@capsulos/provider-docker 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +8 -0
- package/dist/index.js.map +1 -1
- package/package.json +2 -2
- package/src/docker.e2e.test.ts +28 -0
- package/src/index.ts +8 -0
package/dist/index.js
CHANGED
|
@@ -31,6 +31,14 @@ export class DockerProvider {
|
|
|
31
31
|
// Mounts work with real kernel privileges, same as on Lambda with additionalOsCapabilities=ALL.
|
|
32
32
|
if (spec.mounts && Object.keys(spec.mounts).length)
|
|
33
33
|
args.push('--privileged');
|
|
34
|
+
// The network policy locks the container's routes from inside (CAP_NET_ADMIN)
|
|
35
|
+
// and needs reverse-path filtering off, or the kernel drops the replies to
|
|
36
|
+
// the proxy's connections; /proc/sys is read-only in the container, so
|
|
37
|
+
// the sysctls are set here.
|
|
38
|
+
if (spec.network?.internet === 'deny') {
|
|
39
|
+
args.push('--cap-add', 'NET_ADMIN');
|
|
40
|
+
args.push('--sysctl', 'net.ipv4.conf.all.rp_filter=0', '--sysctl', 'net.ipv4.conf.default.rp_filter=0');
|
|
41
|
+
}
|
|
34
42
|
for (const [k, v] of Object.entries(spec.metadata ?? {}))
|
|
35
43
|
args.push('-e', `CAPSULE_${k.toUpperCase()}=${v}`);
|
|
36
44
|
if (spec.clientToken)
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,qEAAqE;AACrE,8EAA8E;AAC9E,gEAAgE;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,YAAY,GASb,MAAM,eAAe,CAAC;AAEvB,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAShC,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,QAAQ,CAAC;IACR,MAAM,CAAS;IACf,KAAK,CAAS;IAE/B,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAG,IAAc;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAA2C,CAAC;YACtD,MAAM,IAAI,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,QAAuB,EAAE;QACvD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,aAAa,EAAE,CAAC,CAAC;QACrG,gGAAgG;QAChG,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7G,IAAI,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,sBAAsB,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,YAAY,CAAC,qCAAqC,MAAM,+CAA+C,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QACtL,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO;YACL,EAAE;YACF,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,QAAQ,EAAE,UAAU,CAAC,OAAO;YAC5B,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACrE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAIxB,CAAC;YACF,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrH,OAAO;gBACL,EAAE;gBACF,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK;gBACxB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC9B,YAAY,EAAE,QAAQ;gBACtB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aACpF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,iDAAiD,CAAC,CAAC;QAClJ,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAClC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3G,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,KAAK,CAAC,EAAU;QACpB,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,IAAY;QACrC,IAAI,CAAC,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,YAAY,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,MAAM,CAAC,CAAC;QAChE,iEAAiE;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,0BAA0B,aAAa,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,OAAO,EAAE,oBAAoB,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChF,CAAC;CACF;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC;QACrB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,YAAY,CAAC;QACtB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,qEAAqE;AACrE,8EAA8E;AAC9E,gEAAgE;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,YAAY,GASb,MAAM,eAAe,CAAC;AAEvB,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAShC,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,QAAQ,CAAC;IACR,MAAM,CAAS;IACf,KAAK,CAAS;IAE/B,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAG,IAAc;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAA2C,CAAC;YACtD,MAAM,IAAI,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,QAAuB,EAAE;QACvD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,aAAa,EAAE,CAAC,CAAC;QACrG,gGAAgG;QAChG,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9E,8EAA8E;QAC9E,2EAA2E;QAC3E,uEAAuE;QACvE,4BAA4B;QAC5B,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,+BAA+B,EAAE,UAAU,EAAE,mCAAmC,CAAC,CAAC;QAC1G,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7G,IAAI,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,sBAAsB,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,YAAY,CAAC,qCAAqC,MAAM,+CAA+C,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QACtL,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO;YACL,EAAE;YACF,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,QAAQ,EAAE,UAAU,CAAC,OAAO;YAC5B,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACrE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAIxB,CAAC;YACF,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrH,OAAO;gBACL,EAAE;gBACF,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK;gBACxB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC9B,YAAY,EAAE,QAAQ;gBACtB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aACpF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,iDAAiD,CAAC,CAAC;QAClJ,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAClC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3G,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,KAAK,CAAC,EAAU;QACpB,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,IAAY;QACrC,IAAI,CAAC,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,YAAY,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,MAAM,CAAC,CAAC;QAChE,iEAAiE;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,0BAA0B,aAAa,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,OAAO,EAAE,oBAAoB,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChF,CAAC;CACF;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC;QACrB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,YAAY,CAAC;QACtB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@capsulos/provider-docker",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.0",
|
|
4
4
|
"description": "capsulos provider for local Docker: the development and CI bench. Not an isolation boundary.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"keywords": [
|
|
@@ -43,7 +43,7 @@
|
|
|
43
43
|
"access": "public"
|
|
44
44
|
},
|
|
45
45
|
"dependencies": {
|
|
46
|
-
"@capsulos/sdk": "0.
|
|
46
|
+
"@capsulos/sdk": "0.3.0"
|
|
47
47
|
},
|
|
48
48
|
"devDependencies": {
|
|
49
49
|
"@types/node": "^22.20.1",
|
package/src/docker.e2e.test.ts
CHANGED
|
@@ -77,6 +77,34 @@ describe.skipIf(!dockerHasImage(IMAGE))('docker provider e2e', () => {
|
|
|
77
77
|
}
|
|
78
78
|
});
|
|
79
79
|
|
|
80
|
+
it('enforces a network policy: allow list through the proxy, everything else unreachable', async () => {
|
|
81
|
+
const locked = await Capsule.create(
|
|
82
|
+
provider,
|
|
83
|
+
{ template: IMAGE!, network: { internet: 'deny', allow: ['registry.npmjs.org'] } },
|
|
84
|
+
{ readyTimeoutMs: 60_000 },
|
|
85
|
+
);
|
|
86
|
+
try {
|
|
87
|
+
const h = await locked.health();
|
|
88
|
+
expect(h.network).toMatchObject({ internet: 'deny', enforced: true, proxy: '127.0.0.1:3128' });
|
|
89
|
+
// Allowed host, through HTTPS_PROXY (inherited by every exec).
|
|
90
|
+
const ok = await locked.commands.run('curl -fsS -m 20 -o /dev/null -w "%{http_code}" https://registry.npmjs.org/-/ping');
|
|
91
|
+
expect(ok.stdout, ok.stderr).toBe('200');
|
|
92
|
+
// Blocked host: the proxy answers 403 (curl -f → exit 22).
|
|
93
|
+
const blocked = await locked.commands.run('curl -fsS -m 20 https://example.com/ 2>&1; echo "exit=$?"');
|
|
94
|
+
expect(blocked.stdout).toMatch(/403/);
|
|
95
|
+
expect(blocked.stdout).toMatch(/exit=22/);
|
|
96
|
+
// Bypassing the proxy variables does not help: the default route is a
|
|
97
|
+
// blackhole, so even the DNS lookup has nowhere to go (curl 6: could not
|
|
98
|
+
// resolve; 7 / 28 would be the connect failing or timing out).
|
|
99
|
+
const direct = await locked.commands.run('curl -sS -m 5 --noproxy "*" https://example.com/ 2>&1; echo "exit=$?"');
|
|
100
|
+
expect(direct.stdout).toMatch(/exit=(6|7|28)/);
|
|
101
|
+
expect(direct.stdout).not.toMatch(/exit=0/);
|
|
102
|
+
expect((await locked.health()).network?.blocked).toBeGreaterThanOrEqual(1);
|
|
103
|
+
} finally {
|
|
104
|
+
await locked.kill();
|
|
105
|
+
}
|
|
106
|
+
}, 120_000);
|
|
107
|
+
|
|
80
108
|
it('lists and terminates capsules', async () => {
|
|
81
109
|
const before = await provider.list();
|
|
82
110
|
expect(before.map((c) => c.id)).toContain(capsule.id);
|
package/src/index.ts
CHANGED
|
@@ -52,6 +52,14 @@ export class DockerProvider implements Provider {
|
|
|
52
52
|
const args = ['run', '-d', '--label', `capsulos=${this.label}`, '-p', `127.0.0.1::${CAPSULOD_PORT}`];
|
|
53
53
|
// Mounts work with real kernel privileges, same as on Lambda with additionalOsCapabilities=ALL.
|
|
54
54
|
if (spec.mounts && Object.keys(spec.mounts).length) args.push('--privileged');
|
|
55
|
+
// The network policy locks the container's routes from inside (CAP_NET_ADMIN)
|
|
56
|
+
// and needs reverse-path filtering off, or the kernel drops the replies to
|
|
57
|
+
// the proxy's connections; /proc/sys is read-only in the container, so
|
|
58
|
+
// the sysctls are set here.
|
|
59
|
+
if (spec.network?.internet === 'deny') {
|
|
60
|
+
args.push('--cap-add', 'NET_ADMIN');
|
|
61
|
+
args.push('--sysctl', 'net.ipv4.conf.all.rp_filter=0', '--sysctl', 'net.ipv4.conf.default.rp_filter=0');
|
|
62
|
+
}
|
|
55
63
|
for (const [k, v] of Object.entries(spec.metadata ?? {})) args.push('-e', `CAPSULE_${k.toUpperCase()}=${v}`);
|
|
56
64
|
if (spec.clientToken) args.push('--name', `capsule-${spec.clientToken}`);
|
|
57
65
|
args.push(spec.template);
|