@flisk-sh/flisk-import 0.10.0 → 0.12.0

package/README.md

@@ -13,12 +13,13 @@ flisk import . --yes         # write service.json files and project setup
 - **Reads one file:** the root `docker-compose.yml`, or `compose.yaml`, `compose.yml` or `docker-compose.yaml` when that is absent. Not override files, nested Compose files, Dockerfiles on their own, `package.json`, or Procfiles.
 - **Writes:** one bring-your-own `service.json` per Compose service, plus `.flisk/project.json` if the repo is not a Flisk project yet. It never edits the Compose file or overwrites a `service.json` without `--force`.
 - **Keeps the install's data:** each named volume gets `name`, the Docker volume `docker compose up` created (`<project>_<volume>`, its own `name:`, or an `external` volume), so `flisk up` mounts the same data with no copy (needs the Flisk release with flisk#2964).
+- **Keeps:** `profiles` (the service starts only with `flisk up --profile`), `env_file` as `envFile`, `tmpfs` and `deploy.resources.limits` (`container.tmpfs`, `cpus`, `memory`).
 - **Keeps:** the service names (`db` stays `db`, so it stays the hostname), the build context and Dockerfile (or the image), the container port as written (3000, 80, 5432), `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
-- **Runtime keys:** named volumes and bind mounts inside the project (`volumes`), `cap_add`, `cap_drop`, `init`, `read_only`, `user`, `security_opt` and `shm_size` (`container`), extra published ports (`extraPorts`, on 127.0.0.1 only), `network_mode: service:<name>` (`sidecarOf`) and `restart`.
+- **Runtime keys:** named volumes and bind mounts inside the project (`volumes`), `cap_add`, `cap_drop`, `init`, `read_only`, `user`, `security_opt` and `shm_size` (`container`), extra published ports (`extraPorts`, on the same host address as in Compose: `"80:80"` stays on every interface, `"127.0.0.1:5432:5432"` on loopback, and another address or a `${VAR:-default}` host side as `publish`), `network_mode: service:<name>` (`sidecarOf`) and `restart`.
 - **Environment:** values that cannot be secrets go into the committed `service.json` `env`: numbers, `true`/`false`, another imported service's address without a user, password or query (`http://invidious:3000`, `redis:6379`), and pure `${VAR}` references. Every other name, and any name that looks like a credential (`PASSWORD`, `TOKEN`, `KEY`, ...), goes into `secrets.required`, with its literal value copied to the project `.env`, which is added to `.gitignore`. Values in `.env` already are kept.
 - **Keeps:** a `command` or `entrypoint` on an image as the `CMD`/`ENTRYPOINT` of a small `Dockerfile` next to `service.json` (Flisk sets no container command), a `healthcheck` as `healthCheck.command`, a published database port as `extraPorts`, and `restart: on-failure:N` as `on-failure`.
-- **Drops, and says so:** `command` on a service with a `build`, `env_file` and every other untranslated key; anonymous volumes and paths outside the project; `network_mode` other than `service:<name>`; services with `profiles`, `extends`, an out-of-tree build or a `${VAR}` image.
-- **Does not start anything.** Run `flisk up` with Flisk core **1.4.24 or later**. The importer does not check the core version.
+- **Drops, and says so:** `command` on a service with a `build`, `env_file` and every other untranslated key; anonymous volumes and paths outside the project; `network_mode` other than `service:<name>`; services with invalid profile names, `extends`, an out-of-tree build or a `${VAR}` image.
+- **Does not start anything.** Run `flisk up` with Flisk core **1.4.26 or later** (`publish` needs it). The importer does not check the core version.
 - **Exit codes:** `0` when the plan succeeds (`--dry-run`, files written, or all `service.json` files already exist), `1` when no root `docker-compose.yml` or mappable service is found, and `2` when the write prompt is declined or closed without an answer (`Nothing written.`).
 
 See [docs/import.md](docs/import.md) for the full mapping and limits. `flisk import` is the core CLI command backed by this package.

package/dist/detectors/compose.js

@@ -47,6 +47,10 @@ const TRANSLATED_KEYS = new Set([
     "command",
     "entrypoint",
     "models",
+    "profiles",
+    "env_file",
+    "tmpfs",
+    "deploy",
     // Flisk gives every service its own stack network and container name, so these change nothing it needs.
     "networks",
     "expose",
@@ -120,33 +124,65 @@ function containerOf(raw) {
     return { ...(Object.keys(container).length ? { container } : {}), dropped };
 }
 /** One published port: container port, host port when Compose names a literal one, and protocol. */
+/** A `publish` value Flisk accepts: digits, dots, colons and `${NAME:-default}` with a port or IPv4 address:port default. */
+const PUBLISH = /^(?:[0-9.:]|\$\{[A-Za-z_][A-Za-z0-9_]*:-[0-9.:]+\})+$/;
+/** The host address and port of a published port. Compose publishes on every interface unless an address is given. */
+function hostSideOf(port, hostIp, hostPort) {
+    const hostNumber = hostPort && /^\d+$/.test(hostPort) ? Number.parseInt(hostPort, 10) : undefined;
+    const keepHostPort = hostNumber !== undefined && hostNumber >= 1 && hostNumber <= 65535 && hostNumber !== port
+        ? { hostPort: hostNumber }
+        : {};
+    if (hostPort?.includes("${")) {
+        const publish = hostIp ? `${hostIp}:${hostPort}` : hostPort;
+        return PUBLISH.test(publish) ? { publish } : undefined;
+    }
+    if (hostIp === undefined || hostIp === "" || hostIp === "0.0.0.0") {
+        // A bare container port ("3000") gets a random host port from Compose; Flisk keeps it on 127.0.0.1.
+        return hostPort === undefined ? {} : { ...keepHostPort, bind: "0.0.0.0" };
+    }
+    if (hostIp === "127.0.0.1")
+        return keepHostPort;
+    const publish = `${hostIp}:${hostNumber ?? port}`;
+    return /^\d{1,3}(\.\d{1,3}){3}:\d+$/.test(publish) ? { publish } : undefined;
+}
 function publishedPort(entry) {
     const port = containerPort(entry);
     if (port === undefined)
         return undefined;
-    let host;
     let protocol = "tcp";
+    let hostSide;
     if (isObj(entry)) {
-        const published = typeof entry.published === "string" ? Number(entry.published) : entry.published;
-        if (typeof published === "number" && Number.isInteger(published))
-            host = published;
+        const published = entry.published === undefined ? undefined : String(entry.published);
+        const hostIp = typeof entry.host_ip === "string" ? entry.host_ip : undefined;
         if (entry.protocol === "udp")
             protocol = "udp";
+        hostSide = hostSideOf(port, hostIp, published);
     }
     else if (typeof entry === "string") {
         const [mapping, proto] = entry.split("/");
         if (proto === "udp")
             protocol = "udp";
-        const parts = (mapping ?? "").split(":");
-        const hostPart = parts.length >= 2 ? parts[parts.length - 2] : undefined;
-        if (hostPart && /^\d+$/.test(hostPart))
-            host = Number.parseInt(hostPart, 10);
+        // [HOST_IP:][HOST_PORT:]CONTAINER_PORT, where the host side may hold ${VAR:-default}, which has colons of its own.
+        const match = (mapping ?? "").match(/^(?:(.*):)?([^:]+)$/);
+        const host = match?.[1];
+        if (host === undefined)
+            hostSide = hostSideOf(port, undefined, undefined);
+        else if (host.includes("${"))
+            hostSide = hostSideOf(port, undefined, host);
+        else {
+            const at = host.lastIndexOf(":");
+            hostSide =
+                at === -1
+                    ? hostSideOf(port, undefined, host)
+                    : hostSideOf(port, host.slice(0, at), host.slice(at + 1));
+        }
+    }
+    else {
+        hostSide = {};
     }
     return {
         port,
-        ...(host !== undefined && host >= 1 && host <= 65535 && host !== port
-            ? { hostPort: host }
-            : {}),
+        ...(hostSide ?? {}),
         ...(protocol === "udp" ? { protocol } : {}),
     };
 }
@@ -325,6 +361,67 @@ function modelsOf(uses, defined) {
     }
     return out.length ? out : undefined;
 }
+const PROFILE = /^[a-z0-9][a-z0-9-]*$/;
+const TMPFS = /^\/[A-Za-z0-9_./-]*(:[a-z0-9=,_-]+)?$/;
+function profilesOf(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return undefined;
+    return value.every((p) => typeof p === "string" && PROFILE.test(p))
+        ? [...new Set(value)]
+        : undefined;
+}
+/** Compose env_file entries (a string, strings, or { path, required }) as paths from the import root; undefined when one leaves it. */
+function envFilesOf(value, composeDir) {
+    const entries = typeof value === "string" ? [value] : Array.isArray(value) ? value : [];
+    const out = [];
+    for (const entry of entries) {
+        const path = typeof entry === "string" ? entry : isObj(entry) ? entry.path : undefined;
+        if (typeof path !== "string" || isAbsolute(path) || path.includes("$"))
+            return undefined;
+        const resolved = normalize(join(composeDir, path));
+        if (resolved === ".." || resolved.startsWith("../") || !/^[A-Za-z0-9_./-]+$/.test(resolved))
+            return undefined;
+        out.push(resolved);
+    }
+    return out.length ? out : undefined;
+}
+/** tmpfs and deploy.resources.limits, and the parts that could not be carried over. */
+function runtimeLimitsOf(raw) {
+    const dropped = [];
+    const out = {};
+    if (raw.tmpfs !== undefined) {
+        const list = typeof raw.tmpfs === "string" ? [raw.tmpfs] : Array.isArray(raw.tmpfs) ? raw.tmpfs : [];
+        const kept = list.filter((t) => typeof t === "string" && TMPFS.test(t));
+        if (kept.length !== list.length || list.length === 0)
+            dropped.push("tmpfs");
+        if (kept.length)
+            out.tmpfs = kept;
+    }
+    if (raw.deploy !== undefined) {
+        const deploy = isObj(raw.deploy) ? raw.deploy : {};
+        const resources = isObj(deploy.resources) ? deploy.resources : {};
+        const limits = isObj(resources.limits) ? resources.limits : {};
+        const cpus = typeof limits.cpus === "number" ? String(limits.cpus) : limits.cpus;
+        if (typeof cpus === "string" && /^[0-9]+(\.[0-9]{1,2})?$/.test(cpus) && Number(cpus) > 0)
+            out.cpus = Number.isInteger(Number(cpus)) && Number(cpus) >= 1 ? Number(cpus) : cpus;
+        else if (limits.cpus !== undefined)
+            dropped.push("deploy.resources.limits.cpus");
+        if (typeof limits.memory === "string" && /^[0-9]+([bBkKmMgG][bB]?)?$/.test(limits.memory))
+            out.memory = limits.memory;
+        else if (limits.memory !== undefined)
+            dropped.push("deploy.resources.limits.memory");
+        const other = [
+            ...Object.keys(deploy)
+                .filter((k) => k !== "resources")
+                .map((k) => `deploy.${k}`),
+            ...Object.keys(resources)
+                .filter((k) => k !== "limits")
+                .map((k) => `deploy.resources.${k}`),
+        ];
+        dropped.push(...other);
+    }
+    return { ...out, dropped };
+}
 function healthPathOf(healthcheck) {
     if (!isObj(healthcheck) || !Array.isArray(healthcheck.test))
         return undefined;
@@ -391,10 +488,11 @@ registerDetector({
                 });
                 continue;
             }
-            if (raw.profiles !== undefined) {
+            const profiles = profilesOf(raw.profiles);
+            if (raw.profiles !== undefined && !profiles) {
                 skips.push({
                     ...base,
-                    reason: `service "${name}" has profiles ${JSON.stringify(raw.profiles)}; profiles are not enforced by Flisk`,
+                    reason: `service "${name}" has profiles ${JSON.stringify(raw.profiles)} that Flisk cannot name (lowercase letters, digits and '-'); not imported`,
                 });
                 continue;
             }
@@ -438,13 +536,13 @@ registerDetector({
             if (ports.length > 1 && selectedPort === undefined) {
                 skips.push({
                     ...base,
-                    reason: `service "${name}" lists several ports (${ports.join(", ")}); no single HTTP container port could be identified, so none is routed (all are published on 127.0.0.1 as extraPorts)`,
+                    reason: `service "${name}" lists several ports (${ports.join(", ")}); no single HTTP container port could be identified, so none is routed (all stay published, as extraPorts)`,
                 });
             }
             else if (ports.length > 1) {
                 skips.push({
                     ...base,
-                    reason: `service "${name}" publishes extra container ports (${ports.filter((port) => port !== selectedPort).join(", ")}); Flisk routes only ${selectedPort} and publishes the others on 127.0.0.1 as extraPorts`,
+                    reason: `service "${name}" publishes extra container ports (${ports.filter((port) => port !== selectedPort).join(", ")}); Flisk routes only ${selectedPort} and keeps the others published as extraPorts`,
                 });
             }
             const dependsOn = Array.isArray(raw.depends_on)
@@ -470,14 +568,29 @@ registerDetector({
                     reason: `service "${name}" health path "${foundHealthPath}" has characters Flisk does not accept (only a-z, 0-9, / and -); not used`,
                 });
             }
-            const { container, dropped } = containerOf(raw);
+            const { container: options, dropped } = containerOf(raw);
+            const limits = runtimeLimitsOf(raw);
+            const { dropped: limitsDropped, ...limitValues } = limits;
+            const container = options || Object.keys(limitValues).length
+                ? { ...(options ?? {}), ...limitValues }
+                : undefined;
+            for (const key of limitsDropped) {
+                skips.push({ ...base, reason: `service "${name}" ${key} is not carried over; not used` });
+            }
+            const envFile = envFilesOf(raw.env_file, composeDir);
+            if (raw.env_file !== undefined && !envFile) {
+                skips.push({
+                    ...base,
+                    reason: `service "${name}" env_file ${JSON.stringify(raw.env_file)} is outside the imported directory or uses Compose variables; not used`,
+                });
+            }
             for (const key of dropped) {
                 skips.push({
                     ...base,
                     reason: `service "${name}" ${key} ${JSON.stringify(raw[key])} has values Flisk does not accept; not used`,
                 });
             }
-            // Every published port Flisk does not route stays published, on 127.0.0.1 (service.json extraPorts).
+            // Every published port Flisk does not route stays published on the same host address (service.json extraPorts).
             const proxied = selectedPort !== undefined && !NON_HTTP_PORTS.has(selectedPort);
             const extraPorts = (Array.isArray(raw.ports) ? raw.ports : [])
                 .map(publishedPort)
@@ -549,6 +662,8 @@ registerDetector({
                 ...(containerCommand ? { containerCommand } : {}),
                 ...(containerEntrypoint ? { containerEntrypoint } : {}),
                 ...(models ? { models } : {}),
+                ...(profiles ? { profiles } : {}),
+                ...(envFile ? { envFile } : {}),
                 ...(healthProbe ? { healthCheck: healthProbe } : {}),
                 ...(selectedPort !== undefined ? { port: selectedPort } : {}),
                 ...(healthCheckPath ? { healthCheckPath } : {}),

package/dist/flisk.js

@@ -9,7 +9,7 @@ export const SERVICE_MANIFEST_SCHEMA_URL = "https://flisk.sh/schema.service.json
  * release after 1.4.10 (flisk#2646) accepts a bring-your-own port outside 4000-5999 and two-letter
  * names, which this importer now writes. Stated, not checked: it does not read the installed version.
  */
-export const MIN_CORE_VERSION = "1.4.24";
+export const MIN_CORE_VERSION = "1.4.26";
 /**
  * The core change that runs a registered Tiltfile (`orchestration.source: "tiltfile"`) from `flisk up`. Stated, not
  * checked, like MIN_CORE_VERSION.

package/dist/merge.js

@@ -74,6 +74,8 @@ function mergeGroup(name, dir, members, resolve) {
         ...firstOf(ordered, "containerCommand"),
         ...firstOf(ordered, "containerEntrypoint"),
         ...firstOf(ordered, "models"),
+        ...firstOf(ordered, "profiles"),
+        ...firstOf(ordered, "envFile"),
         ...firstOf(ordered, "healthCheck"),
         ...(ordered.find((c) => c.sidecarOf)?.sidecarOf
             ? { sidecarOf: resolve(ordered.find((c) => c.sidecarOf)?.sidecarOf) }

package/dist/write.js

@@ -237,8 +237,16 @@ export function planWrites(plan, force) {
         const extraPorts = sidecarOf ? [] : (service.extraPorts ?? []);
         if (sidecarOf && service.extraPorts?.length)
             notes.push(`ports not written: a sidecar has none of its own; publish them on "${sidecarOf}"`);
-        if (extraPorts.length)
-            notes.push(`published on 127.0.0.1 only: ${extraPorts.map((p) => `${p.hostPort ?? p.port}->${p.port}/${p.protocol ?? "tcp"}`).join(", ")}`);
+        const portText = (p) => `${p.publish ?? p.hostPort ?? p.port}->${p.port}/${p.protocol ?? "tcp"}`;
+        const loopback = extraPorts.filter((p) => !p.bind && !p.publish);
+        const everywhere = extraPorts.filter((p) => p.bind === "0.0.0.0");
+        const fromCompose = extraPorts.filter((p) => p.publish);
+        if (loopback.length)
+            notes.push(`published on 127.0.0.1 only: ${loopback.map(portText).join(", ")}`);
+        if (everywhere.length)
+            notes.push(`published on every interface, as in Compose: ${everywhere.map(portText).join(", ")} (flisk doctor lists these)`);
+        if (fromCompose.length)
+            notes.push(`published as Compose wrote the host side: ${fromCompose.map(portText).join(", ")}`);
         // Bind mounts are relative to the service directory in service.json, and must stay inside the project.
         const serviceDir = dirname(path);
         const volumes = (service.volumes ?? []).flatMap((volume) => {
@@ -253,6 +261,16 @@ export function planWrites(plan, force) {
             const rel = relative(serviceDir, absolute).split("\\").join("/") || ".";
             return [{ ...volume, source: rel.startsWith(".") ? rel : `./${rel}` }];
         });
+        // env_file paths are relative to the service directory in service.json, and must stay inside the project.
+        const envFile = (service.envFile ?? []).flatMap((file) => {
+            const absolute = resolve(plan.root, file);
+            const fromProject = relative(projectRoot, absolute).split("\\").join("/");
+            if (fromProject === ".." || fromProject.startsWith("../")) {
+                notes.push(`env_file ${file} not written: it is outside the project`);
+                return [];
+            }
+            return [relative(serviceDir, absolute).split("\\").join("/")];
+        });
         const manifest = {
             $schema: SERVICE_MANIFEST_SCHEMA_URL,
             schemaVersion: SERVICE_MANIFEST_SCHEMA_VERSION,
@@ -272,6 +290,8 @@ export function planWrites(plan, force) {
             ...(service.restart ? { restart: service.restart } : {}),
             ...(service.container ? { container: service.container } : {}),
             ...(service.models ? { models: service.models } : {}),
+            ...(service.profiles ? { profiles: service.profiles } : {}),
+            ...(envFile.length ? { envFile } : {}),
             ...(extraPorts.length ? { extraPorts } : {}),
             ...(sidecarOf ? { sidecarOf } : {}),
             ...(volumes.length

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flisk-sh/flisk-import",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Import a repository's root docker-compose.yml into Flisk service.json files, or register its Tiltfile.",
   "type": "module",
   "license": "MIT",