image, and the network-creation helper.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
from ...gateway import GatewayError
|
|
from . import util as container_mod
|
|
|
|
# The shared host-only network the infra container and every agent bottle sit
|
|
# on. The agent's address here is the attribution key. Distinct from the docker
|
|
# names so both backends can coexist on one host.
|
|
GATEWAY_NETWORK = "bot-bottle-mac-gateway"
|
|
# The NAT network that gives the gateway (and only it) a route out.
|
|
GATEWAY_EGRESS_NETWORK = "bot-bottle-mac-egress"
|
|
# The control network the gateway reaches the orchestrator over (host-only).
|
|
# Only the orchestrator + gateway join it; agents never do, so agents have no
|
|
# route to the control plane (PRD 0070 "Separating the planes").
|
|
CONTROL_NETWORK = "bot-bottle-mac-control"
|
|
|
|
GATEWAY_IMAGE = os.environ.get("BOT_BOTTLE_GATEWAY_IMAGE", "bot-bottle-gateway:latest")
|
|
ORCHESTRATOR_IMAGE = os.environ.get(
|
|
"BOT_BOTTLE_ORCHESTRATOR_IMAGE", "bot-bottle-orchestrator:latest"
|
|
)
|
|
|
|
DEFAULT_CA_TIMEOUT_SECONDS = 30.0
|
|
|
|
|
|
def ensure_networks(
|
|
network: str = GATEWAY_NETWORK,
|
|
egress_network: str = GATEWAY_EGRESS_NETWORK,
|
|
control_network: str = CONTROL_NETWORK,
|
|
) -> None:
|
|
"""Create the shared host-only agent network, the NAT egress network, and
|
|
the host-only control network. Idempotent — `create_network` tolerates
|
|
'already exists'."""
|
|
container_mod.create_network(egress_network)
|
|
container_mod.create_network(network, internal=True)
|
|
container_mod.create_network(control_network, internal=True)
|
|
|
|
|
|
__all__ = [
|
|
"GATEWAY_NETWORK",
|
|
"GATEWAY_EGRESS_NETWORK",
|
|
"CONTROL_NETWORK",
|
|
"GATEWAY_IMAGE",
|
|
"ORCHESTRATOR_IMAGE",
|
|
"GatewayError",
|
|
"DEFAULT_CA_TIMEOUT_SECONDS",
|
|
"ensure_networks",
|
|
]
|