kitchen-dokken 2.23.4 → 2.23.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d9ccb56c8974df70436872b28c19a5450c2c05bf932455bcfa58aafce70864c
-  data.tar.gz: 8e07df1d7dba596d084ad7a4a102c585052a746cc89bb2e4e67684ac4860711e
+  metadata.gz: 2c7f5b5652cdde267df1ead2dad29ea1c7e3f642cec4b86f3c5ef4c13612a3f3
+  data.tar.gz: 8b94c596b93899da42069d35faed37d4be565c9af5617839ee84f9e44fcc9a86
 SHA512:
-  metadata.gz: c1e01f4007692ced6bf2072031e2ab0ccb64540baac5c8442b52241e9202c744a9392382712b69cf02cf62716410ea645c9c2967f13a8fb8c72ae2cd3a94209e
-  data.tar.gz: b5213a8c3f73612734cc5db99a607c9d9eb4253a5814d563122f7556d14df100aeec431eb459a673b3f083408a7581a778d89e0c5ddc8dfb50cfa7b62952b56c
+  metadata.gz: d48c19a4bdbed503978b68451cded18f2437d2aa0c048d8285344447c4a27503b48937eaf29d93d2fd429316f9c8db240942f09a3333616c939a5cd58555f26d
+  data.tar.gz: 305e81615cc269fdfc685436bbd19b47de69c465006c8ac7b55b42eb8911e4dbfd3e2b36759417347e109c56418176dfa69b5f5136f33669ff2b3e5ffbed4f62

data/lib/kitchen/driver/dokken.rb

@@ -543,7 +543,8 @@ module Kitchen
         return unless self[:network_mode] == "dokken"
 
         with_file_lock("#{home_dir}/.dokken-network.lock") do
-          with_retries { ::Docker::Network.get("dokken", {}, docker_connection) }
+          network = with_retries { ::Docker::Network.get("dokken", {}, docker_connection) }
+          warn_on_ipv6_mismatch(network)
         rescue ::Docker::Error::NotFoundError
           begin
             with_retries { ::Docker::Network.create("dokken", network_settings) }
@@ -553,6 +554,34 @@ module Kitchen
         end
       end
 
+      # Say something when the shared network cannot honour `ipv6: true`.
+      #
+      # The dokken network is created once and shared by every instance, and
+      # `destroy` deliberately leaves it behind -- so on any workstation that
+      # has run a non-ipv6 suite, it already exists without ipv6. Since the
+      # network is only created when absent, a later `ipv6: true` suite
+      # quietly reuses it, the container gets no ipv6 address, and nothing
+      # anywhere says why.
+      #
+      # Deliberately a warning rather than an error: the network may be in use
+      # by other instances right now, and removing it is the user's call.
+      #
+      # @param network [::Docker::Network] the existing dokken network
+      # @return [void]
+      def warn_on_ipv6_mismatch(network)
+        return unless self[:ipv6]
+
+        # A daemon that does not report the flag must not produce a warning on
+        # every converge.
+        enabled = network.info["EnableIPv6"] if network.respond_to?(:info)
+        return if enabled.nil? || enabled
+
+        warn "The existing dokken network was created without IPv6, so `ipv6: true` " \
+             "will have no effect and this instance will get no IPv6 address. The " \
+             "network is shared and `kitchen destroy` leaves it in place; recreate it " \
+             "with `docker network rm dokken` once no containers are using it."
+      end
+
       # Build the data image, unless it is already present.
       #
       # @return [void]
@@ -907,6 +936,7 @@ module Kitchen
       # @param args [Hash] the `/containers/create` body
       # @param platform [String, nil] an OCI platform to pin the container to
       # @return [::Docker::Container] the running container
+      # @raise [Kitchen::ActionFailed] if the container will not stay running
       def run_container(args, platform: nil)
         @container = create_container(args, platform: platform)
         with_retries do
@@ -914,9 +944,34 @@ module Kitchen
           @container = ::Docker::Container.get(args["name"], {}, docker_connection)
           wait_running_state(args["name"], true)
         end
+        assert_running!(args["name"])
         @container
       end
 
+      # Fail the action when a container that has to run is not running.
+      #
+      # wait_running_state stops polling as soon as `FinishedAt` is set, which
+      # is precisely the case for a container whose pid 1 exited -- so without
+      # this check `kitchen create` reported success and exited 0, leaving the
+      # user to discover the problem at converge as a bare docker API message:
+      # "container dd55d579... is not running". A container id, no instance
+      # name, and no clue that pid 1 was the cause.
+      #
+      # Only containers that must actually run reach here; the chef container
+      # is a volume and is never started.
+      #
+      # @param name [String] the container name
+      # @return [void]
+      # @raise [Kitchen::ActionFailed] if the container is not running
+      def assert_running!(name)
+        return if container_state["Running"]
+
+        raise ActionFailed,
+          "The #{name} container exited immediately after being started. " \
+          "Its pid 1 did not stay up: check `pid_one_command`, `entrypoint`, " \
+          "and that the image can boot (`docker logs #{name}` shows why)."
+      end
+
       # The current container's `State` payload.
       #
       # @return [Hash] the state, or an empty hash if there is no container

data/lib/kitchen/driver/dokken_version.rb

@@ -18,6 +18,6 @@
 module Kitchen
   module Driver
     # Version string for Dokken Kitchen driver
-    DOKKEN_VERSION = "2.23.4".freeze
+    DOKKEN_VERSION = "2.23.6".freeze
   end
 end

data/lib/kitchen/transport/dokken.rb

@@ -211,6 +211,31 @@ module Kitchen
             "The data container has no address on any docker network: #{settings[:Networks].inspect}"
         end
 
+        # Every address the data container has, best candidate first.
+        #
+        # A user-defined network comes before the default bridge. That order
+        # matters when kitchen is itself a container: a sibling on the dokken
+        # network can reach the container there but has no route to its
+        # bridge address, and preferring the bridge would send every upload
+        # to the docker host instead.
+        #
+        # The legacy top-level `IPAddress` is the default bridge's, so it
+        # sorts with the bridge and is deduplicated against it.
+        #
+        # @return [Array<String>] addresses, most specific network first
+        # @api private
+        def data_container_addresses
+          settings = options[:data_container][:NetworkSettings]
+          networks = settings[:Networks] || {}
+
+          user_defined, default_bridge = networks.partition { |name, _| name.to_s != "bridge" }
+
+          addresses = (user_defined + default_bridge).map { |_, network| network[:IPAddress].to_s }
+          addresses << settings[:IPAddress].to_s
+
+          addresses.reject(&:empty?).uniq
+        end
+
         # Pick an endpoint for a daemon reached over tcp.
         #
         # The container's address on the dokken network is preferred, since it
@@ -221,31 +246,42 @@ module Kitchen
         # @return [Array(String, String)] the address and port to ssh to
         # @api private
         def tcp_ssh_endpoint
-          name = options[:data_container][:Name]
-
           # DOCKER_HOST
           docker_host_url_ip = options[:docker_host_url].split("tcp://")[1].split(":")[0]
 
-          # mapped IP of data container
-          candidate_ip = ::Docker::Container.all.find do |x|
-            x.info["Names"][0].eql?(name)
-          end.info["NetworkSettings"]["Networks"]["dokken"]["IPAddress"]
-
           # mapped port
           candidate_ssh_port = published_ssh_port
 
-          debug "candidate_ip - #{candidate_ip}"
-          debug "candidate_ssh_port - #{candidate_ssh_port}"
-
-          if port_open?(candidate_ip, candidate_ssh_port)
-            debug "candidate_ip - #{candidate_ip}/#{candidate_ssh_port} open"
-            [candidate_ip, candidate_ssh_port]
-          elsif port_open?(candidate_ip, "22")
-            debug "candidate_ip - #{candidate_ip}/22 open"
-            [candidate_ip, "22"]
-          else
-            [docker_host_url_ip, candidate_ssh_port]
+          # The addresses come from the state the driver recorded after it
+          # started the container. This used to ask the daemon instead --
+          # Docker::Container.all, find ours by name, then read
+          # Networks["dokken"]["IPAddress"] -- which was wrong twice over.
+          #
+          # Container.all lists only *running* containers, so a data container
+          # that had exited made `find` return nil and the chained `.info`
+          # raise `undefined method 'info' for nil`. And the dokken network is
+          # only attached when network_mode is left at its default:
+          # start_data_container adds the endpoint
+          # "unless %w{host bridge}.include?" and names it after network_mode,
+          # so `bridge`, `host` and every custom network name produced
+          # `undefined method '[]' for nil` on a remote daemon.
+          data_container_addresses.each do |candidate_ip|
+            debug "candidate_ip - #{candidate_ip}"
+            debug "candidate_ssh_port - #{candidate_ssh_port}"
+
+            if port_open?(candidate_ip, candidate_ssh_port)
+              debug "candidate_ip - #{candidate_ip}/#{candidate_ssh_port} open"
+              return [candidate_ip, candidate_ssh_port]
+            elsif port_open?(candidate_ip, "22")
+              debug "candidate_ip - #{candidate_ip}/22 open"
+              return [candidate_ip, "22"]
+            end
           end
+
+          # Nothing answered, or -- with host networking -- the container has
+          # no address of its own to try. The docker host is the endpoint.
+          debug "no data container address answered; falling back to the docker host"
+          [docker_host_url_ip, candidate_ssh_port]
         end
 
         # Write the built-in insecure private key somewhere ssh will accept it.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-dokken
 version: !ruby/object:Gem::Version
-  version: 2.23.4
+  version: 2.23.6
 platform: ruby
 authors:
 - Sean OMeara