@alchemy.run/docker 2.0.0-beta.84 → 2.0.0-beta.86

package/src/Docker.ts

@@ -85,6 +85,42 @@ export class Docker extends Context.Service<
         network?: string | undefined;
         /** Linux capabilities to add. */
         "cap-add"?: Array<string> | undefined;
+        /** Linux capabilities to drop. */
+        "cap-drop"?: Array<string> | undefined;
+        /** Hard memory limit in Docker's byte-suffix format. */
+        memory?: string | undefined;
+        /** Combined memory-and-swap limit in Docker's byte-suffix format. */
+        "memory-swap"?: string | undefined;
+        /** Soft memory reservation for memory contention. */
+        "memory-reservation"?: string | undefined;
+        /** CPU quota, in cores. */
+        cpus?: number | undefined;
+        /** Per-container process and thread limit. */
+        "pids-limit"?: number | undefined;
+        /** Mount the root filesystem read-only. */
+        "read-only"?: boolean | undefined;
+        /** Security options such as `no-new-privileges` and seccomp/AppArmor profiles. */
+        "security-opt"?: Array<string> | undefined;
+        /** Per-container user namespace; "host" disables daemon user remapping. */
+        userns?: string | undefined;
+        /** Supplemental Linux groups. */
+        "group-add"?: Array<string> | undefined;
+        /** Per-process soft/hard resource limits. */
+        ulimit?: Array<string> | undefined;
+        /** Docker log driver. */
+        "log-driver"?: string | undefined;
+        /** Driver-specific Docker logging options. */
+        "log-opt"?: Array<string> | undefined;
+        /** Kernel OOM score adjustment. */
+        "oom-score-adj"?: number | undefined;
+        /** Signal used on container stop. */
+        "stop-signal"?: string | undefined;
+        /** Run Docker's tiny init process. */
+        init?: boolean | undefined;
+        /** Runtime UID/GID or named user. */
+        user?: string | undefined;
+        /** Docker tmpfs mount expressions (target[:options]). */
+        tmpfs?: Array<string> | undefined;
         /** Host devices in Docker's `host:container[:permissions]` form. */
         device?: Array<string> | undefined;
         command: Array<string> | undefined;
@@ -130,6 +166,12 @@ export class Docker extends Context.Service<
           platform?: string;
           target?: string;
           "build-arg"?: Record<string, string>;
+          /**
+           * BuildKit secrets, keyed by id (`RUN --mount=type=secret,id=<id>`).
+           * Values reach `docker` through its environment, never its argv,
+           * and are not written to the image.
+           */
+          secrets?: Record<string, string | Redacted.Redacted<string>>;
           "cache-from"?: Array<string>;
           "cache-to"?: Array<string>;
           args?: Array<string>;
@@ -229,7 +271,26 @@ export class Docker extends Context.Service<
       readonly create: (options: {
         name: string;
         driver: string;
+        /** Whether the network is isolated from external connectivity. */
+        internal?: boolean;
+        /** Whether standalone containers may attach to the network. */
+        attachable?: boolean;
+        /** Explicitly enable or disable IPv4 address allocation. */
+        ipv4?: boolean;
         ipv6?: boolean;
+        /** Network driver options, passed as repeated `--opt` arguments. */
+        opt?: Record<string, string>;
+        /** Network IP Address Management settings. */
+        ipam?: {
+          driver?: string;
+          options?: Record<string, string>;
+          config?: Array<{
+            subnet: string;
+            gateway?: string;
+            ipRange?: string;
+            auxAddresses?: Record<string, string>;
+          }>;
+        };
         label?: Record<string, string>;
         context?: string;
       }) => Effect.Effect<CommandOutput, PlatformError>;
@@ -327,10 +388,12 @@ export class Docker extends Context.Service<
         context?: string;
         replicas?: number;
         "endpoint-mode"?: "vip" | "dnsrr";
+        /** Networks to detach, by name or id; applied before `network-add`. */
+        "network-rm"?: string[];
+        "network-add"?: string[];
         "constraint-add"?: string[];
         "constraint-rm"?: string[];
         "replicas-max-per-node"?: number;
-        "placement-pref"?: string[];
         "update-parallelism"?: number;
         "update-delay"?: string;
         "update-monitor"?: string;
@@ -356,13 +419,23 @@ export class Docker extends Context.Service<
         "health-start-period"?: string;
         "stop-grace-period"?: string;
         "mount-add"?: string[];
+        /** Mount targets to remove. */
+        "mount-rm"?: string[];
         "secret-add"?: string[];
+        /** Secret names to remove; applied before `secret-add`. */
+        "secret-rm"?: string[];
         "config-add"?: string[];
+        /** Config names to remove; applied before `config-add`. */
+        "config-rm"?: string[];
         "read-only"?: boolean;
         "publish-add"?: string[];
+        /** Published ports to remove, as `target=<port>,protocol=<p>,mode=<m>`. */
+        "publish-rm"?: string[];
         "label-add"?: Record<string, string>;
         "label-rm"?: string[];
         "env-add"?: Record<string, string>;
+        /** Environment variable names to remove. */
+        "env-rm"?: string[];
         args?: string;
       }) => Effect.Effect<CommandOutput, PlatformError>;
       /** Inspects a service. */
@@ -423,6 +496,8 @@ export declare namespace Docker {
       Image: string;
       Cmd: string[] | null;
       Env: string[] | null;
+      User?: string;
+      StopSignal?: string;
       Labels: Record<string, string> | null;
       StopTimeout?: number;
       Healthcheck?: {
@@ -442,12 +517,28 @@ export declare namespace Docker {
       AutoRemove: boolean;
       NetworkMode?: string;
       CapAdd?: string[] | null;
+      CapDrop?: string[] | null;
+      Memory?: number;
+      MemorySwap?: number;
+      MemoryReservation?: number;
+      NanoCpus?: number;
+      PidsLimit?: number;
+      ReadonlyRootfs?: boolean;
+      SecurityOpt?: string[] | null;
+      UsernsMode?: string;
+      GroupAdd?: string[] | null;
+      Ulimits?: Array<{ Name: string; Soft: number; Hard: number }> | null;
+      LogConfig?: { Type: string; Config: Record<string, string> | null };
+      OomScoreAdj?: number;
+      Init?: boolean | null;
+      Tmpfs?: Record<string, string> | null;
       Devices?: Array<{
         PathOnHost: string;
         PathInContainer: string;
         CgroupPermissions: string;
       }> | null;
     };
+    AppArmorProfile?: string;
     NetworkSettings: {
       Networks: Record<string, { NetworkID: string; Aliases: string[] | null }> | null;
       Ports?: Record<string, Array<{ HostIp: string; HostPort: string }> | null> | null;
@@ -483,7 +574,21 @@ export declare namespace Docker {
     Created: string;
     Scope: string;
     Driver: string;
+    Internal?: boolean;
+    Attachable?: boolean;
+    EnableIPv4?: boolean;
     EnableIPv6: boolean;
+    Options?: Record<string, string> | null;
+    IPAM?: {
+      Driver?: string;
+      Options?: Record<string, string> | null;
+      Config?: Array<{
+        Subnet: string;
+        Gateway?: string;
+        IPRange?: string;
+        AuxiliaryAddresses?: Record<string, string> | null;
+      }> | null;
+    };
     Labels: Record<string, string> | null;
   }
 }
@@ -832,17 +937,21 @@ const makeDocker = (options: DockerOptions) =>
       },
       image: {
         build: Effect.fn("Docker.image.build")(function* (
-          { context: buildContext, engineContext, args, credentials, ...options },
+          { context: buildContext, engineContext, args, credentials, secrets, ...options },
           session,
           registry,
         ) {
           const tap = outputTap(session);
-          const buildArgs = [buildContext, ...formatArgs(options), ...(args ?? [])];
+          const secret = buildSecrets(secrets);
+          const buildArgs = [buildContext, ...formatArgs(options), ...secret.args, ...(args ?? [])];
           const engine = formatArgs({ context: engineContext });
           if (registry === undefined) {
             return yield* run(
               [...engine, "image", "build", ...buildArgs],
-              credentials ? yield* registryEnvironment(credentials) : undefined,
+              {
+                ...(credentials ? yield* registryEnvironment(credentials) : undefined),
+                ...secret.env,
+              },
               tap,
             );
           }
@@ -853,7 +962,7 @@ const makeDocker = (options: DockerOptions) =>
             const env = yield* registryEnvironment(registry);
             return yield* run(
               [...engine, "buildx", "build", "--push", ...buildArgs],
-              env,
+              { ...env, ...secret.env },
               tap,
             ).pipe(Effect.mapError(classifyDockerRegistryError));
           }
@@ -869,7 +978,7 @@ const makeDocker = (options: DockerOptions) =>
               ...(mode === "load" ? ["buildx", "build", "--load"] : ["image", "build"]),
               ...buildArgs,
             ],
-            undefined,
+            secret.env,
             tap,
           );
           const [tag, ...tags] =
@@ -924,13 +1033,34 @@ const makeDocker = (options: DockerOptions) =>
         remove: (name, force) => run(["context", "rm", ...(force ? ["-f"] : []), name]),
       },
       network: {
-        create: ({ name, driver, ipv6, label, context }) =>
+        create: ({ name, driver, internal, attachable, ipv4, ipv6, opt, ipam, label, context }) =>
           run([
             ...formatArgs({ context }),
             "network",
             "create",
+            ...formatArgs({
+              driver,
+              internal,
+              attachable,
+              ipv6,
+              opt,
+              "ipam-driver": ipam?.driver,
+              "ipam-opt": ipam?.options,
+              label,
+            }),
+            // Docker's boolean --ipv4=false needs an equals sign; the generic
+            // CLI formatter intentionally skips false values elsewhere.
+            ...(ipv4 === undefined ? [] : [`--ipv4=` + String(ipv4)]),
+            ...(ipam?.config ?? []).flatMap(({ subnet, gateway, ipRange, auxAddresses }) => [
+              "--subnet",
+              subnet,
+              ...(gateway === undefined ? [] : ["--gateway", gateway]),
+              ...(ipRange === undefined ? [] : ["--ip-range", ipRange]),
+              ...Object.entries(auxAddresses ?? {})
+                .sort(([a], [b]) => a.localeCompare(b))
+                .flatMap(([key, value]) => ["--aux-address", key + "=" + value]),
+            ]),
             name,
-            ...formatArgs({ driver, ipv6, label }),
           ]),
         connect: ({ network, container, alias, context }) =>
           run([
@@ -1048,6 +1178,22 @@ const systemError = (input: {
     }),
   );
 
+/**
+ * `--secret id=<id>,env=<var>` per secret, with each value under a generated
+ * variable name: an id is the Dockerfile author's choice and may collide with
+ * the environment Docker itself reads (`PATH`, `DOCKER_HOST`).
+ */
+const buildSecrets = (secrets: Record<string, string | Redacted.Redacted<string>> | undefined) => {
+  const args: Array<string> = [];
+  const env: Record<string, string> = {};
+  Object.entries(secrets ?? {}).forEach(([id, value], index) => {
+    const variable = `ALCHEMY_BUILD_SECRET_${index}`;
+    args.push("--secret", `id=${id},env=${variable}`);
+    env[variable] = Redacted.isRedacted(value) ? Redacted.value(value) : value;
+  });
+  return { args, env };
+};
+
 /** Formats a set of options into a list of command-line arguments. */
 const formatArgs = (
   options: Record<
@@ -1057,7 +1203,9 @@ const formatArgs = (
 ) => {
   const args: Array<string> = [];
   for (const [key, value] of Object.entries(options)) {
-    if (!value) continue;
+    // `0` is meaningful (`--replicas 0`, `--update-parallelism 0`), so only
+    // absent, `false` and empty values are omitted.
+    if (value === undefined || value === false || value === "") continue;
     const prefix = key.length > 1 ? `--${key}` : `-${key}`;
     if (value === true) {
       args.push(prefix);

package/src/Dockerfile.ts

@@ -20,7 +20,6 @@
  * const worker = yield* AWS.ECS.Task(
  *   "Transcoder",
  *   {
- *     cluster,
  *     main: import.meta.url,
  *     dockerfile: Dockerfile.inline`
  *       FROM oven/bun:1
@@ -38,7 +37,6 @@
  * const trainer = yield* AWS.ECS.Task(
  *   "Trainer",
  *   {
- *     cluster,
  *     main: import.meta.url,
  *     dockerfile: Dockerfile.inline`
  *       FROM ${base.imageUri}