@bakers-build/addon-runtime-docker 0.9.1-next.5 → 0.9.1-next.6

package/dist/src/args.d.ts

@@ -13,11 +13,10 @@ export interface DockerOptions {
 }
 /** Host facts the launch depends on, resolved by the backend. */
 export interface HostPaths {
-    gitCommonDir: string;
-    /** The worktree's own Git dir; the common dir itself for a main checkout. */
-    gitDir: string;
-    /** `<worktree>/.git` when it is a gitlink file. */
-    gitLink?: string;
+    /** The run clone's Git directory, mounted as `<workspace>/.git`. */
+    runGitDir?: string;
+    /** A `shared` clone's parent object store, mounted read-only at its own path. */
+    sharedObjects?: string;
     /** The per-run home, mounted at its host path. */
     runHome: string;
     /** The bakers CLI build, mounted read-only at its host path. */

package/dist/src/args.js

@@ -1,4 +1,3 @@
-import { join } from 'node:path';
 /** The image's PATH, behind the run home's `bin` (the `bakers` shim lives there). */
 export const RUN_PATH = `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`;
 export const PROXY_PORTS = { egress: 3128, api: 8081, tools: 8082 };
@@ -37,9 +36,6 @@ export function dockerArgs(input, opts, where) {
         !overridden.has(k) &&
         // Allowlist mode keeps the model credential in the proxy only.
         !(allowlist && credentials.includes(k)));
-    const common = where.gitCommonDir;
-    const gitDir = where.gitDir;
-    const linked = gitDir !== common;
     const ro = (path) => bind(path, path, ':ro');
     const argv = [
         opts.docker,
@@ -58,30 +54,16 @@ export function dockerArgs(input, opts, where) {
         ...computed.flatMap((c) => ['-e', c]),
         ...forwarded.flatMap((k) => ['-e', k]),
         ...bind(ws),
-        ...(where.gitLink ? bind(where.gitLink, undefined, ':ro') : []),
-        ...bind(common),
-        // The run must not plant a hook, rewrite Git config or repoint a worktree's
-        // Git dir: host git in these repos would run what the run chose.
-        ...ro(join(common, 'hooks')),
-        ...ro(join(common, 'config')),
-        // Read by host git in the main checkout once `extensions.worktreeConfig` is on.
-        ...ro(join(common, 'config.worktree')),
-        ...ro(join(common, 'modules')),
-        ...ro(join(common, 'worktrees')),
-        ...(linked
-            ? [
-                // Docker mounts by depth, so this reopens only the run's own Git dir.
-                ...bind(gitDir),
-                ...ro(join(gitDir, 'commondir')),
-                ...ro(join(gitDir, 'gitdir')),
-                ...ro(join(gitDir, 'config.worktree')),
-            ]
-            : []),
+        // The only Git the run sees; the parent repository is not mounted.
+        ...(where.runGitDir ? bind(where.runGitDir, `${ws}/.git`) : []),
+        ...(where.sharedObjects ? ro(where.sharedObjects) : []),
         ...bind(where.cliRoot, undefined, ':ro'),
         ...opts.mounts.flatMap((m) => bind(m, m, ':ro')),
         ...bind(where.runHome),
         ...(input.readPaths ?? []).flatMap((path) => ro(path)),
         ...(input.writePaths ?? []).flatMap((path) => bind(path)),
+        // Shared host files over their placeholders in the run home.
+        ...(input.bindPaths ?? []).flatMap(({ source, target }) => bind(source, target)),
         '-w',
         ws,
         opts.image,

package/dist/src/backend.d.ts

@@ -31,6 +31,5 @@ export interface BackendDeps {
 }
 /** The first 12 hex chars of the sha256 of `text`. */
 export declare const shortHash: (text: string) => string;
-export { quarantinePlanted } from '@bakers-build/core';
 export declare const realExec: BackendDeps['exec'];
 export declare function dockerRuntime(options: RuntimeDockerOptions, deps: BackendDeps): BbRuntime;

package/dist/src/backend.js

@@ -1,15 +1,14 @@
 import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { existsSync, mkdirSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
-import { isAbsolute, join, resolve, sep } from 'node:path';
+import { dirname, isAbsolute, join, resolve, sep } from 'node:path';
 import { promisify } from 'node:util';
-import { quarantinePlanted, shellQuote, } from '@bakers-build/core';
+import { shellQuote } from '@bakers-build/core';
 import { API_KEY_PLACEHOLDER, dockerArgs, PROXY_PORTS, } from './args.js';
 const EGRESS_NETWORK = 'bb-runtime-egress';
 /** The first 12 hex chars of the sha256 of `text`. */
 export const shortHash = (text) => createHash('sha256').update(text).digest('hex').slice(0, 12);
-export { quarantinePlanted } from '@bakers-build/core';
 const run = promisify(execFile);
 export const realExec = (file, args) => run(file, args);
 export function dockerRuntime(options, deps) {
@@ -35,8 +34,6 @@ export function dockerRuntime(options, deps) {
             throw new Error(`runtime-docker: invalid run uuid ${JSON.stringify(uuid)}`);
         return join(cacheHome, 'bakers/runtime', uuid);
     };
-    // Beside the run home, never mounted: cleanup trusts it to find the worktree.
-    const recordOf = (uuid) => `${runHomeOf(uuid)}.workspace.json`;
     // One image per agent install; built once each.
     const imagesReady = new Map();
     const ensureImage = async (image, install) => {
@@ -111,13 +108,6 @@ export function dockerRuntime(options, deps) {
         ]);
         await deps.exec(docker, ['network', 'connect', opts.runNetwork, proxyName]);
     };
-    const git = async (ws, flag) => (await deps.exec('git', [
-        '-C',
-        ws,
-        'rev-parse',
-        '--path-format=absolute',
-        flag,
-    ])).stdout.trim();
     const credentialsFor = (agent) => {
         const api = agent.modelApi;
         if (allowlist && !api)
@@ -176,14 +166,21 @@ export function dockerRuntime(options, deps) {
                 await proxyReady.ready;
             }
             const ws = launch.workspacePath;
-            const gitCommonDir = await git(ws, '--git-common-dir');
-            const gitDir = await git(ws, '--git-dir');
-            const gitLink = join(ws, '.git');
+            const runGitDir = launch.gitDir;
             const within = (path, root) => path === root || path.startsWith(root + sep);
+            if (within(realpathSync(dirname(runHome)), realpathSync(ws)))
+                throw new Error('runtime-docker: private state must stay outside the worktree');
+            if (runGitDir && within(realpathSync(runGitDir), realpathSync(ws)))
+                throw new Error('runtime-docker: the run Git directory must stay outside the workspace');
             const canonical = (path) => existsSync(path) ? realpathSync(path) : resolve(path);
+            const binds = launch.bindPaths ?? [];
+            for (const { target } of binds)
+                if (target.includes(':') || !within(resolve(target), resolve(runHome)))
+                    throw new Error(`runtime-docker: shared file target outside the run home ${target}`);
             for (const [paths, write] of [
                 [launch.readPaths ?? [], false],
                 [launch.writePaths ?? [], true],
+                [binds.map(({ source }) => source), true],
             ]) {
                 for (const path of paths) {
                     if (!isAbsolute(path) || path.includes(':') || !existsSync(path))
@@ -193,21 +190,19 @@ export function dockerRuntime(options, deps) {
                         (deps.env.HOME && within(canonical(deps.env.HOME), actual)))
                         throw new Error(`runtime-docker: refusing broad path ${path}`);
                     if (write &&
-                        [gitCommonDir, gitLink, deps.cliRoot].some((root) => within(actual, canonical(root)) ||
+                        [
+                            ...(runGitDir ? [runGitDir] : []),
+                            ...(launch.sharedObjects ? [launch.sharedObjects] : []),
+                            dirname(runHome),
+                            join(ws, '.git'),
+                            deps.cliRoot,
+                            ...(launch.readPaths ?? []),
+                            ...opts.mounts,
+                        ].some((root) => within(actual, canonical(root)) ||
                             within(canonical(root), actual)))
                         throw new Error(`runtime-docker: protected write path ${path}`);
                 }
             }
-            // Bound read-only, so each must exist before docker would create it as root.
-            for (const d of ['hooks', 'modules', 'worktrees'])
-                mkdirSync(join(gitCommonDir, d), { recursive: true });
-            for (const dir of new Set([gitCommonDir, gitDir])) {
-                const worktreeConfig = join(dir, 'config.worktree');
-                if (!existsSync(worktreeConfig))
-                    writeFileSync(worktreeConfig, '');
-            }
-            mkdirSync(runHome, { recursive: true });
-            writeFileSync(recordOf(launch.run.uuid), JSON.stringify({ workspace: ws, gitCommonDir }));
             // The CLI build is mounted read-only; this puts the conductor's own CLI on PATH.
             if (deps.bakersEntry) {
                 mkdirSync(join(runHome, 'bin'), { recursive: true });
@@ -219,10 +214,9 @@ export function dockerRuntime(options, deps) {
                 for (const k of credentials)
                     env[k] = deps.env[k];
             const { argv, env: runEnv } = dockerArgs({ ...launch, env }, { ...opts, image }, {
-                gitCommonDir,
-                gitDir,
-                ...(statSync(gitLink, { throwIfNoEntry: false })?.isFile()
-                    ? { gitLink }
+                ...(runGitDir ? { runGitDir } : {}),
+                ...(launch.sharedObjects
+                    ? { sharedObjects: launch.sharedObjects }
                     : {}),
                 runHome,
                 cliRoot: deps.cliRoot,
@@ -253,20 +247,6 @@ export function dockerRuntime(options, deps) {
                 deps.logger.warn({ run: r.uuid, err: String(err) }, 'runtime container cleanup failed');
                 return;
             }
-            // After the container is gone, so the run cannot plant anything behind the scan.
-            const record = recordOf(r.uuid);
-            if (existsSync(record)) {
-                try {
-                    const { workspace, gitCommonDir } = JSON.parse(readFileSync(record, 'utf8'));
-                    const moved = await quarantinePlanted(workspace, gitCommonDir, deps.exec);
-                    if (moved.length > 0)
-                        deps.logger.warn({ run: r.uuid, moved }, 'runtime quarantined repositories the run planted');
-                    rmSync(record);
-                }
-                catch (err) {
-                    deps.logger.error({ run: r.uuid, err: String(err) }, 'runtime quarantine failed: host git in the worktree may run what the run planted');
-                }
-            }
             rmSync(runHomeOf(r.uuid), { recursive: true, force: true });
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakers-build/addon-runtime-docker",
-  "version": "0.9.1-next.5",
+  "version": "0.9.1-next.6",
   "description": "Start each agent run in its own Docker or Podman container.",
   "type": "module",
   "license": "MIT",
@@ -23,11 +23,11 @@
     "directory": "bakers-cli/addons/runtime-docker"
   },
   "peerDependencies": {
-    "@bakers-build/conductor": "^0.9.1-next.5",
-    "@bakers-build/core": "^0.9.1-next.5"
+    "@bakers-build/conductor": "^0.9.1-next.6",
+    "@bakers-build/core": "^0.9.1-next.6"
   },
   "bakersBuild": {
-    "commit": "d9242cad6cabee1faf010b5d46ac1bac33f6e0a1",
+    "commit": "e7d9921d51d5c045f29ca7e35d1e6a348e6ddf08",
     "channel": "next"
   }
 }