@flisk-sh/flisk-import 0.11.0 → 0.13.0

package/README.md

@@ -13,11 +13,13 @@ flisk import . --yes         # write service.json files and project setup
 - **Reads one file:** the root `docker-compose.yml`, or `compose.yaml`, `compose.yml` or `docker-compose.yaml` when that is absent. Not override files, nested Compose files, Dockerfiles on their own, `package.json`, or Procfiles.
 - **Writes:** one bring-your-own `service.json` per Compose service, plus `.flisk/project.json` if the repo is not a Flisk project yet. It never edits the Compose file or overwrites a `service.json` without `--force`.
 - **Keeps the install's data:** each named volume gets `name`, the Docker volume `docker compose up` created (`<project>_<volume>`, its own `name:`, or an `external` volume), so `flisk up` mounts the same data with no copy (needs the Flisk release with flisk#2964).
+- **Keeps:** `profiles` (the service starts only with `flisk up --profile`), `env_file` as `envFile`, `tmpfs` and `deploy.resources.limits` (`container.tmpfs`, `cpus`, `memory`).
+- **Keeps:** `stop_grace_period` (`container.stopGracePeriod`, such as `30s`), the `aliases` of every network (`container.networkAliases`), `extra_hosts` in list or map form (`container.extraHosts`, such as `host.docker.internal:host-gateway`) and `ulimits` (`container.ulimits`). A service renamed to kebab-case (`lychee_api` becomes `lychee-api`) keeps its Compose name as a network alias, so `http://lychee_api:8000` in another service still resolves. `container_name` is dropped with a note: Flisk names containers itself. These fields, an image with variables and `on-failure:N` need the Flisk core release that reads them; an older core does not apply them.
 - **Keeps:** the service names (`db` stays `db`, so it stays the hostname), the build context and Dockerfile (or the image), the container port as written (3000, 80, 5432), `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
-- **Runtime keys:** named volumes and bind mounts inside the project (`volumes`), `cap_add`, `cap_drop`, `init`, `read_only`, `user`, `security_opt` and `shm_size` (`container`), extra published ports (`extraPorts`, on the same host address as in Compose: `"80:80"` stays on every interface, `"127.0.0.1:5432:5432"` on loopback, and another address or a `${VAR:-default}` host side as `publish`), `network_mode: service:<name>` (`sidecarOf`) and `restart`.
+- **Runtime keys:** named volumes and bind mounts inside the project (`volumes`), `cap_add`, `cap_drop`, `init`, `read_only`, `user`, `security_opt` and `shm_size` (`container`), extra published ports (`extraPorts`, on the same host address as in Compose: `"80:80"` stays on every interface, `"127.0.0.1:5432:5432"` on loopback, and another address or a `${VAR:-default}` or `${VAR-default}` host side as `publish`), `network_mode: service:<name>` (`sidecarOf`) and `restart`.
 - **Environment:** values that cannot be secrets go into the committed `service.json` `env`: numbers, `true`/`false`, another imported service's address without a user, password or query (`http://invidious:3000`, `redis:6379`), and pure `${VAR}` references. Every other name, and any name that looks like a credential (`PASSWORD`, `TOKEN`, `KEY`, ...), goes into `secrets.required`, with its literal value copied to the project `.env`, which is added to `.gitignore`. Values in `.env` already are kept.
-- **Keeps:** a `command` or `entrypoint` on an image as the `CMD`/`ENTRYPOINT` of a small `Dockerfile` next to `service.json` (Flisk sets no container command), a `healthcheck` as `healthCheck.command`, a published database port as `extraPorts`, and `restart: on-failure:N` as `on-failure`.
-- **Drops, and says so:** `command` on a service with a `build`, `env_file` and every other untranslated key; anonymous volumes and paths outside the project; `network_mode` other than `service:<name>`; services with `profiles`, `extends`, an out-of-tree build or a `${VAR}` image.
+- **Keeps:** a `command` or `entrypoint` on an image as the `CMD`/`ENTRYPOINT` of a small `Dockerfile` next to `service.json` (Flisk sets no container command; a string is split into exec-form arguments as Compose splits it, with no shell, so `command: server /export` on `minio/minio` stays the arguments of its `ENTRYPOINT`; only a string with `$` variables or unbalanced quotes runs through `sh -c`, and the plan says so), a `healthcheck` as `healthCheck.command`, a published database port as `extraPorts`, and `restart: on-failure:N` with its retry limit (N from 1 to 100).
+- **Drops, and says so:** `command` on a service with a `build`, `env_file` and every other untranslated key; anonymous volumes and paths outside the project; `network_mode` other than `service:<name>`; services with invalid profile names, `extends`, an out-of-tree build, or an image with characters or variable forms other than `${NAME}`, `${NAME:-default}` and `${NAME-default}` (`postgres:${POSTGRES_VERSION:-18}-alpine` is written as it is).
 - **Does not start anything.** Run `flisk up` with Flisk core **1.4.26 or later** (`publish` needs it). The importer does not check the core version.
 - **Exit codes:** `0` when the plan succeeds (`--dry-run`, files written, or all `service.json` files already exist), `1` when no root `docker-compose.yml` or mappable service is found, and `2` when the write prompt is declined or closed without an answer (`Nothing written.`).
 

package/dist/detectors/compose.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, normalize } from "node:path/posix";
 import { isAlias, isMap, parseDocument, visit } from "yaml";
-import { HEALTH_CHECK_PATH_PATTERN } from "../flisk.js";
+import { HEALTH_CHECK_PATH_PATTERN, NETWORK_ALIAS } from "../flisk.js";
 import { registerDetector } from "../registry.js";
 const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 /** Container-side port of one `ports:` entry, in short or long syntax. */
@@ -47,9 +47,18 @@ const TRANSLATED_KEYS = new Set([
     "command",
     "entrypoint",
     "models",
-    // Flisk gives every service its own stack network and container name, so these change nothing it needs.
+    "profiles",
+    "env_file",
+    "tmpfs",
+    "deploy",
+    "stop_grace_period",
+    "extra_hosts",
+    "ulimits",
+    // Only `aliases` is read from networks: Flisk gives every service its own stack network.
     "networks",
     "expose",
+    // Flisk names every container itself; the plan says so.
+    "container_name",
 ]);
 const CAPABILITY = /^[A-Z_]+$/;
 const USER = /^[A-Za-z0-9_.:-]+$/;
@@ -58,6 +67,124 @@ const VOLUME_NAME = /^[a-z0-9][a-z0-9_-]*$/;
 const CONTAINER_PATH = /^\/[A-Za-z0-9_./-]*$/;
 const HOST_PATH = /^[A-Za-z0-9_./-]+$/;
 const RESTART = new Set(["no", "on-failure", "unless-stopped", "always"]);
+/** `on-failure:N` with a retry limit from 1 to 100. */
+const RESTART_LIMIT = /^on-failure:([1-9][0-9]?|100)$/;
+/** A Compose duration such as 30s, 1m30s or 500ms. */
+const DURATION = /^(?:[0-9]+(?:\.[0-9]+)?(?:h|ms|us|m|s))+$/;
+const EXTRA_HOST_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,252}$/;
+/** An extra_hosts address: host-gateway, IPv4, or IPv6 (optionally in brackets). */
+const EXTRA_HOST_ADDRESS = /^(?:host-gateway|[0-9]{1,3}(?:\.[0-9]{1,3}){3}|\[?[0-9A-Fa-f.]*:[0-9A-Fa-f.]*:[0-9A-Fa-f:.]*\]?)$/;
+const ULIMIT_NAME = /^[a-z]+$/;
+/** One extra_hosts entry as `name:address`; undefined when either side is not one Flisk accepts. */
+function extraHostOf(name, address) {
+    if (typeof name !== "string" || typeof address !== "string")
+        return undefined;
+    return EXTRA_HOST_NAME.test(name) && EXTRA_HOST_ADDRESS.test(address)
+        ? `${name}:${address}`
+        : undefined;
+}
+/** Compose extra_hosts in list form (`name:address` or `name=address`) or map form. */
+function extraHostsOf(value) {
+    const kept = [];
+    const bad = [];
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            const at = typeof entry === "string" ? entry.search(/[:=]/) : -1;
+            const host = typeof entry === "string" && at > 0
+                ? extraHostOf(entry.slice(0, at), entry.slice(at + 1))
+                : undefined;
+            if (host)
+                kept.push(host);
+            else
+                bad.push(entry);
+        }
+    }
+    else if (isObj(value)) {
+        for (const [name, address] of Object.entries(value)) {
+            const host = extraHostOf(name, address);
+            if (host)
+                kept.push(host);
+            else
+                bad.push({ [name]: address });
+        }
+    }
+    else {
+        bad.push(value);
+    }
+    return { kept: [...new Set(kept)], bad };
+}
+/** Compose ulimits: each a whole number, or { soft, hard } whole numbers with soft no greater than hard. */
+function ulimitsOf(value) {
+    const kept = {};
+    const bad = [];
+    if (!isObj(value))
+        return { kept, bad: [JSON.stringify(value)] };
+    for (const [name, limit] of Object.entries(value)) {
+        if (!ULIMIT_NAME.test(name))
+            bad.push(name);
+        else if (typeof limit === "number" && Number.isInteger(limit))
+            kept[name] = limit;
+        else if (isObj(limit) &&
+            Number.isInteger(limit.soft) &&
+            Number.isInteger(limit.hard) &&
+            Object.keys(limit).every((k) => k === "soft" || k === "hard") &&
+            (limit.hard === -1 || limit.soft <= limit.hard))
+            kept[name] = { soft: limit.soft, hard: limit.hard };
+        else
+            bad.push(name);
+    }
+    return { kept, bad };
+}
+/** Aliases from every network in a `networks` map; the list form names networks only. */
+function networkAliasesOf(value) {
+    const kept = [];
+    const bad = [];
+    if (!isObj(value))
+        return { kept, bad };
+    for (const network of Object.values(value)) {
+        if (!isObj(network) || network.aliases === undefined)
+            continue;
+        const aliases = Array.isArray(network.aliases) ? network.aliases : [network.aliases];
+        for (const alias of aliases) {
+            if (typeof alias === "string" && NETWORK_ALIAS.test(alias))
+                kept.push(alias);
+            else
+                bad.push(alias);
+        }
+    }
+    return { kept: [...new Set(kept)], bad };
+}
+/** stop_grace_period, network aliases, extra_hosts and ulimits, and a line for each value that is not carried over. */
+function networkOptionsOf(raw) {
+    const options = {};
+    const dropped = [];
+    if (raw.stop_grace_period !== undefined) {
+        if (typeof raw.stop_grace_period === "string" && DURATION.test(raw.stop_grace_period))
+            options.stopGracePeriod = raw.stop_grace_period;
+        else
+            dropped.push(`stop_grace_period ${JSON.stringify(raw.stop_grace_period)} is not a duration such as 30s or 1m30s; not used`);
+    }
+    const aliases = networkAliasesOf(raw.networks);
+    if (aliases.kept.length)
+        options.networkAliases = aliases.kept;
+    if (aliases.bad.length)
+        dropped.push(`network aliases ${JSON.stringify(aliases.bad)} are not DNS names (letters, digits, '-', '_' and '.'); not used`);
+    if (raw.extra_hosts !== undefined) {
+        const hosts = extraHostsOf(raw.extra_hosts);
+        if (hosts.kept.length)
+            options.extraHosts = hosts.kept;
+        if (hosts.bad.length)
+            dropped.push(`extra_hosts ${JSON.stringify(hosts.bad)} are not name:address (an IP or host-gateway); not used`);
+    }
+    if (raw.ulimits !== undefined) {
+        const limits = ulimitsOf(raw.ulimits);
+        if (Object.keys(limits.kept).length)
+            options.ulimits = limits.kept;
+        if (limits.bad.length)
+            dropped.push(`ulimits ${limits.bad.join(", ")} are not a whole number or { soft, hard } with soft <= hard; not used`);
+    }
+    return { options, dropped };
+}
 /** Compose `shm_size` as a size string such as 256mb; a number is bytes. */
 function shmSizeOf(value) {
     if (typeof value === "number" && Number.isInteger(value) && value > 0)
@@ -120,8 +247,11 @@ function containerOf(raw) {
     return { ...(Object.keys(container).length ? { container } : {}), dropped };
 }
 /** One published port: container port, host port when Compose names a literal one, and protocol. */
-/** A `publish` value Flisk accepts: digits, dots, colons and `${NAME:-default}` with a port or IPv4 address:port default. */
-const PUBLISH = /^(?:[0-9.:]|\$\{[A-Za-z_][A-Za-z0-9_]*:-[0-9.:]+\})+$/;
+/**
+ * A `publish` value Flisk accepts: digits, dots, colons and `${NAME:-default}` or `${NAME-default}` with a port or IPv4
+ * address:port default.
+ */
+const PUBLISH = /^(?:[0-9.:]|\$\{[A-Za-z_][A-Za-z0-9_]*:?-[0-9.:]+\})+$/;
 /** The host address and port of a published port. Compose publishes on every interface unless an address is given. */
 function hostSideOf(port, hostIp, hostPort) {
     const hostNumber = hostPort && /^\d+$/.test(hostPort) ? Number.parseInt(hostPort, 10) : undefined;
@@ -294,12 +424,82 @@ function commandOf(command) {
         return command.join(" ");
     return undefined;
 }
-/** Compose `command` as the argument vector the container runs; a string goes through a shell, as Compose runs it. */
+/**
+ * A Compose `command`/`entrypoint` string split into arguments the way Compose splits it (shell words: whitespace,
+ * '...' kept as it is, "..." with \" \\ \$ \` escapes, a backslash escaping the next character). Compose runs no shell.
+ * Undefined when the quotes or a trailing backslash do not balance.
+ */
+export function shellWords(text) {
+    const words = [];
+    let word = "";
+    let inWord = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === "'") {
+            const end = text.indexOf("'", i + 1);
+            if (end === -1)
+                return undefined;
+            word += text.slice(i + 1, end);
+            inWord = true;
+            i = end;
+        }
+        else if (ch === '"') {
+            inWord = true;
+            let closed = false;
+            for (i++; i < text.length; i++) {
+                const c = text[i];
+                if (c === '"') {
+                    closed = true;
+                    break;
+                }
+                if (c === "\\" && i + 1 < text.length && '"\\$`'.includes(text[i + 1])) {
+                    word += text[i + 1];
+                    i++;
+                }
+                else
+                    word += c;
+            }
+            if (!closed)
+                return undefined;
+        }
+        else if (ch === "\\") {
+            if (i + 1 >= text.length)
+                return undefined;
+            word += text[i + 1];
+            inWord = true;
+            i++;
+        }
+        else if (/\s/.test(ch)) {
+            if (inWord)
+                words.push(word);
+            word = "";
+            inWord = false;
+        }
+        else {
+            word += ch;
+            inWord = true;
+        }
+    }
+    if (inWord)
+        words.push(word);
+    return words;
+}
+/**
+ * Compose `command`/`entrypoint` as the argument vector the container runs. A list is kept as it is; a string is split
+ * into words as Compose splits it, with no shell, so an image ENTRYPOINT (minio) gets `server /export` as its arguments.
+ * Only a string that cannot be split, or that reads `$VAR` at run time, runs through `sh -c`; `shell` says why.
+ */
 function containerCommandOf(command) {
-    if (typeof command === "string" && command.trim())
-        return ["sh", "-c", command];
+    if (typeof command === "string" && command.trim()) {
+        if (command.includes("$"))
+            return { argv: ["sh", "-c", command], shell: "uses $ variables" };
+        const words = shellWords(command);
+        return words?.length
+            ? { argv: words }
+            : { argv: ["sh", "-c", command], shell: "has unbalanced quotes" };
+    }
     if (Array.isArray(command) && command.length > 0 && command.every((c) => typeof c === "string"))
-        return command;
+        return { argv: command };
     return undefined;
 }
 /** Seconds from a Compose duration such as `30s` or `2m`; undefined for anything it cannot read exactly. */
@@ -357,6 +557,67 @@ function modelsOf(uses, defined) {
     }
     return out.length ? out : undefined;
 }
+const PROFILE = /^[a-z0-9][a-z0-9-]*$/;
+const TMPFS = /^\/[A-Za-z0-9_./-]*(:[a-z0-9=,_-]+)?$/;
+function profilesOf(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return undefined;
+    return value.every((p) => typeof p === "string" && PROFILE.test(p))
+        ? [...new Set(value)]
+        : undefined;
+}
+/** Compose env_file entries (a string, strings, or { path, required }) as paths from the import root; undefined when one leaves it. */
+function envFilesOf(value, composeDir) {
+    const entries = typeof value === "string" ? [value] : Array.isArray(value) ? value : [];
+    const out = [];
+    for (const entry of entries) {
+        const path = typeof entry === "string" ? entry : isObj(entry) ? entry.path : undefined;
+        if (typeof path !== "string" || isAbsolute(path) || path.includes("$"))
+            return undefined;
+        const resolved = normalize(join(composeDir, path));
+        if (resolved === ".." || resolved.startsWith("../") || !/^[A-Za-z0-9_./-]+$/.test(resolved))
+            return undefined;
+        out.push(resolved);
+    }
+    return out.length ? out : undefined;
+}
+/** tmpfs and deploy.resources.limits, and the parts that could not be carried over. */
+function runtimeLimitsOf(raw) {
+    const dropped = [];
+    const out = {};
+    if (raw.tmpfs !== undefined) {
+        const list = typeof raw.tmpfs === "string" ? [raw.tmpfs] : Array.isArray(raw.tmpfs) ? raw.tmpfs : [];
+        const kept = list.filter((t) => typeof t === "string" && TMPFS.test(t));
+        if (kept.length !== list.length || list.length === 0)
+            dropped.push("tmpfs");
+        if (kept.length)
+            out.tmpfs = kept;
+    }
+    if (raw.deploy !== undefined) {
+        const deploy = isObj(raw.deploy) ? raw.deploy : {};
+        const resources = isObj(deploy.resources) ? deploy.resources : {};
+        const limits = isObj(resources.limits) ? resources.limits : {};
+        const cpus = typeof limits.cpus === "number" ? String(limits.cpus) : limits.cpus;
+        if (typeof cpus === "string" && /^[0-9]+(\.[0-9]{1,2})?$/.test(cpus) && Number(cpus) > 0)
+            out.cpus = Number.isInteger(Number(cpus)) && Number(cpus) >= 1 ? Number(cpus) : cpus;
+        else if (limits.cpus !== undefined)
+            dropped.push("deploy.resources.limits.cpus");
+        if (typeof limits.memory === "string" && /^[0-9]+([bBkKmMgG][bB]?)?$/.test(limits.memory))
+            out.memory = limits.memory;
+        else if (limits.memory !== undefined)
+            dropped.push("deploy.resources.limits.memory");
+        const other = [
+            ...Object.keys(deploy)
+                .filter((k) => k !== "resources")
+                .map((k) => `deploy.${k}`),
+            ...Object.keys(resources)
+                .filter((k) => k !== "limits")
+                .map((k) => `deploy.resources.${k}`),
+        ];
+        dropped.push(...other);
+    }
+    return { ...out, dropped };
+}
 function healthPathOf(healthcheck) {
     if (!isObj(healthcheck) || !Array.isArray(healthcheck.test))
         return undefined;
@@ -423,10 +684,11 @@ registerDetector({
                 });
                 continue;
             }
-            if (raw.profiles !== undefined) {
+            const profiles = profilesOf(raw.profiles);
+            if (raw.profiles !== undefined && !profiles) {
                 skips.push({
                     ...base,
-                    reason: `service "${name}" has profiles ${JSON.stringify(raw.profiles)}; profiles are not enforced by Flisk`,
+                    reason: `service "${name}" has profiles ${JSON.stringify(raw.profiles)} that Flisk cannot name (lowercase letters, digits and '-'); not imported`,
                 });
                 continue;
             }
@@ -486,8 +748,20 @@ registerDetector({
                     : [];
             const command = commandOf(raw.command);
             const models = modelsOf(raw.models, isObj(root) ? root.models : undefined);
-            const containerCommand = containerCommandOf(raw.command);
-            const containerEntrypoint = containerCommandOf(raw.entrypoint);
+            const commandArgs = containerCommandOf(raw.command);
+            const entrypointArgs = containerCommandOf(raw.entrypoint);
+            const containerCommand = commandArgs?.argv;
+            const containerEntrypoint = entrypointArgs?.argv;
+            for (const [key, args] of [
+                ["command", commandArgs],
+                ["entrypoint", entrypointArgs],
+            ]) {
+                if (args?.shell)
+                    skips.push({
+                        ...base,
+                        reason: `service "${name}" ${key} ${JSON.stringify(raw[key])} ${args.shell}; it runs through sh -c, which Compose would not do`,
+                    });
+            }
             const healthProbe = healthProbeOf(raw.healthcheck);
             const envKeys = envNames(raw.environment);
             const env = envValues(raw.environment);
@@ -502,7 +776,31 @@ registerDetector({
                     reason: `service "${name}" health path "${foundHealthPath}" has characters Flisk does not accept (only a-z, 0-9, / and -); not used`,
                 });
             }
-            const { container, dropped } = containerOf(raw);
+            const { container: options, dropped } = containerOf(raw);
+            const limits = runtimeLimitsOf(raw);
+            const { dropped: limitsDropped, ...limitValues } = limits;
+            const network = networkOptionsOf(raw);
+            const merged = { ...(options ?? {}), ...limitValues, ...network.options };
+            const container = Object.keys(merged).length ? merged : undefined;
+            for (const reason of network.dropped) {
+                skips.push({ ...base, reason: `service "${name}" ${reason}` });
+            }
+            if (raw.container_name !== undefined) {
+                skips.push({
+                    ...base,
+                    reason: `service "${name}" container_name ${JSON.stringify(raw.container_name)} is dropped: Flisk names containers itself; other services reach it by its service name`,
+                });
+            }
+            for (const key of limitsDropped) {
+                skips.push({ ...base, reason: `service "${name}" ${key} is not carried over; not used` });
+            }
+            const envFile = envFilesOf(raw.env_file, composeDir);
+            if (raw.env_file !== undefined && !envFile) {
+                skips.push({
+                    ...base,
+                    reason: `service "${name}" env_file ${JSON.stringify(raw.env_file)} is outside the imported directory or uses Compose variables; not used`,
+                });
+            }
             for (const key of dropped) {
                 skips.push({
                     ...base,
@@ -541,23 +839,15 @@ registerDetector({
                         reason: `service "${name}" volume ${JSON.stringify(entry)} is not translated (an anonymous volume, a path outside the imported directory, or Compose variables); not mounted`,
                     });
             }
-            // `on-failure:5` caps the retries; Flisk has the policy without the cap.
-            const restartName = typeof raw.restart === "string"
-                ? raw.restart.replace(/^(on-failure):\d+$/, "$1")
-                : undefined;
-            const restart = restartName !== undefined && RESTART.has(restartName)
-                ? restartName
+            // `on-failure:5` caps the retries at 5; service.json keeps the cap (1 to 100).
+            const restart = typeof raw.restart === "string" &&
+                (RESTART.has(raw.restart) || RESTART_LIMIT.test(raw.restart))
+                ? raw.restart
                 : undefined;
-            if (restart && restartName !== raw.restart) {
-                skips.push({
-                    ...base,
-                    reason: `service "${name}" restart ${JSON.stringify(raw.restart)} keeps "${restart}"; the retry limit is not carried over`,
-                });
-            }
             if (raw.restart !== undefined && !restart) {
                 skips.push({
                     ...base,
-                    reason: `service "${name}" restart ${JSON.stringify(raw.restart)} is not a policy Flisk accepts; not used`,
+                    reason: `service "${name}" restart ${JSON.stringify(raw.restart)} is not a policy Flisk accepts (no, always, unless-stopped, on-failure, on-failure:1 to 100); not used`,
                 });
             }
             const untranslated = Object.keys(raw).filter((key) => !TRANSLATED_KEYS.has(key));
@@ -581,6 +871,8 @@ registerDetector({
                 ...(containerCommand ? { containerCommand } : {}),
                 ...(containerEntrypoint ? { containerEntrypoint } : {}),
                 ...(models ? { models } : {}),
+                ...(profiles ? { profiles } : {}),
+                ...(envFile ? { envFile } : {}),
                 ...(healthProbe ? { healthCheck: healthProbe } : {}),
                 ...(selectedPort !== undefined ? { port: selectedPort } : {}),
                 ...(healthCheckPath ? { healthCheckPath } : {}),

package/dist/flisk.js

@@ -9,7 +9,7 @@ export const SERVICE_MANIFEST_SCHEMA_URL = "https://flisk.sh/schema.service.json
  * release after 1.4.10 (flisk#2646) accepts a bring-your-own port outside 4000-5999 and two-letter
  * names, which this importer now writes. Stated, not checked: it does not read the installed version.
  */
-export const MIN_CORE_VERSION = "1.4.24";
+export const MIN_CORE_VERSION = "1.4.26";
 /**
  * The core change that runs a registered Tiltfile (`orchestration.source: "tiltfile"`) from `flisk up`. Stated, not
  * checked, like MIN_CORE_VERSION.
@@ -22,7 +22,13 @@ export const BYO_PORT_RANGE = { min: 4000, max: 5999, label: "4000-5999" };
  * the manifest (flisk `cli/src/utils/service-manifest.ts`, engine `manifest/parser.star`).
  */
 export const HEALTH_CHECK_PATH_PATTERN = /^\/[a-z0-9/-]*$/;
-export const IMAGE_PATTERN = /^[A-Za-z0-9._/:@-]+$/;
+/**
+ * An image reference, which may hold Compose variables `${NAME}`, `${NAME:-default}` and `${NAME-default}` (postgres:${PG_VERSION:-18}-alpine);
+ * Compose resolves them from the project .env. Nothing else: no quotes, spaces or newlines that could change generated YAML.
+ */
+export const IMAGE_PATTERN = /^(?:[A-Za-z0-9._/:@-]|\$\{[A-Za-z_][A-Za-z0-9_]*(?::?-[A-Za-z0-9._/:@-]*)?\})+$/;
+/** A DNS name for a network alias: letters, digits, '-', '_' and '.'. */
+export const NETWORK_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,252}$/;
 const KEBAB = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 export function validateName(label, name) {
     return KEBAB.test(name)

package/dist/merge.js

@@ -74,6 +74,8 @@ function mergeGroup(name, dir, members, resolve) {
         ...firstOf(ordered, "containerCommand"),
         ...firstOf(ordered, "containerEntrypoint"),
         ...firstOf(ordered, "models"),
+        ...firstOf(ordered, "profiles"),
+        ...firstOf(ordered, "envFile"),
         ...firstOf(ordered, "healthCheck"),
         ...(ordered.find((c) => c.sidecarOf)?.sidecarOf
             ? { sidecarOf: resolve(ordered.find((c) => c.sidecarOf)?.sidecarOf) }

package/dist/write.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { ImportError } from "./errors.js";
-import { BYO_PORT_RANGE, defaultProjectConfig, findProjectRoot, IMAGE_PATTERN, SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, validateName, } from "./flisk.js";
+import { BYO_PORT_RANGE, defaultProjectConfig, findProjectRoot, IMAGE_PATTERN, NETWORK_ALIAS, SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, validateName, } from "./flisk.js";
 import { toResourceName } from "./merge.js";
 import { usedManifestPorts } from "./plan.js";
 /** Secret names the service schema accepts (`secrets.required`). */
@@ -96,7 +96,7 @@ export function planWrites(plan, force) {
                 : !service.image
                     ? "Compose gives it neither `image` nor a usable `build`"
                     : !IMAGE_PATTERN.test(service.image)
-                        ? `image "${service.image}" uses Compose variables or characters Flisk does not accept; set a literal image in docker-compose.yml, or write this service.json by hand`
+                        ? `image "${service.image}" has characters Flisk does not accept (Compose variables may only be \${NAME}, \${NAME:-default} or \${NAME-default}); fix it in docker-compose.yml, or write this service.json by hand`
                         : undefined;
         if (reason)
             rejected.push({ name: service.name, reason });
@@ -234,6 +234,31 @@ export function planWrites(plan, force) {
             : undefined;
         if (service.sidecarOf && !sidecarOf)
             notes.push(`network_mode not written: "${service.sidecarOf}" is not in this import`);
+        // A renamed service keeps its Compose name as a network alias, so `http://lychee_api:8000` or `DB_HOST=lychee_db`
+        // in another service still resolves. A sidecar has no network of its own, so it gets no aliases.
+        const renamed = service.originalName && service.originalName !== service.name
+            ? service.originalName
+            : undefined;
+        const keepRenamed = renamed !== undefined && NETWORK_ALIAS.test(renamed);
+        if (renamed && !keepRenamed)
+            notes.push(`"${renamed}" is not kept as a network alias: it is not a DNS name`);
+        const aliases = [
+            ...new Set([...(service.container?.networkAliases ?? []), ...(keepRenamed ? [renamed] : [])]),
+        ].filter((alias) => alias !== service.name);
+        let container = service.container;
+        if (sidecarOf) {
+            if (aliases.length)
+                notes.push(`network aliases not written (${aliases.join(", ")}): a sidecar shares "${sidecarOf}"'s network`);
+            if (container?.networkAliases) {
+                const { networkAliases: _aliases, ...rest } = container;
+                container = Object.keys(rest).length ? rest : undefined;
+            }
+        }
+        else if (aliases.length) {
+            container = { ...(container ?? {}), networkAliases: aliases };
+            if (keepRenamed)
+                notes.push(`network alias "${renamed}" keeps the Compose name, so other services that call it by that name still reach it`);
+        }
         const extraPorts = sidecarOf ? [] : (service.extraPorts ?? []);
         if (sidecarOf && service.extraPorts?.length)
             notes.push(`ports not written: a sidecar has none of its own; publish them on "${sidecarOf}"`);
@@ -261,6 +286,16 @@ export function planWrites(plan, force) {
             const rel = relative(serviceDir, absolute).split("\\").join("/") || ".";
             return [{ ...volume, source: rel.startsWith(".") ? rel : `./${rel}` }];
         });
+        // env_file paths are relative to the service directory in service.json, and must stay inside the project.
+        const envFile = (service.envFile ?? []).flatMap((file) => {
+            const absolute = resolve(plan.root, file);
+            const fromProject = relative(projectRoot, absolute).split("\\").join("/");
+            if (fromProject === ".." || fromProject.startsWith("../")) {
+                notes.push(`env_file ${file} not written: it is outside the project`);
+                return [];
+            }
+            return [relative(serviceDir, absolute).split("\\").join("/")];
+        });
         const manifest = {
             $schema: SERVICE_MANIFEST_SCHEMA_URL,
             schemaVersion: SERVICE_MANIFEST_SCHEMA_VERSION,
@@ -278,8 +313,10 @@ export function planWrites(plan, force) {
                 : {}),
             ...(secretNames.length ? { secrets: { required: secretNames } } : {}),
             ...(service.restart ? { restart: service.restart } : {}),
-            ...(service.container ? { container: service.container } : {}),
+            ...(container ? { container } : {}),
             ...(service.models ? { models: service.models } : {}),
+            ...(service.profiles ? { profiles: service.profiles } : {}),
+            ...(envFile.length ? { envFile } : {}),
             ...(extraPorts.length ? { extraPorts } : {}),
             ...(sidecarOf ? { sidecarOf } : {}),
             ...(volumes.length

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flisk-sh/flisk-import",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Import a repository's root docker-compose.yml into Flisk service.json files, or register its Tiltfile.",
   "type": "module",
   "license": "MIT",