@celilo/e2e 0.20.4 → 0.20.6

package/docker/Dockerfile.greenwave-sim

@@ -1,4 +1,4 @@
-FROM oven/bun:latest@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 RUN apt-get update && apt-get install -y \
     openssh-server \

package/docker/Dockerfile.ip-echo

@@ -1,4 +1,4 @@
-FROM oven/bun:latest@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 # iproute2 so the entrypoint can see its own addressing when debugging; the
 # service itself needs no routing changes (it sits on internet-external with

package/docker/Dockerfile.isitup

@@ -1,4 +1,4 @@
-FROM oven/bun:latest@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 # Caddy (for ACME/TLS termination) + tools needed by entrypoint.sh.
 # iproute2 provides `ip` so the entrypoint can rewrite the default route

package/docker/Dockerfile.management

@@ -1,4 +1,4 @@
-FROM oven/bun:latest@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 # This Dockerfile produces a *vanilla* management image — bun + unzip +
 # bunfig, no celilo. `cele2e build-infra` runs install.sh inside a
@@ -124,6 +124,36 @@ ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
 # fall through to Bun's normal resolution.
 RUN printf '[install.scopes]\n"@celilo" = "http://npm-registry.lab"\n' > /root/.bunfig.toml
 
+# --- The fleet browser runtime (managed-browser-runtime) ----------------------
+#
+# Browser-driven health checks (celilo-web-console is the first) resolve
+# `/var/lib/celilo/browsers/current/chrome` and a descriptor describing what
+# was installed. This image provisions that runtime the way the celilo-mgmt
+# role does on a real management host (`modules/celilo-mgmt/ansible/roles/
+# celilo-mgmt/tasks/debian.yml`), pinned to the SAME playwright version that
+# role declares — the fleet's single browser-version declaration. A module
+# bundling a different client is a pin-drift finding, not a failure: the
+# consumer passes the stable path explicitly.
+#
+# Revision comes from the pinned client itself (`install --dry-run`), never
+# from a hand-maintained version→revision table — same reasoning as the role.
+ARG PLAYWRIGHT_VERSION=1.60.0
+RUN set -eux; \
+    REVISION="$(PLAYWRIGHT_BROWSERS_PATH=/var/lib/celilo/browsers bun x "playwright-core@${PLAYWRIGHT_VERSION}" install --dry-run chromium-headless-shell \
+      | grep -oE 'chromium_headless_shell-[0-9]+' | head -1 | cut -d- -f2)"; \
+    PLAYWRIGHT_BROWSERS_PATH=/var/lib/celilo/browsers bun x "playwright-core@${PLAYWRIGHT_VERSION}" install chromium-headless-shell; \
+    PLAYWRIGHT_BROWSERS_PATH=/var/lib/celilo/browsers bun x "playwright-core@${PLAYWRIGHT_VERSION}" install-deps chromium-headless-shell; \
+    BIN="$(find /var/lib/celilo/browsers/chromium_headless_shell-"${REVISION}" -type f \
+      \( -name chrome-headless-shell -o -name headless_shell \) | head -1)"; \
+    test -x "${BIN}"; \
+    mkdir -p /var/lib/celilo/browsers/current; \
+    ln -sf "${BIN}" /var/lib/celilo/browsers/current/chrome; \
+    BROWSER_VERSION="$(/var/lib/celilo/browsers/current/chrome --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)"; \
+    printf '{"schemaVersion":1,"browser":"chromium","flavor":"headless-shell","browserVersion":"%s","playwrightVersion":"%s","revision":"%s","writtenBy":"e2e management image"}' \
+      "${BROWSER_VERSION}" "${PLAYWRIGHT_VERSION}" "${REVISION}" \
+      > /var/lib/celilo/browsers/current/celilo-browser.json; \
+    cat /var/lib/celilo/browsers/current/celilo-browser.json
+
 # Standard modules pre-packaged as .netapp files — built by e2e-build.
 # Tests import from /netapps/<module>.netapp instead of the monorepo mount.
 COPY netapps/ /netapps/

package/docker/Dockerfile.npm-registry-sim

@@ -1,4 +1,4 @@
-FROM oven/bun:1@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 WORKDIR /app
 

package/docker/Dockerfile.proxmox-sim

@@ -1,4 +1,4 @@
-FROM oven/bun:1@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 WORKDIR /app
 

package/docker/Dockerfile.registry

@@ -1,4 +1,4 @@
-FROM oven/bun:1@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 WORKDIR /app
 

package/docker/Dockerfile.signal-sim

@@ -6,7 +6,7 @@
 # arrives: it can queue an inbound reply, fail a recipient inside a success,
 # and revoke the device link on demand — none of which the real unlinked
 # daemon can be made to do.
-FROM oven/bun:1@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 WORKDIR /app
 COPY simulators/signal-cli/server.ts ./server.ts

package/docker/Dockerfile.socks-proxy

@@ -18,6 +18,11 @@ RUN apt-get update && apt-get install -y \
     iproute2 \
     iputils-ping \
     dnsutils \
+    # wireguard-tools: the control-plane-vpn vantage. A browser that reaches
+    # celilo-web-console (secure-mgmt, VPN-only per D7) must enter as a real
+    # VPN peer — the proxy brings up a wg tunnel, it does not attach directly
+    # to the zone. Needs /dev/net/tun at `docker run` time (socks-proxy.ts).
+    wireguard-tools \
     && rm -rf /var/lib/apt/lists/*
 
 COPY config/socks/danted.conf /etc/danted.conf

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.20.4",
+  "version": "0.20.6",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -38,9 +38,9 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/capabilities": "^5.1.0",
+    "@celilo/capabilities": "^6.0.0",
     "@celilo/cli-display": "^0.2.0",
-    "@celilo/event-bus": "^0.6.0",
+    "@celilo/event-bus": "^0.7.0",
     "@celilo/terraform-fake": "^0.3.1",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"

package/scripts/dockerhub-login.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Authenticate the builder to Docker Hub before any e2e image build.
+#
+# celilo#1376: the e2e base images are digest-pinned, which makes a pull
+# REPRODUCIBLE — it does not make it ALLOWED. Docker Hub meters anonymous pulls
+# per source IP, and once the builder's share is spent every pull fails at
+# `load metadata` with:
+#
+#   ERROR: pull access denied ... insufficient_scope: authorization failed
+#
+# which reads like a missing image rather than a spent quota. An authenticated
+# pull draws on the account's much larger allowance instead.
+#
+# No credentials configured (a fork, a local run) => stay anonymous and say so,
+# rather than failing the build for a quota that may well not be spent.
+set -eu
+
+if [ -z "${DOCKERHUB_USERNAME:-}" ] || [ -z "${DOCKERHUB_TOKEN:-}" ]; then
+  echo "DOCKERHUB_USERNAME/DOCKERHUB_TOKEN unset — pulling Docker Hub anonymously."
+  echo "Anonymous pulls share this host's IP quota; a spent quota fails as"
+  echo "'insufficient_scope: authorization failed' at 'load metadata' (celilo#1376)."
+  exit 0
+fi
+
+printf '%s' "${DOCKERHUB_TOKEN}" |
+  docker login --username "${DOCKERHUB_USERNAME}" --password-stdin

package/src/socks-proxy.ts

@@ -3,6 +3,7 @@ import { existsSync } from 'node:fs';
 import { createConnection } from 'node:net';
 import { join } from 'node:path';
 import { progress } from './progress';
+import type { ExecResult, SocksProxyHandle } from './types';
 
 /** Package root — `docker/` and `config/` live here. */
 const PACKAGE_ROOT = join(__dirname, '..');
@@ -37,17 +38,6 @@ export interface SocksProxyOptions {
   nameserver?: string;
 }
 
-export interface SocksProxyHandle {
-  /** URL the host can use to reach the proxy, e.g. 'socks5://127.0.0.1:54321' */
-  hostUrl: string;
-  /** The published host port (the second half of hostUrl) */
-  hostPort: number;
-  /** Container name (deterministic per project + vantage) */
-  containerName: string;
-  /** Tear down the proxy. Idempotent. */
-  stop(): Promise<void>;
-}
-
 /**
  * Custom image with dante-server + an entrypoint that fixes routing
  * and DNS for the chosen vantage. Built from
@@ -139,6 +129,11 @@ export async function startSocksProxy(
         `--network ${networkName}`,
         `--ip ${cfg.ip}`,
         '--cap-add NET_ADMIN',
+        // wireguard-tools in the image plus the TUN device let the proxy bring
+        // up a real WireGuard tunnel, which is how a browser enters the
+        // topology as a control-plane-vpn peer (celilo-web-console's only
+        // client path, D7). Harmless for the plain vantages.
+        '--device /dev/net/tun',
         `-e VANTAGE=${vantage}`,
         ...(options.nameserver ? [`-e NAMESERVER_OVERRIDE=${options.nameserver}`] : []),
         '-p 127.0.0.1::1080',
@@ -224,6 +219,32 @@ function makeHandle(containerName: string, port: number): SocksProxyHandle {
     hostUrl: `socks5://127.0.0.1:${port}`,
     hostPort: port,
     containerName,
+    /**
+     * Run a command inside the proxy container.
+     *
+     * The proxy is started with `docker run`, not compose, so
+     * `net.exec` (a `docker compose exec`) cannot reach it. The
+     * control-plane-vpn test uses this to bring the proxy's WireGuard
+     * tunnel up after the tunnel has deployed — the peer is the proxy,
+     * so the browser behind it enters the topology the way a real
+     * admin laptop does.
+     */
+    async exec(cmd, timeoutMs = 60_000): Promise<ExecResult> {
+      try {
+        const stdout = execSync(`docker exec ${containerName} bash -c ${JSON.stringify(cmd)}`, {
+          timeout: timeoutMs,
+          stdio: 'pipe',
+        }).toString();
+        return { stdout, stderr: '', exitCode: 0 };
+      } catch (err: unknown) {
+        const e = err as { stdout?: Buffer; stderr?: Buffer; status?: number };
+        return {
+          stdout: e.stdout?.toString() ?? '',
+          stderr: e.stderr?.toString() ?? String(err),
+          exitCode: e.status ?? 1,
+        };
+      }
+    },
     async stop(): Promise<void> {
       if (stopped) return;
       stopped = true;

package/src/types.ts

@@ -220,6 +220,14 @@ export interface SocksProxyHandle {
   hostPort: number;
   /** Container name (deterministic per project + vantage) */
   containerName: string;
+  /**
+   * Run a command inside the proxy container (raw `docker exec`).
+   *
+   * The proxy is started with `docker run`, not compose, so `net.exec`
+   * cannot reach it. The control-plane-vpn browser test uses this to bring
+   * the proxy's WireGuard tunnel up after the tunnel has deployed.
+   */
+  exec(cmd: string, timeoutMs?: number): Promise<ExecResult>;
   /** Tear down the proxy. Idempotent. */
   stop(): Promise<void>;
 }