empeira 0.1.0.pre.alpha.1

data/lib/empeira/runtime/service_inspection.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Runtime
+    # rubocop:disable-next Metrics/ModuleLength -- Shared native ownership and snapshot validation boundary.
+    module ServiceInspection
+      def inspect_services(definitions, expected_ids: {})
+        selected = select_services(definitions, expected_ids)
+        ids = selected.values.compact.map { |entry| entry.fetch('id') }
+        resources = inspect_containers(ids)
+        definitions.to_h do |key, definition|
+          resource = resources[selected[key]&.fetch('id')]
+          definition.verify!(resource, expected_id: expected_ids[key])
+          [key, resource]
+        end
+      end
+
+      def inspect_volumes(definitions, expected_ids: {})
+        resources = inspect_volumes_by_name(select_volume_names(definitions))
+        definitions.to_h do |key, definition|
+          resource = resources[definition.name]
+          definition.verify!(resource, expected_id: expected_ids[key])
+          [key, resource]
+        end
+      end
+
+      private
+
+      def select_volume_names(definitions)
+        names = definitions.values.map(&:name)
+        inventory('volume').filter_map { |entry| entry.fetch('name') if names.include?(entry.fetch('name')) }
+      end
+
+      def inspect_volumes_by_name(names)
+        return {} if names.empty?
+
+        data = parse_json(service_command(['volume', 'inspect', *names], operation: 'volume snapshot').stdout)
+        validate_snapshot!(data, names.size)
+        resources = data.map { |entry| normalize_volume(entry) }
+        verify_volume_names!(resources, names)
+        resources.to_h { |entry| [entry.fetch('name'), entry] }
+      rescue KeyError, TypeError, NoMethodError
+        malformed!
+      end
+
+      def verify_volume_names!(resources, names)
+        malformed! unless resources.map { |entry| entry.fetch('name') }.sort == names.sort
+      end
+
+      def select_services(definitions, expected_ids)
+        entries = inventory('container')
+        definitions.to_h do |key, definition|
+          entry = entries.find { |item| item.fetch('name') == definition.name }
+          verify_recorded_name!('container', entries, entry, expected_ids[key])
+          [key, entry]
+        end
+      end
+
+      def inspect_containers(ids)
+        return {} if ids.empty?
+
+        data = parse_json(service_command(['container', 'inspect', *ids], operation: 'service snapshot').stdout)
+        validate_snapshot!(data, ids.size)
+        resources = data.map { |entry| normalize_service('container', entry) }
+        verify_snapshot_ids!(resources, ids)
+        resources.to_h { |entry| [entry.fetch('id'), entry] }
+      rescue KeyError, TypeError, NoMethodError
+        malformed!
+      end
+
+      def validate_snapshot!(data, size)
+        malformed! unless data.is_a?(Array) && data.size == size && data.all?(Hash)
+      end
+
+      def verify_snapshot_ids!(resources, ids)
+        malformed! unless resources.map { |entry| entry['id'] }.sort == ids.sort
+      end
+
+      def inspect_owned(kind, definition, expected_id:)
+        return inspect_named(kind, definition, expected_id: expected_id) unless kind == 'container' && expected_id
+
+        result = runner.run(name, arguments: ['container', 'inspect', expected_id], timeout: 30)
+        return inspect_named(kind, definition, expected_id: expected_id) unless result.success?
+
+        data = parse_json(result.stdout)
+        validate_snapshot!(data, 1)
+        resource = normalize_service(kind, data.first)
+        definition.verify!(resource, expected_id: expected_id)
+        resource
+      rescue KeyError, TypeError, NoMethodError
+        malformed!
+      end
+
+      def inspect_named(kind, definition, expected_id:)
+        entries = inventory(kind)
+        entry = entries.find { |item| item.fetch('name') == definition.name }
+        verify_recorded_name!(kind, entries, entry, expected_id)
+        return unless entry
+
+        resource = normalize_service(kind, inspect_entry_data(kind, entry.fetch('id')))
+        definition.verify!(resource, expected_id: expected_id)
+        resource
+      rescue JSON::ParserError, KeyError, TypeError, NoMethodError
+        raise Providers::ExecutionError, 'Malformed service inventory', cause: nil
+      end
+
+      def verify_recorded_name!(kind, entries, entry, expected_id)
+        return unless kind == 'container' && !entry && expected_id
+        return unless entries.any? { |item| item.fetch('id') == expected_id }
+
+        raise Providers::OwnershipError, "Recorded #{kind} exists under a different name"
+      end
+
+      def inspect_entry_data(kind, id)
+        data = JSON.parse(service_command([kind, 'inspect', id], operation: "#{kind} inspection").stdout)
+        unless data.is_a?(Array) && data.size == 1 && data.first.is_a?(Hash)
+          raise Providers::ExecutionError, 'Malformed service inspection'
+        end
+
+        data.first
+      end
+
+      def inventory(kind)
+        args = kind == 'container' ? ['ps', '--all', '--no-trunc'] : %w[volume ls]
+        # Both CLIs support Go templates independently of their JSON inspection casing.
+        if kind == 'container'
+          output = service_command([*args, '--format', '{{.ID}} {{.Names}}'],
+                                   operation: 'service inventory')
+        end
+        output ||= service_command([*args, '--format', '{{.Name}}'], operation: 'volume inventory')
+        output.stdout.lines.reject { |line| line.strip.empty? }.map do |line|
+          id, item_name = line.strip.split(' ', 2)
+          { 'id' => id, 'name' => item_name || id }
+        end
+      end
+
+      def normalize_volume(data)
+        { 'id' => data.fetch('Labels', {}).fetch('io.empeira.volume-id', data.fetch('Name')),
+          'name' => data.fetch('Name'), 'labels' => data['Labels'] || {} }
+      end
+
+      def normalize_service(kind, data)
+        return normalize_volume(data) if kind == 'volume'
+
+        { 'id' => data.fetch('Id'), 'name' => data.fetch('Name').delete_prefix('/'),
+          'labels' => data.fetch('Config')['Labels'] || {}, 'state' => data.fetch('State').fetch('Status'),
+          'networks' => data.fetch('NetworkSettings').fetch('Networks'),
+          'host_config' => data['HostConfig'], 'image_id' => data['Image'],
+          'mounts' => data.fetch('Mounts'), 'dns' => data.dig('HostConfig', 'Dns') || [],
+          **port_observations(data) }
+      end
+
+      def port_observations(data)
+        { 'ports' => data.dig('HostConfig', 'PortBindings') || {},
+          'published_ports' => data.dig('NetworkSettings', 'Ports') || {} }
+      end
+    end
+  end
+end

data/lib/empeira/runtime/services.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require 'tmpdir'
+
+module Empeira
+  module Runtime
+    # Shared service contract for Docker and Podman. No shell or Compose orchestration.
+    module Services
+      include ServiceInspection
+      include ServiceImages
+      include ImageMetadata
+      include RecipeBuild
+      include RegistryDiagnostics
+
+      def inspect_service(definition, expected_id: nil)
+        inspect_owned('container', definition, expected_id: expected_id)
+      end
+
+      def inspect_volume(definition, expected_id: nil)
+        inspect_owned('volume', definition, expected_id: expected_id)
+      end
+
+      def create_volume(definition)
+        service_command(['volume', 'create', *label_arguments(definition),
+                         '--label', "io.empeira.volume-id=#{SecureRandom.uuid}",
+                         definition.name], operation: 'volume creation')
+        inspect_volume(definition)
+      end
+
+      def remove_volume(definition, expected_id:)
+        resource = inspect_volume(definition, expected_id: expected_id)
+        return unless resource
+
+        service_command(['volume', 'rm', definition.name], operation: 'persistent volume removal')
+        raise Providers::ExecutionError, 'Volume removal could not be verified' if inspect_volume(definition)
+      end
+
+      def create_service(definition)
+        service_command(create_service_arguments(definition), operation: "#{definition.key} creation")
+        inspect_service(definition)
+      end
+
+      def start_service(resource)
+        service_command(['start', resource.fetch('id')], operation: 'service start')
+      end
+
+      # rubocop:disable-next Naming/PredicateMethod -- This mutation returns whether it changed infrastructure.
+      def remove_service(definition, expected_id: nil)
+        resource = inspect_service(definition, expected_id: expected_id)
+        return false unless resource
+
+        service_command(['stop', '--time', '20', resource.fetch('id')], operation: 'service stop', timeout: 40)
+        volumes = ['--volumes']
+        service_command(['rm', *volumes, resource.fetch('id')], operation: 'service removal')
+        raise Providers::ExecutionError, 'Service removal could not be verified' if inspect_service(definition)
+
+        true
+      end
+
+      def reload_service(resource, signal: 'HUP')
+        service_command(['kill', '--signal', signal, resource.fetch('id')], operation: 'service reload')
+      end
+
+      def stop_service(resource)
+        service_command(['stop', '--time', '20', resource.fetch('id')], operation: 'node stop', timeout: 40)
+      end
+
+      def ssh_proxy_command(resource, port: nil)
+        helper = Pathname(__dir__).join('../../../resources/nodes/ssh/proxy.rb').realpath
+        [RbConfig.ruby, helper.to_s, name, resource.fetch('id'), *(port ? [port.to_s] : [])]
+      end
+
+      def stream_service(resource, arguments, interactive: false, logs: false, user: nil)
+        command = if logs
+                    ['logs', '--follow', resource.fetch('id')]
+                  else
+                    ['exec', *(user ? ['--user', user] : []), *(interactive ? ['--interactive'] : []),
+                     *(interactive && $stdin.tty? && $stdout.tty? ? ['--tty'] : []), resource.fetch('id'), *arguments]
+                  end
+        runner.stream(name, arguments: command)
+      end
+
+      def service_exec(resource, arguments, timeout: 15, on_stdout: nil)
+        options = on_stdout ? { on_stdout: on_stdout } : {}
+        runner.run(name, arguments: ['exec', resource.fetch('id'), *arguments], timeout: timeout, **options)
+      end
+
+      def copy_from(resource, source, destination)
+        service_command(['cp', "#{resource.fetch('id')}:#{source}", destination.to_s], operation: 'certificate export')
+      end
+
+      def copy_to(resource, source, destination)
+        service_command(['cp', source.to_s, "#{resource.fetch('id')}:#{destination}"],
+                        operation: 'service configuration')
+      end
+
+      def attach_egress(definition, resource)
+        service_command(['network', 'connect', definition.backend_name, resource.fetch('id')],
+                        operation: 'proxy egress attachment')
+      end
+
+      private
+
+      def service_command(arguments, operation:, timeout: 30)
+        result = runner.run(name, arguments: arguments, timeout: timeout)
+        return result if result.success?
+
+        raise Providers::ExecutionError,
+              "#{name} #{operation} failed; run empeira status\n" \
+              "#{Execution::Diagnostics.native(result, operation: operation, tool: name)}", cause: nil
+      end
+
+      def create_service_arguments(definition)
+        ServiceArguments.new(definition).build
+      end
+    end
+
+    Container.include(Services)
+  end
+end

data/lib/empeira/runtime/update_helper.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Runtime
+    # Disposable update tooling: no service plan, workspace networking or persistent inventory.
+    module UpdateHelper
+      PROXY_VARIABLES = %w[HTTP_PROXY HTTPS_PROXY NO_PROXY http_proxy https_proxy no_proxy].freeze
+
+      def with_update_helper(image:, input:, output:, sources:, cache:)
+        # Reuse the ownership verifier, but assign a unique identity for this invocation only.
+        identity = Empeira::Services::Definition.new(key: "update-#{SecureRandom.hex(16)}",
+                                                     workspace: context.workspace)
+        update_command(helper_arguments(identity, image, input, output, sources, cache), operation: 'helper creation')
+        resource = inspect_service(identity)
+        raise Providers::ExecutionError, 'Update helper creation could not be verified' unless resource
+
+        update_command(['start', resource.fetch('id')], operation: 'helper start')
+        verify_helper_network!(identity, resource.fetch('id'))
+        yield resource
+      ensure
+        remove_update_helper(identity, resource&.fetch('id')) if identity
+      end
+
+      def update_command(arguments, operation:, timeout: 600, registry: nil)
+        result = runner.run(name, arguments: arguments, timeout: timeout)
+        return result if result.success?
+
+        diagnostic = Execution::Diagnostics.safe_text("#{result.stderr}\n#{result.stdout}")
+        guidance = if registry
+                     registry_failure_hint(registry, diagnostic, timed_out: result.timed_out)
+                   else
+                     'Check your normal host/container network access.'
+                   end
+        raise Providers::ExecutionError, "#{name} update #{operation} failed " \
+                                         "(#{result.timed_out ? 'timeout' : result.exit_status}). " \
+                                         "#{guidance}\n" \
+                                         "#{Execution::Diagnostics.native(result, operation: operation, tool: name)}",
+              cause: nil
+      end
+
+      private
+
+      # rubocop:disable-next Metrics/AbcSize -- Keep all explicit module-helper mounts and restrictions together.
+      def helper_arguments(identity, image, input, output, sources, cache)
+        mounts = %w[Puppetfile request.json].flat_map do |file|
+          ['--mount', helper_mount(File.join(input, file), "/work/#{file}", readonly: true)]
+        end
+        environment = { 'HOME' => '/work', 'GIT_TERMINAL_PROMPT' => '0', 'GIT_ALLOW_PROTOCOL' => 'file' }
+        ['create', '--name', identity.name, '--network', update_helper_network, *update_helper_user,
+         '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', *label_arguments(identity),
+         *PROXY_VARIABLES.select { |key| ENV.key?(key) }.flat_map { |key| ['--env', key] },
+         *environment.flat_map { |key, value| ['--env', "#{key}=#{value}"] },
+         *mounts, '--mount', helper_mount(output, '/work/modules', readonly: false),
+         '--mount', helper_mount(sources, sources.to_s, readonly: true),
+         '--mount', helper_mount(cache, cache.to_s, readonly: false), image]
+      end
+
+      def update_helper_user
+        ['--user', "#{Process.uid}:#{Process.gid}"]
+      end
+
+      def helper_mount(source, target, readonly:)
+        if source.to_s.match?(/[,\r\n]/)
+          raise ConfigurationError,
+                'Update mount paths must not contain commas or newlines'
+        end
+
+        "type=bind,src=#{File.realpath(source)},dst=#{target}#{',readonly' if readonly}"
+      end
+
+      def verify_helper_network!(identity, id)
+        resource = inspect_service(identity, expected_id: id)
+        raise Providers::ExecutionError, 'Update helper disappeared before synchronization' unless resource
+
+        networks = resource.fetch('networks').keys
+        return if networks == [update_helper_network] && resource.fetch('dns').empty? &&
+                  resource.fetch('ports').empty? && resource.fetch('published_ports', {}).values.all?(&:nil?)
+
+        raise Providers::OwnershipError, 'Update helper has unexpected network, DNS or port configuration'
+      end
+
+      def update_helper_network
+        'bridge'
+      end
+
+      def remove_update_helper(identity, id)
+        resource = inspect_service(identity, expected_id: id)
+        return unless resource
+
+        update_command(['rm', '--force', '--volumes', resource.fetch('id')], operation: 'helper removal')
+        raise Providers::ExecutionError, 'Update helper removal could not be verified' if inspect_service(identity)
+      end
+    end
+
+    Container.include(UpdateHelper)
+  end
+end

data/lib/empeira/runtime/workspace_network.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Runtime
+    module WorkspaceNetwork
+      # This privileged, short-lived operation runs in the engine's Linux host
+      # namespace, including Docker Desktop's VM. It does not share host files,
+      # sockets or PID namespaces, and cannot select arbitrary firewall rules.
+      # rubocop:disable-next Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- Verify ownership before this narrow host-namespace transaction.
+      def reconcile_workspace_bridge(definition:, expected_id:, image:, action:)
+        return unless name == 'docker'
+
+        resource = inspect_network(identifier: definition.backend_name)
+        definition.verify_ownership!(resource, expected_id: expected_id)
+        raise Providers::OwnershipError, 'Workspace network is missing' unless resource
+
+        definition.verify_isolation!(resource)
+        details = network_details(resource.id)
+        bridge = "ep#{context.workspace.id[0, 10]}"
+        unless details.dig('Options', 'com.docker.network.bridge.name') == bridge &&
+               details.fetch('IPAM').fetch('Config').any? { |item| item['Subnet'] == definition.allocation }
+          raise Providers::OwnershipError, 'Workspace bridge or subnet conflicts with recorded allocation'
+        end
+
+        helper = Empeira::Services::Definition.new(key: "bridge-#{SecureRandom.hex(16)}", workspace: context.workspace)
+        service_command(['run', '--rm', '--pull=never', '--name', helper.name, '--network', 'host',
+                         '--cap-drop', 'ALL', '--cap-add', 'NET_ADMIN', '--cap-add', 'NET_RAW',
+                         '--security-opt', 'no-new-privileges', '--read-only',
+                         '--tmpfs', '/run:rw,noexec,nosuid,size=1m', *label_arguments(helper),
+                         '--entrypoint', '/usr/local/libexec/empeira-bridge', image,
+                         action, bridge, definition.allocation, resource.id],
+                        operation: 'workspace bridge attachment', timeout: action == 'check' ? 3 : 30)
+      ensure
+        if helper && (remaining = inspect_service(helper))
+          service_command(['rm', '--force', remaining.fetch('id')], operation: 'bridge helper cleanup')
+        end
+      end
+
+      def detach_egress(definition, resource)
+        service_command(['network', 'disconnect', definition.backend_name, resource.fetch('id')],
+                        operation: 'gateway uplink detachment')
+      end
+
+      # Only the target's network namespace is shared. No host namespace, Docker
+      # socket, target filesystem or persistent NET_ADMIN capability is exposed.
+      # rubocop:disable-next Metrics/AbcSize -- Bound the privilege and cleanup of a single namespace operation.
+      def configure_workspace_route(resource, gateway:, image:)
+        labels = resource.fetch('labels')
+        unless labels['io.empeira.managed-by'] == 'empeira' && labels['io.empeira.workspace'] == context.workspace.id
+          raise Providers::OwnershipError, 'Cannot configure routing on a foreign container'
+        end
+
+        helper = Empeira::Services::Definition.new(key: "route-#{SecureRandom.hex(16)}", workspace: context.workspace)
+        arguments = ['run', '--rm', '--pull=never', '--name', helper.name,
+                     '--network', "container:#{resource.fetch('id')}", '--cap-drop', 'ALL', '--cap-add', 'NET_ADMIN',
+                     '--security-opt', 'no-new-privileges', '--read-only',
+                     '--tmpfs', '/run:rw,noexec,nosuid,size=1m', *label_arguments(helper),
+                     '--entrypoint', Network::Gateway::EXECUTABLE, image, 'route', gateway]
+        service_command(arguments, operation: 'workspace default routing')
+      ensure
+        if helper && (remaining = inspect_service(helper))
+          service_command(['rm', '--force', remaining.fetch('id')], operation: 'route helper cleanup')
+        end
+      end
+    end
+
+    Container.include(WorkspaceNetwork)
+  end
+end

data/lib/empeira/server/environment_configuration.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Server
+    # Apply one native Puppet setting without replacing an image's configuration.
+    class EnvironmentConfiguration
+      PUPPET = '/opt/puppetlabs/bin/puppet'
+      READER = '/empeira-server/environment.rb'
+
+      def initialize(runtime:, plan:)
+        @runtime = runtime
+        @plan = plan
+      end
+
+      # rubocop:disable-next Naming/PredicateMethod -- Reconciliation mutates the native server setting.
+      def reconcile(resource)
+        return false if current(resource) == '0'
+
+        execute(resource, [PUPPET, 'config', 'set', 'environment_timeout', '0', '--section', 'server',
+                           '--confdir', confdir])
+        @runtime.stop_service(resource)
+        @runtime.start_service(resource)
+        true
+      end
+
+      def verify!(resource)
+        return if current(resource) == '0'
+
+        raise Error, 'Puppetserver environment_timeout is not 0 after startup; the custom entrypoint or ' \
+                     'server confdir overrides the managed setting; inspect the server runtime contract'
+      end
+
+      private
+
+      def current(resource)
+        execute(resource, [ControlPlane::Health::RUBY, READER, '--confdir', confdir]).stdout.strip
+      end
+
+      def execute(resource, arguments)
+        result = @runtime.service_exec(resource, arguments)
+        return result if result.success?
+
+        details = Execution::Diagnostics.command(result, operation: 'Effective Puppetserver environment timeout',
+                                                         tool: arguments.first)
+        raise Error, "Cannot reconcile Puppetserver environment_timeout\n#{details}", cause: nil
+      end
+
+      def confdir
+        File.dirname(@plan.server_runtime.paths.fetch('puppetdb_config'))
+      end
+    end
+  end
+end

data/lib/empeira/server/http.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Server
+    module HTTP
+      def self.arguments
+        ['curl', '--silent', '--show-error', '--fail-with-body', '--max-time', '8', '--noproxy', '*']
+      end
+
+      def self.tls_arguments
+        ssl = '/etc/puppetlabs/puppet/ssl'
+        [*arguments, '--cacert', "#{ssl}/certs/ca.pem", '--cert', "#{ssl}/certs/server.empeira.internal.pem",
+         '--key', "#{ssl}/private_keys/server.empeira.internal.pem"]
+      end
+
+      def self.response(result)
+        text = result.stdout
+        status = reason = type = nil
+        while (match = %r{\AHTTP/\S+ (\d{3})(?: ([^\r\n]*))?\r?\n((?:[^\r\n]+\r?\n)*)\r?\n}.match(text))
+          status = match[1]
+          reason = match[2]
+          type = match[3][/^Content-Type:\s*([^\r\n]+)/i, 1]
+          text = text[match[0].length..]
+        end
+        { status: status, reason: reason, body: text, content_type: type }
+      end
+
+      def self.failure(result, url:, operation:)
+        data = response(result)
+        return Execution::Diagnostics.native(result, operation: operation, tool: 'curl', url: url) unless data[:status]
+
+        detail = Execution::Diagnostics.http(operation: operation, url: url, **data)
+        stderr = Execution::Diagnostics.bounded(Execution::Diagnostics.safe_text(result.stderr))
+        "#{detail}\n#{stderr}"
+      end
+    end
+  end
+end

data/lib/empeira/server/puppetdb_runtime.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Server
+    # OpenVoxDB process layout; custom images may override only these runtime details.
+    class PuppetDBRuntime
+      PATHS = %w[jar config bootstrap_config data].freeze
+      FIELDS = %w[entrypoint user java_arguments main_arguments paths].freeze
+
+      def self.validate!(value, path = 'puppetdb.runtime', effective: false)
+        raise ConfigurationError, "#{path} must be a mapping" unless value.is_a?(Hash)
+
+        value.each do |key, item|
+          validate_entry!(key, item, path)
+        end
+        return unless effective
+
+        missing = FIELDS - value.keys
+        raise ConfigurationError, "#{path}.#{missing.first} is required" unless missing.empty?
+      end
+
+      def self.validate_entry!(key, item, path)
+        raise ConfigurationError, "#{path}.#{key} is not supported" unless FIELDS.include?(key)
+
+        if key == 'paths'
+          validate_mapping!(item, PATHS, "#{path}.#{key}")
+        elsif !valid_item?(key, item)
+          raise ConfigurationError, "#{path}.#{key} is invalid"
+        end
+      end
+
+      def self.validate_mapping!(value, allowed, path)
+        raise ConfigurationError, "#{path} must be a mapping" unless value.is_a?(Hash)
+
+        value.each do |key, item|
+          raise ConfigurationError, "#{path}.#{key} is not supported" unless allowed.include?(key)
+
+          valid = Runtime.safe_path?(item)
+          raise ConfigurationError, "#{path}.#{key} is invalid" unless valid
+        end
+      end
+
+      def self.valid_item?(key, item)
+        case key
+        when 'entrypoint' then Runtime.safe_path?(item)
+        when 'user' then item.is_a?(String) && item.match?(/\A[0-9]+\z/)
+        else Runtime.valid_arguments?(item)
+        end
+      end
+
+      def self.resolve(config)
+        definition = config.fetch('puppetdb').fetch('runtime')
+        validate!(definition, effective: true)
+        new(definition)
+      end
+
+      attr_reader :entrypoint, :user, :paths
+
+      def initialize(definition)
+        @entrypoint = definition.fetch('entrypoint')
+        @user = definition.fetch('user')
+        @paths = definition.fetch('paths')
+        @java_arguments = definition.fetch('java_arguments')
+        @main_arguments = definition.fetch('main_arguments')
+      end
+
+      def command
+        [*@java_arguments, '-cp', paths.fetch('jar'), *@main_arguments,
+         '--config', paths.fetch('config'), '--bootstrap-config', paths.fetch('bootstrap_config'),
+         '--restart-file', "#{paths.fetch('data')}/restartcounter"]
+      end
+    end
+  end
+end