didericis
a1180adec1
The docker backend's compose renderer now emits a single `sidecars` service in place of the four per-sidecar services when CLAUDE_BOTTLE_SIDECAR_BUNDLE is truthy. Default (unset/0/ false) keeps the legacy five-service shape so existing operators don't have to migrate atomically; chunks 4-5 flip the default and delete the flag. New module claude_bottle/backend/docker/sidecar_bundle.py owns the bundle image constant (CLAUDE_BOTTLE_SIDECAR_IMAGE env var override + claude-bottle-sidecars:latest default), the Dockerfile reference, the container-name helper, and the flag-parser. The bundle service: - joins both internal + egress networks with aliases for every legacy shortname + per-slug long form so the agent's HTTPS_PROXY URL (which dials `egress` or `claude-bottle-pipelock-<slug>`) keeps resolving with no agent-side change - carries CLAUDE_BOTTLE_SIDECAR_DAEMONS=<csv> for the init supervisor to narrow which daemons to start - carries the union of the four prior services' daemon-private env vars (EGRESS_UPSTREAM_PROXY, SUPERVISE_*, token env names) - does NOT carry HTTPS_PROXY/HTTP_PROXY/NO_PROXY — those would route git-gate's git fetches through pipelock by mistake - union'd bind-mounts at the same in-container paths as before HTTPS_PROXY scoping moved into egress_entrypoint.sh so only mitmdump's subprocess sees it. In the legacy four-sidecar shape the env vars also lived in the egress service's compose env; the shell script's export is additionally defensive. Tests: - All 44 existing TestCompose cases pass unchanged (flag off → legacy shape). - 20 new TestSidecarBundleShape cases assert on the bundle's services / aliases / env / volumes / depends_on under the flag. - 8 new TestSidecarBundleFlag cases lock down the env-var parser (unset / 0 / false / no / off → disabled; everything else → enabled). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
50 lines
2.1 KiB
Bash
50 lines
2.1 KiB
Bash
#!/bin/sh
|
|
# Egress daemon entrypoint inside the sidecar bundle (PRD 0024).
|
|
#
|
|
# Extracted verbatim from Dockerfile.egress's prior inline `sh -c`
|
|
# ENTRYPOINT so the supervisor in claude_bottle/sidecar_init.py can
|
|
# call it as a normal child. Behavior is unchanged:
|
|
#
|
|
# * Upstream proxy: when EGRESS_UPSTREAM_PROXY is set, switch
|
|
# to `--mode upstream:URL` to forward all post-MITM traffic
|
|
# through pipelock. mitmproxy does NOT honor HTTPS_PROXY on
|
|
# its outbound side, so the upstream wiring has to be the
|
|
# mitmproxy mode flag, not env.
|
|
# * Upstream trust: when EGRESS_UPSTREAM_CA is set, build a
|
|
# combined trust bundle (system roots + pipelock CA) and point
|
|
# mitmproxy at it. The option REPLACES mitmproxy's default
|
|
# trust store, so passing pipelock's CA alone would break
|
|
# pipelock-passthrough hosts (api.anthropic.com etc.).
|
|
# * `-s /app/egress_addon.py` loads the addon that reads
|
|
# /etc/egress/routes.yaml.
|
|
|
|
set -e
|
|
|
|
MODE="--mode regular@9099"
|
|
if [ -n "$EGRESS_UPSTREAM_PROXY" ]; then
|
|
MODE="--mode upstream:$EGRESS_UPSTREAM_PROXY --listen-port 9099"
|
|
fi
|
|
|
|
TRUST_FLAG=""
|
|
if [ -n "$EGRESS_UPSTREAM_CA" ] && [ -f "$EGRESS_UPSTREAM_CA" ]; then
|
|
COMBINED=/home/mitmproxy/.mitmproxy/combined-trust.pem
|
|
cat /etc/ssl/certs/ca-certificates.crt "$EGRESS_UPSTREAM_CA" > "$COMBINED"
|
|
TRUST_FLAG="--set ssl_verify_upstream_trusted_ca=$COMBINED"
|
|
fi
|
|
|
|
# Scope the proxy env to this process tree only. In the bundle
|
|
# image (PRD 0024) the four daemons share one container — setting
|
|
# HTTPS_PROXY at the container level would route git-gate's git
|
|
# pushes through pipelock, which is wrong (pipelock doesn't proxy
|
|
# SSH and would block public git repos). Setting them here means
|
|
# only mitmdump's subprocess inherits them. In the legacy
|
|
# four-sidecar setup these env vars are also set in compose; here
|
|
# they're additionally defensive.
|
|
if [ -n "$EGRESS_UPSTREAM_PROXY" ]; then
|
|
export HTTPS_PROXY="$EGRESS_UPSTREAM_PROXY"
|
|
export HTTP_PROXY="$EGRESS_UPSTREAM_PROXY"
|
|
export NO_PROXY="localhost,127.0.0.1"
|
|
fi
|
|
|
|
exec mitmdump $MODE $TRUST_FLAG -s /app/egress_addon.py
|