didericis
69db629e16
Rewire DockerBottleBackend.launch to the consolidated model, replacing the
per-bottle sidecar bundle. VALIDATED END-TO-END on real docker:
test_sandbox_escape passes all 5 attacks (egress DLP + git-gate gitleaks)
through the shared gateway.
launch now:
- mints git-gate dynamic keys (if any), then launch_consolidated() to
register the bottle + provision its git-gate state into the gateway and
get the agent's attach context (pinned source IP, gateway address);
- installs the SHARED gateway CA (gateway.ca_cert_pem) into the agent;
- renders the agent-only consolidated compose on the gateway network at the
pinned IP, proxied through the gateway;
- points the agent's git-gate insteadOf (http://<gw>:9420) and supervise
MCP (http://<gw>:9100) at the gateway (DockerBottlePlan.agent_git_gate_url
/ agent_supervise_url);
- teardown = compose down + teardown_consolidated (dereg + deprovision).
Dropped the per-bottle networks, per-bottle egress CA, and bundle service.
Fixes surfaced by the real e2e (couldn't be caught by unit mocks):
- provision_git_gate installs the bottle-agnostic pre-receive/access hooks
into the gateway (were cp'd per-bundle before);
- source-IP allocation reads the *actual* container IPs on the network
(gateway + orchestrator + agents), not just gateway + registry — the
orchestrator container sits on the network and was colliding.
Unit tests for the old bundle launch rewritten against the new collaborators.
NOTE for reviewers: the gateway/bundle image (bot-bottle-sidecars) must be
rebuilt when its flat sources change — `ensure_built` only builds-if-missing,
so a stale image silently runs the OLD single-tenant daemons. A content-hash
/ --rebuild path is a follow-up.
pyright 0 errors; pylint 9.83/10; unit suite green (1760 tests; the 13
test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise);
test_sandbox_escape green on real docker.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
101 lines
4.2 KiB
Python
101 lines
4.2 KiB
Python
"""Provision one bottle's git-gate state into the running shared gateway
|
|
(PRD 0070, docker slice).
|
|
|
|
The consolidated gateway serves every bottle's repos under `/git/<bottle_id>/`
|
|
with per-repo credentials under `/git-gate/creds/<bottle_id>/`. When a bottle
|
|
is registered the launcher must place *its* deploy keys + known_hosts into
|
|
that per-bottle creds dir and init its bare repos there — so this copies the
|
|
credential files into the live gateway container and runs the (namespaced,
|
|
init-only) provisioning script produced by `git_gate_render_provision`.
|
|
|
|
Isolating each bottle's creds dir + repo root by id is what keeps one
|
|
bottle's push credentials out of another's repos on the shared gateway.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
|
|
from ...docker_cmd import run_docker
|
|
from ...git_gate import GitGatePlan, git_gate_render_provision
|
|
|
|
# bottle ids index the gateway's per-bottle repo + creds dirs; they land in
|
|
# `docker cp`/`rm` path arguments, so validate before any path is built (a
|
|
# traversal id like "../etc" must never reach the container). Registry ids are
|
|
# token_hex — this is defense in depth at the docker boundary.
|
|
_SAFE_BOTTLE_ID = re.compile(r"[A-Za-z0-9_-]+")
|
|
|
|
|
|
class GatewayProvisionError(RuntimeError):
|
|
"""A git-gate provisioning step against the running gateway failed."""
|
|
|
|
|
|
def _require_safe(bottle_id: str) -> None:
|
|
if not _SAFE_BOTTLE_ID.fullmatch(bottle_id):
|
|
raise GatewayProvisionError(f"unsafe bottle id {bottle_id!r}")
|
|
|
|
|
|
def _creds_dir(bottle_id: str) -> str:
|
|
return f"/git-gate/creds/{bottle_id}"
|
|
|
|
|
|
def _exec(gateway: str, argv: list[str]) -> None:
|
|
"""`docker exec` a command in the gateway, raising on non-zero exit."""
|
|
proc = run_docker(["docker", "exec", gateway, *argv])
|
|
if proc.returncode != 0:
|
|
raise GatewayProvisionError(
|
|
f"gateway exec {argv!r} failed: {proc.stderr.strip()}"
|
|
)
|
|
|
|
|
|
def _cp_into(gateway: str, src: str, dest: str) -> None:
|
|
"""`docker cp` a host file into the gateway, raising on non-zero exit."""
|
|
proc = run_docker(["docker", "cp", src, f"{gateway}:{dest}"])
|
|
if proc.returncode != 0:
|
|
raise GatewayProvisionError(
|
|
f"gateway cp {src} -> {dest} failed: {proc.stderr.strip()}"
|
|
)
|
|
|
|
|
|
def provision_git_gate(gateway: str, bottle_id: str, plan: GitGatePlan) -> None:
|
|
"""Place `bottle_id`'s git-gate credentials into the running `gateway`
|
|
container and init its bare repos under `/git/<bottle_id>/`.
|
|
|
|
Copies each upstream's identity key (and known_hosts, when present) into
|
|
`/git-gate/creds/<bottle_id>/`, then runs the namespaced provisioning
|
|
script. No-op for a bottle with no git upstreams."""
|
|
_require_safe(bottle_id)
|
|
if not plan.upstreams:
|
|
return
|
|
# The pre-receive + access hooks are bottle-agnostic and shared by every
|
|
# bottle's repos; install them into the gateway (idempotent — same content
|
|
# each time). The per-bottle model cp'd these into each bundle at start.
|
|
_exec(gateway, ["mkdir", "-p", "/etc/git-gate"])
|
|
_cp_into(gateway, str(plan.hook_script), "/etc/git-gate/pre-receive")
|
|
_cp_into(gateway, str(plan.access_hook_script), "/etc/git-gate/access-hook")
|
|
creds = _creds_dir(bottle_id)
|
|
_exec(gateway, ["mkdir", "-p", creds])
|
|
for u in plan.upstreams:
|
|
if u.identity_file:
|
|
_cp_into(gateway, u.identity_file, f"{creds}/{u.name}-key")
|
|
known_hosts = str(u.known_hosts_file)
|
|
if known_hosts and known_hosts != ".":
|
|
_cp_into(gateway, known_hosts, f"{creds}/{u.name}-known_hosts")
|
|
# Init the bare repos + per-repo credential config for this namespace.
|
|
script = git_gate_render_provision(bottle_id, plan.upstreams)
|
|
_exec(gateway, ["sh", "-c", script])
|
|
|
|
|
|
def deprovision_git_gate(gateway: str, bottle_id: str) -> None:
|
|
"""Remove a bottle's repos + creds from the gateway on teardown. Idempotent
|
|
— an already-absent namespace is a clean no-op (best effort; a stray dir
|
|
can't leak, since attribution is by source IP and the bottle is gone)."""
|
|
_require_safe(bottle_id)
|
|
run_docker([
|
|
"docker", "exec", gateway, "rm", "-rf",
|
|
f"/git/{bottle_id}", _creds_dir(bottle_id),
|
|
])
|
|
|
|
|
|
__all__ = ["provision_git_gate", "deprovision_git_gate", "GatewayProvisionError"]
|