@dharma-ai-labs/agent-fabric 0.2.135 → 0.2.136

package/README.md

@@ -37,7 +37,18 @@ command accepts no grant, policy, provider or task arguments. Inspect the
 credential-free plan with `relay container-entrypoint --dry-run` before image
 installation; it makes no local changes. Set an explicit
 private `DHARMA_HOME` before launch. An npm wrapper, shell that does not exec,
-`sleep` or init shim as PID1 does not qualify.
+`sleep` or an arbitrary init shim as PID1 does not qualify. A narrowly verified
+Docker `--init` route also supports the canonical CLI as the non-root direct
+child of Docker's root-owned, non-writable `/sbin/docker-init` executable. This
+route retains the existing official Node-image command
+`docker-entrypoint.sh sleep infinity`; an explicitly approved public entrypoint
+migration must exec the canonical Node/CLI command as that init's main child.
+The CLI checks the executable inode, UID, both process start times and the
+kernel's first init-child identity, retaining zombies rather than promoting
+adopted processes. The controller must also retain init's session and its own
+process group. The main-child and process identities are checked again before
+control is admitted; a foreground or orphaned `docker exec` or a fabricated
+marker cannot claim startup.
 
 The image/operator must provide its own protected Secret Service, private
 session bus and durable private home. Never mount a host bus or copy another
@@ -52,7 +63,7 @@ The entrypoint owns one relay for that container OS user. It never creates a
 second host service or changes an existing systemd user unit. Owned start/stop
 controls use atomic private receipts; disable removes the registration. It
 reaps its child on normal shutdown and retries an exited child with a bounded
-delay. A new container boot renews only its own PID1 lease while retaining its
+delay. A new container boot renews only its own entrypoint lease while retaining its
 configuration and encrypted state. Runtime-version mismatch blocks restart;
 upgrade the reviewed image/runtime together through the normal release path.
 

package/dist/containerDockerInit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=containerDockerInit.test.d.ts.map

package/dist/containerDockerInit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerDockerInit.test.d.ts","sourceRoot":"","sources":["../src/containerDockerInit.test.ts"],"names":[],"mappings":""}

package/dist/containerDockerInit.test.js

@@ -0,0 +1,187 @@
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import * as lifecycle from './containerRelayLifecycle.js';
+import { enableRelayAutostart, relayAutostartStatus } from './relayAutostart.js';
+const linux = { skip: process.platform !== 'linux' };
+async function fixture() {
+    const root = await mkdtemp(join(tmpdir(), 'dharma-docker-init-'));
+    const home = join(root, 'device');
+    const workspace = join(root, 'checkout');
+    await mkdir(join(home, 'relay'), { recursive: true, mode: 0o700 });
+    await mkdir(join(workspace, '.dharma'), { recursive: true, mode: 0o700 });
+    const uid = process.getuid();
+    const init = { pid: 1, parentPid: 0, processGroupId: 1, sessionId: 1, uid, startTicks: '123', argv: ['/sbin/docker-init', '--', 'docker-entrypoint.sh', 'sleep', 'infinity'] };
+    const controller = { pid: 42, parentPid: 1, processGroupId: 42, sessionId: 1, uid, startTicks: '124',
+        argv: ['/usr/local/bin/node', '/fixture/cli/dist/bin.js', 'relay', 'container-entrypoint'] };
+    const marker = { schema: 'dharma.container-entrypoint/v2', home, pid: controller.pid, uid,
+        startTicks: controller.startTicks, initStartTicks: init.startTicks };
+    await writeFile(join(home, 'relay', 'container-entrypoint.json'), JSON.stringify(marker), { mode: 0o600 });
+    let verifiedInit = true;
+    let verifiedNode = true;
+    let mainChild = controller.pid;
+    const runtime = { identity: async () => init, canonicalEntrypoint: controller.argv[1], runtimeVersion: '0.2.135',
+        controllerIdentity: async (pid) => { assert.equal(pid, controller.pid); return controller; },
+        dockerInitVerified: async () => verifiedInit,
+        dockerInitMainChild: async () => mainChild,
+        controllerExecutableVerified: async () => verifiedNode,
+        childIdentity: async (pid) => ({ ...await lifecycle.readContainerChildIdentity(pid), parentPid: controller.pid }) };
+    const options = { platform: 'linux', home, uid, userHome: root, workspace,
+        launcher: join(workspace, '.dharma', 'bin', 'dharma'), policy: join(workspace, '.dharma', 'approved-policy.json'),
+        version: '0.2.135', containerRuntime: runtime,
+        run: async () => { throw new Error('must never use systemd for the owned init child'); } };
+    return { root, home, init, controller, marker, runtime, options,
+        untrustInit: () => { verifiedInit = false; }, untrustNode: () => { verifiedNode = false; },
+        setMainChild: (pid) => { mainChild = pid; } };
+}
+async function until(check) {
+    const deadline = Date.now() + 3000;
+    while (!check()) {
+        if (Date.now() > deadline)
+            throw new Error('fixture did not progress');
+        await new Promise(r => setTimeout(r, 10));
+    }
+}
+test('canonical direct child of verified Docker init can own persistent container startup', linux, async () => {
+    const f = await fixture();
+    assert.equal((await enableRelayAutostart(f.options)).backend, 'container-entrypoint');
+    assert.equal((await relayAutostartStatus(f.options)).state, 'enabled');
+});
+test('adopted canonical exec child cannot replace the Docker init main startup child', linux, async () => {
+    for (const kind of ['different-main-child', 'foreign-session', 'foreign-process-group', 'missing-main-child']) {
+        const f = await fixture();
+        if (kind === 'different-main-child')
+            f.setMainChild(7);
+        if (kind === 'missing-main-child')
+            f.setMainChild(0);
+        if (kind === 'foreign-session')
+            f.controller.sessionId = 99;
+        if (kind === 'foreign-process-group')
+            f.controller.processGroupId = 99;
+        await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/, kind);
+    }
+});
+test('Docker init main-child identity is checked again before control is admitted', linux, async () => {
+    const f = await fixture();
+    let reads = 0;
+    f.runtime.dockerInitMainChild = async () => ++reads === 1 ? f.controller.pid : 7;
+    await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/);
+});
+test('Docker init session and controller process group cannot change during attribution', linux, async () => {
+    for (const kind of ['init-session', 'init-group', 'controller-session', 'controller-group']) {
+        const f = await fixture();
+        let reads = 0;
+        if (kind.startsWith('init-'))
+            f.runtime.identity = async () => {
+                reads++;
+                return { ...f.init, ...(reads > 1 ? kind === 'init-session' ? { sessionId: 99 } : { processGroupId: 99 } : {}) };
+            };
+        else
+            f.runtime.controllerIdentity = async () => {
+                reads++;
+                return { ...f.controller, ...(reads > 1 ? kind === 'controller-session' ? { sessionId: 99 } : { processGroupId: 99 } : {}) };
+            };
+        await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/, kind);
+    }
+});
+test('Docker init route rejects foreign parent owner argv executable boot and controller ticks', linux, async () => {
+    for (const kind of ['parent', 'uid', 'argv', 'executable', 'node-executable', 'init-parent', 'init-argv', 'init-boot', 'controller-boot', 'extra-argument']) {
+        const f = await fixture();
+        if (kind === 'parent')
+            f.controller.parentPid = 9;
+        if (kind === 'uid')
+            f.controller.uid++;
+        if (kind === 'argv')
+            f.controller.argv[1] = '/foreign/cli/dist/bin.js';
+        if (kind === 'executable')
+            f.untrustInit();
+        if (kind === 'node-executable')
+            f.untrustNode();
+        if (kind === 'init-parent')
+            f.init.parentPid = 3;
+        if (kind === 'init-argv')
+            f.init.argv[3] = 'foreign-command';
+        if (kind === 'init-boot')
+            f.init.startTicks = '999';
+        if (kind === 'controller-boot')
+            f.controller.startTicks = '999';
+        if (kind === 'extra-argument')
+            f.controller.argv.push('--grant');
+        await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/, kind);
+    }
+});
+test('init marker cannot omit the Docker boot identity or promote an ordinary exec child to the entrypoint', linux, async () => {
+    const f = await fixture();
+    await writeFile(join(f.home, 'relay', 'container-entrypoint.json'), JSON.stringify({ ...f.marker, initStartTicks: undefined }));
+    await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/);
+});
+test('controller identity changes during executable verification are rejected before startup control', linux, async () => {
+    const f = await fixture();
+    let reads = 0;
+    f.runtime.controllerIdentity = async (pid) => {
+        assert.equal(pid, f.controller.pid);
+        reads++;
+        return { ...f.controller, startTicks: reads > 1 ? 'CANARY_REUSED_PROCESS' : f.controller.startTicks };
+    };
+    await assert.rejects(enableRelayAutostart(f.options), error => {
+        assert.match(String(error), /container_startup_unavailable/);
+        assert.doesNotMatch(String(error), /CANARY_REUSED_PROCESS/);
+        return true;
+    });
+});
+test('same Docker-init boot cannot take over another controller lease', linux, async () => {
+    const f = await fixture();
+    await writeFile(join(f.home, 'relay', 'container-entrypoint.lock'), JSON.stringify({ ...f.marker, pid: 77, startTicks: '99' }), { mode: 0o600 });
+    const abort = new AbortController();
+    await assert.rejects(lifecycle.runOwnedContainerEntrypoint({ home: f.home, uid: f.options.uid, signal: abort.signal,
+        containerRuntime: { ...f.runtime, currentControllerPid: f.controller.pid } }), /container_entrypoint_busy/);
+});
+test('different verified Docker-init boot renews only its own previous lifecycle metadata', linux, async () => {
+    const f = await fixture();
+    await writeFile(join(f.home, 'relay', 'container-entrypoint.lock'), JSON.stringify(f.marker), { mode: 0o600 });
+    f.init.startTicks = '223';
+    f.controller.startTicks = '224';
+    const abort = new AbortController();
+    const result = lifecycle.runOwnedContainerEntrypoint({ home: f.home, uid: f.options.uid, signal: abort.signal,
+        containerRuntime: { ...f.runtime, currentControllerPid: f.controller.pid }, pollMs: 10,
+        spawnRelay: () => { throw new Error('unconfigured controller cannot launch'); } });
+    try {
+        await new Promise(resolve => setTimeout(resolve, 50));
+        const marker = JSON.parse(await readFile(join(f.home, 'relay', 'container-entrypoint.json'), 'utf8'));
+        assert.equal(marker.initStartTicks, '223');
+        assert.equal(marker.startTicks, '224');
+    }
+    finally {
+        abort.abort();
+    }
+    await result;
+});
+test('Docker init controller fences its own supervisor and remains blocked while the consumer is locked', linux, async () => {
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const abort = new AbortController();
+    let ready = false;
+    const children = [];
+    const result = lifecycle.runOwnedContainerEntrypoint({ home: f.home, uid: f.options.uid, signal: abort.signal,
+        containerRuntime: { ...f.runtime, currentControllerPid: f.controller.pid }, pollMs: 10,
+        consumerStoreReady: async () => ready,
+        spawnRelay: () => { const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' }); children.push(child); return child; } });
+    try {
+        await new Promise(resolve => setTimeout(resolve, 50));
+        const heartbeat = JSON.parse(await readFile(join(f.home, 'relay', 'container-heartbeat.json'), 'utf8'));
+        assert.equal(heartbeat.lifecycle, 'blocked');
+        assert.equal(children.length, 0);
+        ready = true;
+        await until(() => children.length === 1);
+        assert.equal((await relayAutostartStatus(f.options)).lifecycle, 'running');
+    }
+    finally {
+        abort.abort();
+    }
+    await result;
+    assert.equal(children.every(child => child.exitCode !== null || child.signalCode !== null), true);
+});
+//# sourceMappingURL=containerDockerInit.test.js.map

package/dist/containerDockerInit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerDockerInit.test.js","sourceRoot":"","sources":["../src/containerDockerInit.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,SAAS,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;AACrD,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5E,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,MAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;IAC/K,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK;QAClG,IAAI,EAAE,CAAC,qBAAqB,EAAE,0BAA0B,EAAE,OAAO,EAAE,sBAAsB,CAAC,EAAE,CAAC;IAC/F,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,gCAAgC,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG;QACvF,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACvE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3G,IAAI,YAAY,GAAG,IAAI,CAAC;IAAC,IAAI,YAAY,GAAG,IAAI,CAAC;IAAC,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC;IACjF,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS;QAC9G,kBAAkB,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;QACpG,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;QAC5C,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;QAC1C,4BAA4B,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;QACtD,aAAa,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,SAAS,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IAC9H,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS;QAChF,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,sBAAsB,CAAC;QACjH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO;QAC7C,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;QAC7D,WAAW,EAAE,GAAG,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC;QAC1F,YAAY,EAAE,CAAC,GAAW,EAAE,EAAE,GAAG,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AACD,KAAK,UAAU,KAAK,CAAC,KAAoB;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACnC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;AACzI,CAAC;AAED,IAAI,CAAC,qFAAqF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC5G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACvG,KAAK,MAAM,IAAI,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,sBAAsB;YAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,oBAAoB;YAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,iBAAiB;YAAE,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,EAAE,CAAC;QAC5D,IAAI,IAAI,KAAK,uBAAuB;YAAE,CAAC,CAAC,UAAU,CAAC,cAAc,GAAG,EAAE,CAAC;QACvE,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACpG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,OAAO,CAAC,mBAAmB,GAAG,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mFAAmF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC1G,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE;gBAC5D,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACnH,CAAC,CAAC;;YACG,CAAC,CAAC,OAAO,CAAC,kBAAkB,GAAG,KAAK,IAAI,EAAE;gBAC7C,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/H,CAAC,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0FAA0F,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACjH,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC5J,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,QAAQ;YAAE,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,KAAK;YAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,MAAM;YAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC;QACvE,IAAI,IAAI,KAAK,YAAY;YAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,IAAI,KAAK,iBAAiB;YAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,IAAI,KAAK,aAAa;YAAE,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,WAAW;YAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC;QAC7D,IAAI,IAAI,KAAK,WAAW;YAAE,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACpD,IAAI,IAAI,KAAK,iBAAiB;YAAE,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC;QAChE,IAAI,IAAI,KAAK,gBAAgB;YAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sGAAsG,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC7H,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAChI,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACvH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,OAAO,CAAC,kBAAkB,GAAG,KAAK,EAAC,GAAG,EAAC,EAAE;QACzC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;IACxG,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE;QAC5D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC7D,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjJ,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QACjH,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAChH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC5G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/G,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;IAAC,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QAC3G,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE;QACtF,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACtG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAC5B,MAAM,MAAM,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mGAAmG,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC1H,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,KAAK,CAAC;IAAC,MAAM,QAAQ,GAA+B,EAAE,CAAC;IACxG,MAAM,MAAM,GAAG,SAAS,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QAC3G,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE;QACtF,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QACrC,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAiE,CAAC,CAAC;IACjO,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACxG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/E,KAAK,GAAG,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAC5B,MAAM,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC"}

package/dist/containerRelayLifecycle.d.ts

@@ -4,6 +4,9 @@ export interface ContainerProcessIdentity {
     uid: number;
     startTicks: string;
     argv: string[];
+    parentPid?: number;
+    processGroupId?: number;
+    sessionId?: number;
 }
 export interface ContainerChildIdentity {
     pid: number;
@@ -16,6 +19,11 @@ export interface ContainerRuntime {
     childIdentity?: (pid: number) => Promise<ContainerChildIdentity>;
     canonicalEntrypoint?: string;
     runtimeVersion?: string;
+    controllerIdentity?: (pid: number) => Promise<ContainerProcessIdentity>;
+    dockerInitVerified?: () => Promise<boolean>;
+    dockerInitMainChild?: () => Promise<number>;
+    controllerExecutableVerified?: (identity: ContainerProcessIdentity) => Promise<boolean>;
+    currentControllerPid?: number;
 }
 export interface ContainerLifecycleOptions {
     home: string;
@@ -32,6 +40,7 @@ export interface ContainerRelayRegistration {
     taskName: null;
 }
 export declare function readContainerPid1Identity(): Promise<ContainerProcessIdentity>;
+export declare function readContainerProcessIdentity(pid: number): Promise<ContainerProcessIdentity>;
 export declare function readContainerChildIdentity(pid: number): Promise<ContainerChildIdentity>;
 export declare function containerEntrypointAvailable(options: ContainerLifecycleOptions): Promise<boolean>;
 export declare function containerStartupControl(options: ContainerLifecycleOptions, registration: ContainerRelayRegistration, running: boolean): Promise<void>;

package/dist/containerRelayLifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"containerRelayLifecycle.d.ts","sourceRoot":"","sources":["../src/containerRelayLifecycle.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOxE,MAAM,WAAW,wBAAwB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE;AAC1G,MAAM,WAAW,sBAAsB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAE3G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACnD,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,yBAAyB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CAAE;AAC9G,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,2BAA2B,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IACvF,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;CACpE;AA+CD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAQnF;AAyCD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAO7F;AASD,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CASvG;AAmBD,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,EAC9E,YAAY,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,iBAM3D;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,0BAA0B;;;;;;GA2BvH;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,0BAA0B,oBAUtH;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,0BAA0B,iBAE5H;AAYD,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,yBAAyB,8CAKjF;AA0BD,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAapE;AAoBD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,yBAAyB,GAAG;IACrF,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,0BAA0B,KAAK,YAAY,CAAC;IAC7F,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACvF;;;GAoFA"}
+{"version":3,"file":"containerRelayLifecycle.d.ts","sourceRoot":"","sources":["../src/containerRelayLifecycle.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOxE,MAAM,WAAW,wBAAwB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AAC3K,MAAM,WAAW,sBAAsB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAE3G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACnD,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxE,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,4BAA4B,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AACD,MAAM,WAAW,yBAAyB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CAAE;AAC9G,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,2BAA2B,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IACvF,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;CACpE;AA+CD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAEnF;AAED,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAUjG;AA0ID,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAO7F;AAcD,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAKvG;AAmBD,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,EAC9E,YAAY,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,iBAM3D;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,0BAA0B;;;;;;GA2BvH;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,0BAA0B,oBAUtH;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,0BAA0B,iBAE5H;AAYD,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,yBAAyB,8CAKjF;AA0BD,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAapE;AAoBD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,yBAAyB,GAAG;IACrF,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,0BAA0B,KAAK,YAAY,CAAC;IAC7F,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACvF;;;GAoFA"}

package/dist/containerRelayLifecycle.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { execFile, spawn } from 'node:child_process';
 import { constants } from 'node:fs';
-import { lstat, mkdir, open, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, open, readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
@@ -50,15 +50,78 @@ function exactObject(value, keys) {
         && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key)));
 }
 export async function readContainerPid1Identity() {
+    return readContainerProcessIdentity(1);
+}
+export async function readContainerProcessIdentity(pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        throw unavailable();
     const [stat, command, owner] = await Promise.all([
-        readFile('/proc/1/stat', 'utf8'), readFile('/proc/1/cmdline'), lstat('/proc/1'),
+        readFile(`/proc/${pid}/stat`, 'utf8'), readFile(`/proc/${pid}/cmdline`), lstat(`/proc/${pid}`),
     ]);
-    if (stat.length > 8192 || command.length > 8192)
+    if (stat.length > 8192 || command.length > 8192 || Number(stat.slice(0, stat.indexOf(' '))) !== pid)
         throw unavailable();
     const fields = stat.slice(stat.lastIndexOf(')') + 2).trim().split(/\s+/);
-    return { pid: 1, uid: owner.uid, startTicks: fields[19] || '',
+    if (fields[0] === 'Z' || fields[0] === 'X')
+        throw unavailable();
+    return { pid, uid: owner.uid, parentPid: Number(fields[1]), processGroupId: Number(fields[2]), sessionId: Number(fields[3]), startTicks: fields[19] || '',
         argv: command.toString('utf8').split('\0').filter(Boolean) };
 }
+async function dockerInitMainChild() {
+    // Tini forks its main child first. Linux appends subsequently forked and
+    // adopted children to this kernel list; PPID 1 alone also admits orphans.
+    // Retain the first entry even if it is a zombie: never promote an adoptee.
+    const file = await open('/proc/1/task/1/children', constants.O_RDONLY);
+    try {
+        const bytes = Buffer.alloc(4097);
+        const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+        if (bytesRead === 0 || bytesRead > 4096)
+            throw unavailable();
+        const text = bytes.subarray(0, bytesRead).toString('ascii').trim();
+        if (!/^[1-9]\d*(?:\s+[1-9]\d*)*$/.test(text))
+            throw unavailable();
+        const children = text.split(/\s+/).map(Number);
+        if (children.length > 256 || children.some(pid => !Number.isSafeInteger(pid) || pid <= 1)
+            || new Set(children).size !== children.length)
+            throw unavailable();
+        return children[0];
+    }
+    finally {
+        await file.close();
+    }
+}
+async function verifiedDockerInit() {
+    // Docker's --init executable is supplied by the daemon, root-owned and not
+    // writable by the client UID. Names or argv alone cannot establish this.
+    try {
+        const canonical = await realpath('/sbin/docker-init');
+        if (canonical !== '/usr/sbin/docker-init' && canonical !== '/sbin/docker-init')
+            return false;
+        if (await realpath('/proc/1/exe') !== canonical)
+            return false;
+        const [file, running] = await Promise.all([lstat(canonical), stat('/proc/1/exe')]);
+        return file.isFile() && file.uid === 0 && (file.mode & 0o022) === 0
+            && file.dev === running.dev && file.ino === running.ino;
+    }
+    catch {
+        return false;
+    }
+}
+async function verifiedControllerExecutable(identity) {
+    try {
+        const candidate = identity.argv[0];
+        if (!candidate || !isAbsolute(candidate))
+            return false;
+        const canonical = await realpath(candidate);
+        if (await realpath(`/proc/${identity.pid}/exe`) !== canonical)
+            return false;
+        const [file, running] = await Promise.all([lstat(canonical), stat(`/proc/${identity.pid}/exe`)]);
+        return file.isFile() && file.uid === 0 && (file.mode & 0o022) === 0
+            && file.dev === running.dev && file.ino === running.ino;
+    }
+    catch {
+        return false;
+    }
+}
 async function publicRuntimeBytes(path, limit, executingCaller = false) {
     const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
     try {
@@ -103,10 +166,67 @@ async function canonicalEntrypoint(options, identity) {
     }
 }
 function ownedIdentity(identity, uid, entrypoint) {
-    return identity.pid === 1 && identity.uid === uid && Number.isSafeInteger(uid) && uid > 0 && /^\d{1,20}$/.test(identity.startTicks)
+    return Number.isSafeInteger(identity.pid) && identity.pid >= 1 && identity.uid === uid && Number.isSafeInteger(uid) && uid > 0 && /^\d{1,20}$/.test(identity.startTicks)
         && identity.argv.length === 4 && identity.argv[2] === 'relay' && identity.argv[3] === 'container-entrypoint'
         && identity.argv[1] === entrypoint && isAbsolute(entrypoint);
 }
+function validMarker(value) {
+    const init = Boolean(value && typeof value === 'object' && value.schema === 'dharma.container-entrypoint/v2');
+    return exactObject(value, ['schema', 'home', 'pid', 'uid', 'startTicks', ...(init ? ['initStartTicks'] : [])])
+        && (init ? value.schema === 'dharma.container-entrypoint/v2' && Number.isSafeInteger(value.pid) && Number(value.pid) > 1
+            && typeof value.initStartTicks === 'string' && /^\d{1,20}$/.test(value.initStartTicks)
+            : value.schema === 'dharma.container-entrypoint/v1' && value.pid === 1)
+        && typeof value.home === 'string' && Number.isSafeInteger(value.uid) && Number(value.uid) > 0
+        && typeof value.startTicks === 'string' && /^\d{1,20}$/.test(value.startTicks);
+}
+async function ownedController(options, pid) {
+    const init = await (options.containerRuntime?.identity || readContainerPid1Identity)();
+    if (init.pid !== 1 || init.uid !== ownUid(options) || !/^\d{1,20}$/.test(init.startTicks))
+        throw unavailable();
+    if (init.argv[2] === 'relay' && init.argv[3] === 'container-entrypoint') {
+        if (pid !== undefined && pid !== 1 || !ownedIdentity(init, ownUid(options), await canonicalEntrypoint(options, init)))
+            throw unavailable();
+        return { identity: init, initStartTicks: undefined };
+    }
+    // Bounded migration of the existing official Node-image startup. Neither an
+    // arbitrary init/wrapper nor a foreground exec can claim this lifecycle.
+    if (init.parentPid !== 0 || init.argv.length !== 5 || init.argv[0] !== '/sbin/docker-init' || init.argv[1] !== '--'
+        || init.argv[2] !== 'docker-entrypoint.sh' || init.argv[3] !== 'sleep' || init.argv[4] !== 'infinity'
+        || !await (options.containerRuntime?.dockerInitVerified || verifiedDockerInit)())
+        throw unavailable();
+    const controller = await (options.containerRuntime?.controllerIdentity || readContainerProcessIdentity)(pid ?? options.containerRuntime?.currentControllerPid ?? process.pid);
+    if (controller.pid <= 1 || controller.parentPid !== 1
+        || !Number.isSafeInteger(init.sessionId) || Number(init.sessionId) <= 0
+        || controller.sessionId !== init.sessionId || controller.processGroupId !== controller.pid
+        || await (options.containerRuntime?.dockerInitMainChild || dockerInitMainChild)() !== controller.pid
+        || !ownedIdentity(controller, ownUid(options), await canonicalEntrypoint(options, controller))
+        || !await (options.containerRuntime?.controllerExecutableVerified || verifiedControllerExecutable)(controller))
+        throw unavailable();
+    const [freshInit, freshController, freshMainChild] = await Promise.all([
+        (options.containerRuntime?.identity || readContainerPid1Identity)(),
+        (options.containerRuntime?.controllerIdentity || readContainerProcessIdentity)(controller.pid),
+        (options.containerRuntime?.dockerInitMainChild || dockerInitMainChild)(),
+    ]);
+    if (freshInit.pid !== init.pid || freshInit.uid !== init.uid || freshInit.startTicks !== init.startTicks
+        || JSON.stringify(freshInit.argv) !== JSON.stringify(init.argv)
+        || freshInit.sessionId !== init.sessionId || freshInit.processGroupId !== init.processGroupId
+        || freshController.pid !== controller.pid || freshController.uid !== controller.uid
+        || freshController.parentPid !== 1 || freshController.startTicks !== controller.startTicks
+        || freshMainChild !== controller.pid || freshController.sessionId !== init.sessionId
+        || freshController.processGroupId !== controller.pid
+        || JSON.stringify(freshController.argv) !== JSON.stringify(controller.argv))
+        throw unavailable();
+    return { identity: controller, initStartTicks: init.startTicks };
+}
+async function liveMarker(options) {
+    const marker = await privateJson(options, 'container-entrypoint.json');
+    if (!validMarker(marker) || marker.home !== options.home || marker.uid !== ownUid(options))
+        throw unavailable();
+    const live = await ownedController(options, marker.pid);
+    if (live.identity.startTicks !== marker.startTicks || live.initStartTicks !== marker.initStartTicks)
+        throw unavailable();
+    return marker;
+}
 export async function readContainerChildIdentity(pid) {
     if (!Number.isSafeInteger(pid) || pid <= 1)
         throw unavailable();
@@ -118,9 +238,15 @@ export async function readContainerChildIdentity(pid) {
         throw unavailable();
     return { pid, uid: owner.uid, parentPid: Number(fields[1]), startTicks: fields[19] };
 }
-async function ownedChild(options, pid, startTicks) {
+async function ownedChild(options, pid, startTicks, controller) {
+    const parent = controller || await liveMarker(options);
+    if (controller) {
+        const live = await ownedController(options, controller.pid);
+        if (live.identity.startTicks !== controller.startTicks || live.initStartTicks !== controller.initStartTicks)
+            throw unavailable();
+    }
     const identity = await (options.containerRuntime?.childIdentity || readContainerChildIdentity)(pid);
-    if (identity.pid !== pid || identity.uid !== ownUid(options) || identity.parentPid !== 1
+    if (identity.pid !== pid || identity.uid !== ownUid(options) || identity.parentPid !== parent.pid
         || !/^\d{1,20}$/.test(identity.startTicks) || startTicks !== undefined && identity.startTicks !== startTicks)
         throw unavailable();
     return identity;
@@ -129,13 +255,7 @@ export async function containerEntrypointAvailable(options) {
     const value = await privateJson(options, 'container-entrypoint.json');
     if (value === null)
         return false;
-    if (!exactObject(value, ['schema', 'home', 'pid', 'uid', 'startTicks']))
-        throw unavailable();
-    const identity = await (options.containerRuntime?.identity || readContainerPid1Identity)().catch(() => { throw unavailable(); });
-    if (value.schema !== 'dharma.container-entrypoint/v1' || value.home !== options.home
-        || value.pid !== 1 || value.uid !== ownUid(options) || value.startTicks !== identity.startTicks
-        || !ownedIdentity(identity, ownUid(options), await canonicalEntrypoint(options, identity)))
-        throw unavailable();
+    await liveMarker(options);
     return true;
 }
 function registrationHash(home, registration) {
@@ -279,11 +399,11 @@ export async function containerConsumerStoreReady() {
         return false;
     }
 }
-async function stopOwnedChild(child, options, identity) {
+async function stopOwnedChild(child, options, identity, controller) {
     if (child.exitCode !== null || child.signalCode !== null || !child.pid)
         return;
     // Never signal a recycled PID or a process outside this owned parent/UID.
-    if (identity && !await ownedChild(options, child.pid, identity.startTicks).catch(() => null))
+    if (identity && !await ownedChild(options, child.pid, identity.startTicks, controller).catch(() => null))
         return;
     // On an initial /proc failure, the freshly spawned ChildProcess handle is
     // still ours. Drain it immediately; never leave unverified work running.
@@ -298,13 +418,14 @@ async function stopOwnedChild(child, options, identity) {
     if (timer)
         clearTimeout(timer);
     if (child.exitCode === null && child.signalCode === null
-        && (!identity || await ownedChild(options, child.pid, identity.startTicks).catch(() => null))) {
+        && (!identity || await ownedChild(options, child.pid, identity.startTicks, controller).catch(() => null))) {
         child.kill('SIGKILL');
         await exited;
     }
 }
 export async function runOwnedContainerEntrypoint(options) {
-    const identity = await (options.containerRuntime?.identity || readContainerPid1Identity)();
+    const live = await ownedController(options);
+    const identity = live.identity;
     const bin = await canonicalEntrypoint(options, identity);
     const runtimeVersion = options.containerRuntime?.runtimeVersion
         ?? JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8')).version;
@@ -314,21 +435,19 @@ export async function runOwnedContainerEntrypoint(options) {
         throw unavailable();
     await mkdir(join(options.home, 'relay'), { recursive: true, mode: 0o700 });
     await privateDirectory(options);
-    const marker = { schema: 'dharma.container-entrypoint/v1', home: options.home,
-        pid: 1, uid: identity.uid, startTicks: identity.startTicks };
+    const marker = { schema: live.initStartTicks === undefined ? 'dharma.container-entrypoint/v1' : 'dharma.container-entrypoint/v2', home: options.home,
+        pid: identity.pid, uid: identity.uid, startTicks: identity.startTicks,
+        ...(live.initStartTicks === undefined ? {} : { initStartTicks: live.initStartTicks }) };
     const previous = await privateJson(options, 'container-entrypoint.json');
-    if (previous !== null && (!exactObject(previous, ['schema', 'home', 'pid', 'uid', 'startTicks'])
-        || previous.schema !== marker.schema || previous.home !== marker.home || previous.uid !== marker.uid || previous.pid !== 1
-        || typeof previous.startTicks !== 'string' || !/^\d{1,20}$/.test(previous.startTicks)))
+    if (previous !== null && (!validMarker(previous) || previous.schema !== marker.schema
+        || previous.home !== marker.home || previous.uid !== marker.uid))
         throw unavailable();
     const lockPath = privatePath(options.home, 'container-entrypoint.lock');
     const oldLock = await privateJson(options, 'container-entrypoint.lock');
     if (oldLock !== null) {
-        if (!exactObject(oldLock, ['schema', 'home', 'pid', 'uid', 'startTicks'])
-            || oldLock.schema !== marker.schema || oldLock.home !== marker.home || oldLock.uid !== marker.uid || oldLock.pid !== 1
-            || typeof oldLock.startTicks !== 'string' || !/^\d{1,20}$/.test(oldLock.startTicks))
+        if (!validMarker(oldLock) || oldLock.schema !== marker.schema || oldLock.home !== marker.home || oldLock.uid !== marker.uid)
             throw unavailable();
-        if (oldLock.startTicks === marker.startTicks)
+        if (marker.initStartTicks === undefined ? oldLock.startTicks === marker.startTicks : oldLock.initStartTicks === marker.initStartTicks)
             throw new Error('container_entrypoint_busy: an owned entrypoint is already active.');
         await rm(lockPath); // an earlier boot's private lock; actual PID1 identity was verified
     }
@@ -370,7 +489,7 @@ export async function runOwnedContainerEntrypoint(options) {
                 retryAt = Date.now() + restartDelayMs;
             }
             if (child && (!shouldRun || hash !== childHash)) {
-                await stopOwnedChild(child, options, childIdentity);
+                await stopOwnedChild(child, options, childIdentity, marker);
                 child = null;
                 childIdentity = null;
                 childHash = null;
@@ -379,7 +498,7 @@ export async function runOwnedContainerEntrypoint(options) {
                 child = spawnRelay(configuration.registration);
                 childHash = hash;
                 child.on('error', () => { childFailed = true; });
-                childIdentity = child.pid ? await ownedChild(options, child.pid).catch(() => null) : null;
+                childIdentity = child.pid ? await ownedChild(options, child.pid, undefined, marker).catch(() => null) : null;
                 if (child.pid && !childIdentity && child.exitCode === null && child.signalCode === null)
                     throw unavailable();
             }
@@ -401,14 +520,14 @@ export async function runOwnedContainerEntrypoint(options) {
     }
     finally {
         if (child)
-            await stopOwnedChild(child, options, childIdentity);
+            await stopOwnedChild(child, options, childIdentity, marker);
         const current = await privateJson(options, 'container-entrypoint.json').catch(() => null);
-        if (current?.startTicks === marker.startTicks && current.home === marker.home) {
+        if (current?.startTicks === marker.startTicks && current.home === marker.home && current.pid === marker.pid && current.initStartTicks === marker.initStartTicks) {
             await rm(privatePath(options.home, 'container-entrypoint.json'), { force: true });
             await rm(privatePath(options.home, 'container-heartbeat.json'), { force: true });
         }
         const lock = await privateJson(options, 'container-entrypoint.lock').catch(() => null);
-        if (lock?.startTicks === marker.startTicks && lock.home === marker.home)
+        if (lock?.startTicks === marker.startTicks && lock.home === marker.home && lock.pid === marker.pid && lock.initStartTicks === marker.initStartTicks)
             await rm(lockPath, { force: true });
     }
 }