feat: Implemented (un)install,start/stop flow and fixed actions flow
This commit is contained in:
@@ -1 +1,395 @@
|
||||
package containers
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"git.dcntrlized.org/Dcntrlized/Maestro/lib/docker"
|
||||
"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
|
||||
"git.dcntrlized.org/Dcntrlized/Maestro/lib/types"
|
||||
"github.com/docker/docker/api/types/image"
|
||||
registrytypes "github.com/docker/docker/api/types/registry"
|
||||
)
|
||||
|
||||
// InstallContainer downloads the raw docker-compose.yaml and pulls the Docker image.
|
||||
func InstallContainer(ctx context.Context, item types.RegistryContainer) error {
|
||||
// 1. Determine storage path (XDG_DATA_HOME or ~/.dcntrlized/[name]/)
|
||||
targetDir, err := getContainerDataDir(item.Name)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to determine data directory: %w", err)
|
||||
}
|
||||
|
||||
if err := os.MkdirAll(targetDir, 0755); err != nil {
|
||||
return fmt.Errorf("failed to create directory %s: %w", targetDir, err)
|
||||
}
|
||||
|
||||
// 2. Fetch raw docker-compose.yaml from the Git URL
|
||||
rawURL := fmt.Sprintf("%s/raw/branch/master/docker-compose.yaml", item.URL)
|
||||
composePath := filepath.Join(targetDir, "docker-compose.yaml")
|
||||
|
||||
logger.Info("Fetching compose file from %s...", rawURL)
|
||||
if err := downloadFile(ctx, rawURL, composePath); err != nil {
|
||||
return fmt.Errorf("failed to download docker-compose.yaml: %w", err)
|
||||
}
|
||||
|
||||
// 2.5. Persist install metadata so installed-but-not-running state can be tracked without Docker lookups
|
||||
metadata := types.InstalledMetadata{
|
||||
RegistryContainer: item,
|
||||
InstalledAt: time.Now().UTC().Format(time.RFC3339),
|
||||
}
|
||||
metadataPath := filepath.Join(targetDir, "metadata.json")
|
||||
if err := writeMetadata(metadataPath, metadata); err != nil {
|
||||
return fmt.Errorf("failed to write metadata: %w", err)
|
||||
}
|
||||
|
||||
// 3. Pull the Docker Image with Registry Authentication
|
||||
logger.Info("Pulling docker image %s...", item.Image)
|
||||
cli, err := docker.NewDockerClient()
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to initialize docker client: %w", err)
|
||||
}
|
||||
defer cli.Close()
|
||||
|
||||
pullOpts := image.PullOptions{}
|
||||
|
||||
// Build auth payload if git credentials or registry auth env vars exist
|
||||
authHeader, err := buildRegistryAuthHeader()
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to create registry auth: %w", err)
|
||||
}
|
||||
if authHeader != "" {
|
||||
pullOpts.RegistryAuth = authHeader
|
||||
}
|
||||
|
||||
reader, err := cli.ImagePull(ctx, item.Image, pullOpts)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to pull docker image %s: %w", item.Image, err)
|
||||
}
|
||||
defer reader.Close()
|
||||
|
||||
// Drain reader stream to ensure Docker finishes downloading layers
|
||||
_, _ = io.Copy(io.Discard, reader)
|
||||
|
||||
logger.Info("Successfully installed container service: %s", item.Name)
|
||||
return nil
|
||||
}
|
||||
|
||||
// buildRegistryAuthHeader builds the base64-encoded auth header required by Docker SDK
|
||||
func buildRegistryAuthHeader() (string, error) {
|
||||
username := os.Getenv("REGISTRY_USER")
|
||||
token := os.Getenv("GIT_TOKEN")
|
||||
if token == "" {
|
||||
token = os.Getenv("GITHUB_TOKEN")
|
||||
}
|
||||
|
||||
// For Gitea/Forgejo container registries, token auth works using "token" or your username as the user, and GIT_TOKEN as password.
|
||||
if username == "" {
|
||||
username = "oauth2" // Fallback username when using personal access tokens
|
||||
}
|
||||
|
||||
if token == "" {
|
||||
return "", nil // No token set; proceed unauthenticated
|
||||
}
|
||||
|
||||
authConfig := registrytypes.AuthConfig{
|
||||
Username: username,
|
||||
Password: token,
|
||||
}
|
||||
|
||||
encodedJSON, err := json.Marshal(authConfig)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
return base64.URLEncoding.EncodeToString(encodedJSON), nil
|
||||
}
|
||||
|
||||
// getDataRoot resolves the directory that stores installed container metadata,
|
||||
// using the first variable that is set. DCNTRLIZED_INSTALL_DIR is used as-is;
|
||||
// the others are base dirs with ".dcntrlized" appended.
|
||||
func getDataRoot() (string, error) {
|
||||
if dir := os.Getenv("DCNTRLIZED_INSTALL_DIR"); dir != "" {
|
||||
return dir, nil
|
||||
}
|
||||
|
||||
if xdg := os.Getenv("XDG_DATA_HOME"); xdg != "" {
|
||||
return filepath.Join(xdg, ".dcntrlized"), nil
|
||||
}
|
||||
|
||||
if xdgHome := os.Getenv("XDG_HOME_DIR"); xdgHome != "" {
|
||||
return filepath.Join(xdgHome, ".dcntrlized"), nil
|
||||
}
|
||||
|
||||
if home := os.Getenv("HOME"); home != "" {
|
||||
return filepath.Join(home, ".dcntrlized"), nil
|
||||
}
|
||||
|
||||
return filepath.Join("/data", ".dcntrlized"), nil
|
||||
}
|
||||
|
||||
// EnsureDataRoot creates the data root directory if it does not exist yet.
|
||||
// This gives a clear, early error when the install directory is missing or not
|
||||
// writable (e.g. the container's bind mount source was removed) instead of a
|
||||
// confusing "no such file or directory" when installing a container.
|
||||
//
|
||||
// When started as root inside the container it hands the data root over to the
|
||||
// host user (discovered at runtime, or overridden via DCNTRLIZED_UID/GID) and
|
||||
// drops privileges, so every file created afterwards stays user-owned.
|
||||
func EnsureDataRoot() error {
|
||||
root, err := getDataRoot()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.MkdirAll(root, 0755); err != nil {
|
||||
return fmt.Errorf("failed to create data root %s (is the host directory present and writable?): %w", root, err)
|
||||
}
|
||||
if os.Geteuid() == 0 {
|
||||
identity, err := resolveRuntimeIdentity(root)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Chown(root, identity.uid, identity.gid); err != nil {
|
||||
return fmt.Errorf("failed to chown data root %s to %d:%d: %w", root, identity.uid, identity.gid, err)
|
||||
}
|
||||
if err := dropPrivileges(identity, root); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// runtimeIdentity is the user the container should run as, plus any
|
||||
// supplementary groups needed to keep working (e.g. the docker socket group).
|
||||
type runtimeIdentity struct {
|
||||
username string
|
||||
hostDir string
|
||||
uid, gid int
|
||||
groups []int
|
||||
}
|
||||
|
||||
// resolveRuntimeIdentity determines the user to hand the data root to.
|
||||
// An explicit DCNTRLIZED_UID/GID wins; otherwise the host user is discovered
|
||||
// from the bind-mounted home directory, falling back to the data root's owner
|
||||
// (self-heals upgrades) and finally to uid 1000.
|
||||
func resolveRuntimeIdentity(dataRoot string) (runtimeIdentity, error) {
|
||||
username := filepath.Base(hostPath(mountSource("/host-home")))
|
||||
if username == "" || username == "." || username == "/" {
|
||||
username = "user"
|
||||
}
|
||||
hostDir := hostPath(mountSource(dataRoot))
|
||||
if hostDir == "" {
|
||||
hostDir = "(unknown)"
|
||||
}
|
||||
|
||||
var id runtimeIdentity
|
||||
if uidStr := os.Getenv("DCNTRLIZED_UID"); uidStr != "" {
|
||||
uid, err := strconv.Atoi(uidStr)
|
||||
if err != nil {
|
||||
return runtimeIdentity{}, fmt.Errorf("invalid DCNTRLIZED_UID %q: %w", uidStr, err)
|
||||
}
|
||||
gid, err := strconv.Atoi(os.Getenv("DCNTRLIZED_GID"))
|
||||
if err != nil {
|
||||
gid = uid
|
||||
}
|
||||
id = runtimeIdentity{uid: uid, gid: gid, groups: dockerSocketGroups(uid)}
|
||||
} else {
|
||||
uid, gid, err := discoverHostUser(dataRoot)
|
||||
if err != nil {
|
||||
return runtimeIdentity{}, err
|
||||
}
|
||||
id = runtimeIdentity{uid: uid, gid: gid, groups: dockerSocketGroups(uid)}
|
||||
}
|
||||
|
||||
id.username, id.hostDir = username, hostDir
|
||||
logger.Info("User: %s (%d, %d)", id.username, id.uid, id.gid)
|
||||
return id, nil
|
||||
}
|
||||
|
||||
// discoverHostUser finds the host user's uid/gid, preferring the read-only
|
||||
// bind mount of the host home directory, then the data root's owner.
|
||||
func discoverHostUser(dataRoot string) (uid, gid int, err error) {
|
||||
if uid, gid, ok := statOwner("/host-home"); ok && uid != 0 {
|
||||
logger.Debug("Host user resolved from /host-home")
|
||||
return uid, gid, nil
|
||||
}
|
||||
if uid, gid, ok := statOwner(dataRoot); ok && uid != 0 {
|
||||
logger.Debug("Host user resolved from data root owner")
|
||||
return uid, gid, nil
|
||||
}
|
||||
logger.Warn("Could not determine host user (no /host-home or owned data root); defaulting to uid 1000")
|
||||
return 1000, 1000, nil
|
||||
}
|
||||
|
||||
// statOwner returns the numeric uid/gid owning the given path.
|
||||
func statOwner(path string) (uid, gid int, ok bool) {
|
||||
st, err := os.Stat(path)
|
||||
if err != nil {
|
||||
return 0, 0, false
|
||||
}
|
||||
sys, ok := st.Sys().(*syscall.Stat_t)
|
||||
if !ok {
|
||||
return 0, 0, false
|
||||
}
|
||||
return int(sys.Uid), int(sys.Gid), true
|
||||
}
|
||||
|
||||
// mountSource returns the host source path of the bind mount at mountPoint by
|
||||
// parsing /proc/self/mountinfo, or "" when the mount does not exist.
|
||||
func mountSource(mountPoint string) string {
|
||||
data, err := os.ReadFile("/proc/self/mountinfo")
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
for _, line := range strings.Split(string(data), "\n") {
|
||||
fields := strings.Fields(line)
|
||||
if len(fields) < 5 {
|
||||
continue
|
||||
}
|
||||
// Format: <id> <parent> <major:minor> <root> <mountpoint> <opts> ...
|
||||
// For bind mounts, <root> is the source path on the host.
|
||||
if fields[4] == mountPoint {
|
||||
return unescapeMountPath(fields[3])
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// unescapeMountPath decodes the octal escapes used in mountinfo paths (e.g. \040).
|
||||
func unescapeMountPath(s string) string {
|
||||
if !strings.Contains(s, `\`) {
|
||||
return s
|
||||
}
|
||||
var b strings.Builder
|
||||
for i := 0; i < len(s); i++ {
|
||||
if s[i] == '\\' && i+3 < len(s) {
|
||||
if v, err := strconv.ParseUint(s[i+1:i+4], 8, 8); err == nil {
|
||||
b.WriteByte(byte(v))
|
||||
i += 3
|
||||
continue
|
||||
}
|
||||
}
|
||||
b.WriteByte(s[i])
|
||||
}
|
||||
return b.String()
|
||||
}
|
||||
|
||||
// hostPath converts a mount source into a host-visible path. Btrfs encodes
|
||||
// subvolumes as "@name/..." (e.g. "@home/franciscofadigas" mounted at
|
||||
// "/home/franciscofadigas"); ordinary sources already start with "/".
|
||||
func hostPath(source string) string {
|
||||
if source == "" {
|
||||
return ""
|
||||
}
|
||||
if strings.HasPrefix(source, "/@") {
|
||||
return "/" + strings.TrimPrefix(source, "/@")
|
||||
}
|
||||
if strings.HasPrefix(source, "@") {
|
||||
return "/" + strings.TrimPrefix(source, "@")
|
||||
}
|
||||
return source
|
||||
}
|
||||
|
||||
// dockerSocketPath is where the host's docker socket is mounted into the container.
|
||||
const dockerSocketPath = "/var/run/docker.sock"
|
||||
|
||||
// dockerSocketGroups returns the group of the mounted docker socket when it is
|
||||
// group-accessible, so the container can keep talking to it after dropping
|
||||
// privileges without hardcoding the host's docker group id.
|
||||
func dockerSocketGroups(runAsUID int) []int {
|
||||
st, err := os.Stat(dockerSocketPath)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
if st.Mode()&0o020 == 0 {
|
||||
return nil
|
||||
}
|
||||
sys, ok := st.Sys().(*syscall.Stat_t)
|
||||
if !ok || sys.Gid == 0 || int(sys.Gid) == runAsUID {
|
||||
return nil
|
||||
}
|
||||
return []int{int(sys.Gid)}
|
||||
}
|
||||
|
||||
// dropPrivileges switches the process to the given uid/gid, keeping the
|
||||
// supplementary groups needed for the docker socket.
|
||||
func dropPrivileges(id runtimeIdentity, guestDir string) error {
|
||||
if err := syscall.Setgroups(id.groups); err != nil {
|
||||
return fmt.Errorf("failed to set supplementary groups %v: %w", id.groups, err)
|
||||
}
|
||||
if err := syscall.Setgid(id.gid); err != nil {
|
||||
return fmt.Errorf("failed to set gid to %d: %w", id.gid, err)
|
||||
}
|
||||
if err := syscall.Setuid(id.uid); err != nil {
|
||||
return fmt.Errorf("failed to set uid to %d: %w", id.uid, err)
|
||||
}
|
||||
if os.Geteuid() != id.uid {
|
||||
return fmt.Errorf("failed to drop privileges: still running as euid %d (want %d)", os.Geteuid(), id.uid)
|
||||
}
|
||||
logger.Info("Handoff %s (%s) %d:%d", guestDir, id.hostDir, id.uid, id.gid)
|
||||
return nil
|
||||
}
|
||||
|
||||
func getContainerDataDir(serviceName string) (string, error) {
|
||||
root, err := getDataRoot()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return filepath.Join(root, serviceName), nil
|
||||
}
|
||||
|
||||
func downloadFile(ctx context.Context, url string, destPath string) error {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
token := os.Getenv("GIT_TOKEN")
|
||||
if token == "" {
|
||||
token = os.Getenv("GITHUB_TOKEN")
|
||||
}
|
||||
|
||||
if token != "" {
|
||||
req.Header.Set("Authorization", "Bearer "+token)
|
||||
}
|
||||
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
|
||||
return fmt.Errorf("authentication failed (HTTP %d): ensure GIT_TOKEN is set and has access to the repository", resp.StatusCode)
|
||||
}
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("unexpected HTTP status fetching compose file: %s", resp.Status)
|
||||
}
|
||||
|
||||
out, err := os.Create(destPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer out.Close()
|
||||
|
||||
_, err = io.Copy(out, resp.Body)
|
||||
return err
|
||||
}
|
||||
|
||||
func writeMetadata(path string, metadata types.InstalledMetadata) error {
|
||||
data, err := json.MarshalIndent(metadata, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return os.WriteFile(path, data, 0644)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user