@flisk-sh/flisk-import 0.15.0 → 0.17.0

package/README.md

@@ -10,10 +10,11 @@ flisk import . --yes         # write service.json files and project setup
 
 ## What to expect
 
-- **Reads one file:** the root `docker-compose.yml`, or `compose.yaml`, `compose.yml` or `docker-compose.yaml` when that is absent. Not override files, nested Compose files, Dockerfiles on their own, `package.json`, or Procfiles.
+- **Reads one project:** the root `docker-compose.yml`, or `compose.yaml`, `compose.yml` or `docker-compose.yaml` when that is absent, through `docker compose config --no-interpolate --no-env-resolution --no-path-resolution` when docker compose is installed, so `include:`, `extends` and anchors are resolved as `docker compose up` resolves them (wger keeps db, cache and powersync in `services/*.yaml`), `${VAR}` templates stay as written, and an included file's paths stay relative to its own folder. Without docker compose (or with `FLISK_IMPORT_DOCKER=0`) the file is read as YAML, and the plan says when that leaves `include` or `extends` unresolved. Not override files, Dockerfiles on their own, `package.json`, or Procfiles.
 - **Writes:** one bring-your-own `service.json` per Compose service, plus `.flisk/project.json` if the repo is not a Flisk project yet. It never edits the Compose file or overwrites a `service.json` without `--force`.
 - **Keeps the install's data:** each named volume gets `name`, the Docker volume `docker compose up` created (`<project>_<volume>`, its own `name:`, or an `external` volume), so `flisk up` mounts the same data with no copy (needs the Flisk release with flisk#2964).
 - **Keeps:** `profiles` (the service starts only with `flisk up --profile`), `env_file` as `envFile`, `tmpfs` and `deploy.resources.limits` (`container.tmpfs`, `cpus`, `memory`).
+- **Keeps (Flisk 1.4.28):** each `depends_on` condition as a `{ name, condition }` entry (the list form as `service_started`), `build.args` as `buildArgs` (and, for a generated Dockerfile on an image with variables, each variable as a build argument, so `ARG POSTGRES_VERSION` gets the project's value), `logging` (options as strings), bind paths from the environment (`${OM_AGENTS_DIR:-./agents}`, the default rewritten relative to `service.json`), SELinux labels (`:z`, `:Z`, `bind.selinux`) as `selinux`, and images with `${NAME:?message}`. A bind path from a variable without a default (`${STORAGE_DIR}/redis`) and `extra_hosts` with a variable are still not carried over.
 - **Keeps:** `stop_grace_period` (`container.stopGracePeriod`, such as `30s`), the `aliases` of every network (`container.networkAliases`), `extra_hosts` in list or map form (`container.extraHosts`, such as `host.docker.internal:host-gateway`) and `ulimits` (`container.ulimits`). A service renamed to kebab-case (`lychee_api` becomes `lychee-api`) keeps its Compose name as a network alias, so `http://lychee_api:8000` in another service still resolves. `container_name` is dropped with a note: Flisk names containers itself. These fields, an image with variables and `on-failure:N` need the Flisk core release that reads them; an older core does not apply them.
 - **Keeps:** the service names (`db` stays `db`, so it stays the hostname), the build context and Dockerfile (or the image), the container port as written (3000, 80, 5432), `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
 - **Runtime keys:** named volumes and bind mounts inside the project (`volumes`), `cap_add`, `cap_drop`, `init`, `read_only`, `user`, `security_opt` and `shm_size` (`container`), extra published ports (`extraPorts`, on the same host address as in Compose: `"80:80"` stays on every interface, `"127.0.0.1:5432:5432"` on loopback, and another address or a `${VAR:-default}` or `${VAR-default}` host side as `publish`), `network_mode: service:<name>` (`sidecarOf`) and `restart`.
@@ -22,7 +23,7 @@ flisk import . --yes         # write service.json files and project setup
 - **A tracked `.env`:** a repo that commits its `.env` (Symfony) keeps it as it is, and it is not added to `.gitignore`; values that must stay local go to `.env.local` when git already ignores it, else to `.flisk/.env.import` (added to `.gitignore`), and each service that needs them reads that file as `envFile`.
 - **Keeps:** a `command` or `entrypoint` on an image as the `CMD`/`ENTRYPOINT` of a small `Dockerfile` next to `service.json` (Flisk sets no container command; a string is split into exec-form arguments as Compose splits it, with no shell, so `command: server /export` on `minio/minio` stays the arguments of its `ENTRYPOINT`; `$$` becomes `$` as Compose passes it to the container; only a string with Compose variables (`${VAR}`, filled from `.env` by Compose, by the container's shell here) or unbalanced quotes runs through `sh -c`, and the plan says so), a `healthcheck` as `healthCheck.command`, a published database port as `extraPorts`, and `restart: on-failure:N` with its retry limit (N from 1 to 100).
 - **Drops, and says so:** `command` on a service with a `build`, `env_file` and every other untranslated key; anonymous volumes and paths outside the project; `network_mode` other than `service:<name>`; services with invalid profile names, `extends`, an out-of-tree build, or an image with characters or variable forms other than `${NAME}`, `${NAME:-default}` and `${NAME-default}` (`postgres:${POSTGRES_VERSION:-18}-alpine` is written as it is).
-- **Does not start anything.** Run `flisk up` with Flisk core **1.4.26 or later** (`publish` needs it). The importer does not check the core version.
+- **Does not start anything.** Run `flisk up` with Flisk core **1.4.28 or later** (dependsOn conditions, buildArgs, logging, bind paths from the environment, SELinux labels and `${NAME:?message}` images need it). The importer does not check the core version.
 - **Exit codes:** `0` when the plan succeeds (`--dry-run`, files written, or all `service.json` files already exist), `1` when no root `docker-compose.yml` or mappable service is found, and `2` when the write prompt is declined or closed without an answer (`Nothing written.`).
 
 See [docs/import.md](docs/import.md) for the full mapping and limits. `flisk import` is the core CLI command backed by this package.

package/dist/detectors/compose.js

@@ -1,3 +1,4 @@
+import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, normalize } from "node:path/posix";
 import { isAlias, isMap, parseDocument, visit } from "yaml";
@@ -51,6 +52,7 @@ const TRANSLATED_KEYS = new Set([
     "env_file",
     "tmpfs",
     "deploy",
+    "logging",
     "stop_grace_period",
     "extra_hosts",
     "ulimits",
@@ -152,7 +154,8 @@ function networkAliasesOf(value) {
                 bad.push(alias);
         }
     }
-    return { kept: [...new Set(kept)], bad };
+    // Sorted, so the YAML reader and docker compose config (which sorts networks) give the same list.
+    return { kept: [...new Set(kept)].sort(), bad };
 }
 /** stop_grace_period, network aliases, extra_hosts and ulimits, and a line for each value that is not carried over. */
 function networkOptionsOf(raw) {
@@ -271,10 +274,44 @@ function hostSideOf(port, hostIp, hostPort) {
     const publish = `${hostIp}:${hostNumber ?? port}`;
     return /^\d{1,3}(\.\d{1,3}){3}:\d+$/.test(publish) ? { publish } : undefined;
 }
+/**
+ * The project as `docker compose config` resolves it (include, extends, merges, anchors), with ${VAR} templates and env
+ * files left as written. Undefined when docker compose is not available, fails, or FLISK_IMPORT_DOCKER=0.
+ */
+function composeConfigOf(absPath) {
+    if (process.env.FLISK_IMPORT_DOCKER === "0")
+        return undefined;
+    try {
+        const out = execFileSync("docker", [
+            "compose",
+            "--profile",
+            "*",
+            "-f",
+            absPath,
+            "config",
+            "--no-interpolate",
+            "--no-env-resolution",
+            // Paths stay as written in the root file; an included file's are rebased onto the project directory.
+            "--no-path-resolution",
+            "--format",
+            "json",
+        ], {
+            cwd: dirname(absPath),
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 60_000,
+        });
+        const config = JSON.parse(out);
+        return isObj(config) ? config : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Whether a `ports:` entry names a host port ("8000:8000", "127.0.0.1:8000:8000", `published:`), not only a container port. */
 function hasHostSide(entry) {
     if (isObj(entry))
-        return entry.published !== undefined;
+        return entry.published !== undefined && entry.published !== "";
     return typeof entry === "string" && (entry.split("/")[0] ?? "").includes(":");
 }
 function publishedPort(entry) {
@@ -284,7 +321,7 @@ function publishedPort(entry) {
     let protocol = "tcp";
     let hostSide;
     if (isObj(entry)) {
-        const published = entry.published === undefined ? undefined : String(entry.published);
+        const published = entry.published === undefined || entry.published === "" ? undefined : String(entry.published);
         const hostIp = typeof entry.host_ip === "string" ? entry.host_ip : undefined;
         if (entry.protocol === "udp")
             protocol = "udp";
@@ -318,33 +355,69 @@ function publishedPort(entry) {
         ...(protocol === "udp" ? { protocol } : {}),
     };
 }
+/** A volume entry in short form for the plan, also when docker compose config wrote it in long form. */
+function volumeText(entry) {
+    if (!isObj(entry) || typeof entry.target !== "string")
+        return entry;
+    const source = typeof entry.source === "string" && entry.source ? `${entry.source}:` : "";
+    return `${source}${entry.target}${entry.read_only === true ? ":ro" : ""}`;
+}
 /** One `volumes:` entry. Bind sources are resolved against the Compose file's directory. */
 function volumeOf(entry, composeDir) {
     let source;
     let target;
     let readOnly = false;
     let type;
+    let selinux;
     if (typeof entry === "string") {
-        const parts = entry.split(":");
-        if (parts.length < 2 || parts.length > 3)
-            return undefined;
-        [source, target] = parts;
-        readOnly = parts[2] === "ro";
-        if (parts[2] !== undefined && parts[2] !== "ro" && parts[2] !== "rw")
+        // A `${NAME:-./path}` source has a colon of its own.
+        const match = entry.match(/^(\$\{[^}]*\}|[^:]*):([^:]*)(?::([^:]*))?$/);
+        if (!match)
             return undefined;
+        [, source, target] = match;
+        for (const option of match[3] === undefined ? [] : match[3].split(",")) {
+            if (option === "ro")
+                readOnly = true;
+            else if (option === "z" || option === "Z")
+                selinux = option;
+            else if (option !== "rw")
+                return undefined;
+        }
     }
     else if (isObj(entry)) {
         ({ source, target, type } = entry);
         readOnly = entry.read_only === true;
         if (type !== undefined && type !== "volume" && type !== "bind")
             return undefined;
+        const label = isObj(entry.bind) ? entry.bind.selinux : undefined;
+        if (label === "z" || label === "Z")
+            selinux = label;
+        else if (label !== undefined)
+            return undefined;
     }
     else {
         return undefined;
     }
     if (typeof source !== "string" || typeof target !== "string" || !CONTAINER_PATH.test(target))
         return undefined;
+    // `${NAME:-./path}`: a bind path from the environment, with a default inside the project.
+    const fromEnv = source.match(/^\$\{([A-Za-z_][A-Za-z0-9_]*)(:?-)(\.{1,2}(?:\/[A-Za-z0-9_.-]+)*\/?)\}$/);
+    if (fromEnv) {
+        const resolved = normalize(join(composeDir, fromEnv[3]));
+        if (resolved === ".." || resolved.startsWith("../"))
+            return undefined;
+        return {
+            source: resolved,
+            target,
+            ...(readOnly ? { readOnly } : {}),
+            bind: true,
+            fromEnv: { name: fromEnv[1], op: fromEnv[2] },
+            ...(selinux ? { selinux } : {}),
+        };
+    }
     const bind = type === "bind" || source.startsWith(".") || source.startsWith("/");
+    if (!bind && selinux)
+        return undefined;
     if (!bind) {
         return VOLUME_NAME.test(source)
             ? { source, target, ...(readOnly ? { readOnly } : {}), bind }
@@ -355,7 +428,62 @@ function volumeOf(entry, composeDir) {
     const resolved = normalize(join(composeDir, source));
     if (resolved === ".." || resolved.startsWith("../"))
         return undefined;
-    return { source: resolved, target, ...(readOnly ? { readOnly } : {}), bind };
+    return {
+        source: resolved,
+        target,
+        ...(readOnly ? { readOnly } : {}),
+        bind,
+        ...(selinux ? { selinux } : {}),
+    };
+}
+const ARG_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Compose build.args (a map, or a list of NAME=value) as strings; undefined when there are none or one is unusable. */
+function buildArgsOf(build) {
+    if (!isObj(build) || build.args === undefined)
+        return undefined;
+    const pairs = Array.isArray(build.args)
+        ? build.args.map((a) => typeof a === "string" && a.includes("=")
+            ? [a.slice(0, a.indexOf("=")), a.slice(a.indexOf("=") + 1)]
+            : [String(a), undefined])
+        : isObj(build.args)
+            ? Object.entries(build.args)
+            : [];
+    const out = {};
+    for (const [name, value] of pairs) {
+        if (!ARG_NAME.test(name) || value === undefined || value === null || typeof value === "object")
+            return undefined;
+        const text = String(value);
+        if (text.includes("\n"))
+            return undefined;
+        out[name] = text;
+    }
+    return Object.keys(out).length ? out : undefined;
+}
+/** Compose logging: a driver and string options (max-file: 3 becomes "3"). */
+function loggingOf(value) {
+    if (!isObj(value))
+        return undefined;
+    const out = {};
+    if (value.driver !== undefined) {
+        if (typeof value.driver !== "string" || !/^[a-z0-9][a-z0-9_.-]*$/.test(value.driver))
+            return undefined;
+        out.driver = value.driver;
+    }
+    if (value.options !== undefined) {
+        if (!isObj(value.options))
+            return undefined;
+        const options = {};
+        for (const [key, v] of Object.entries(value.options)) {
+            if (!/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(key) || v === null || typeof v === "object")
+                return undefined;
+            const text = String(v);
+            if (/[\n\r]/.test(text))
+                return undefined;
+            options[key] = text;
+        }
+        out.options = options;
+    }
+    return Object.keys(out).length ? out : undefined;
 }
 /** Compose's project name: top-level `name`, else the directory name, lowercased with other characters dropped. */
 export function projectNameOf(root, absPath) {
@@ -784,9 +912,21 @@ registerDetector({
                 reason: "uses YAML anchors/aliases; values were read after resolution",
             });
         }
-        const root = doc.toJS();
+        const rawRoot = doc.toJS();
+        // `docker compose config` resolves include, extends and merges as `docker compose up` does; the YAML is the fallback.
+        const resolved = composeConfigOf(absPath);
+        const root = resolved ?? rawRoot;
+        const resolves = isObj(rawRoot) &&
+            (rawRoot.include !== undefined ||
+                (isObj(rawRoot.services) &&
+                    Object.values(rawRoot.services).some((s) => isObj(s) && s.extends !== undefined)));
+        if (!resolved && resolves)
+            skips.push({
+                ...base,
+                reason: "uses include or extends, which only `docker compose config` resolves; docker compose was not available (or failed), so the file was read as YAML",
+            });
         const services = isObj(root) && isObj(root.services) ? root.services : null;
-        if (!services || !isMap(doc.get("services", true))) {
+        if (!services || (!resolved && !isMap(doc.get("services", true)))) {
             return { candidates, skips: [...skips, { ...base, reason: "no `services:` map" }] };
         }
         const project = projectNameOf(root, absPath);
@@ -866,6 +1006,34 @@ registerDetector({
                     reason: `service "${name}" publishes extra container ports (${ports.filter((port) => port !== selectedPort).join(", ")}); Flisk routes only ${selectedPort} and keeps the others published as extraPorts`,
                 });
             }
+            // Every dependency keeps its Compose condition; the list form, and a map entry without one, mean service_started.
+            const dependsOnConditions = {};
+            const dependencyEntries = Array.isArray(raw.depends_on)
+                ? raw.depends_on
+                    .filter((d) => typeof d === "string")
+                    .map((d) => [d, undefined])
+                : isObj(raw.depends_on)
+                    ? Object.entries(raw.depends_on)
+                    : [];
+            for (const [dep, value] of dependencyEntries) {
+                const condition = isObj(value) ? value.condition : undefined;
+                dependsOnConditions[dep] =
+                    condition === "service_healthy" || condition === "service_completed_successfully"
+                        ? condition
+                        : "service_started";
+            }
+            const buildArgs = buildArgsOf(raw.build);
+            if (raw.build !== undefined && isObj(raw.build) && raw.build.args !== undefined && !buildArgs)
+                skips.push({
+                    ...base,
+                    reason: `service "${name}" build.args ${JSON.stringify(raw.build.args)} has names or values Flisk does not accept; not used`,
+                });
+            const logging = loggingOf(raw.logging);
+            if (raw.logging !== undefined && !logging)
+                skips.push({
+                    ...base,
+                    reason: `service "${name}" logging ${JSON.stringify(raw.logging)} has a driver or options Flisk does not accept; not used`,
+                });
             const dependsOn = Array.isArray(raw.depends_on)
                 ? raw.depends_on.filter((d) => typeof d === "string")
                 : isObj(raw.depends_on)
@@ -968,7 +1136,7 @@ registerDetector({
                 else
                     skips.push({
                         ...base,
-                        reason: `service "${name}" volume ${JSON.stringify(entry)} is not translated (an anonymous volume, a path outside the imported directory, or Compose variables); not mounted`,
+                        reason: `service "${name}" volume ${JSON.stringify(volumeText(entry))} is not translated (an anonymous volume, a path outside the imported directory, or Compose variables); not mounted`,
                     });
             }
             // `on-failure:5` caps the retries at 5; service.json keeps the cap (1 to 100).
@@ -1013,6 +1181,9 @@ registerDetector({
                 ...(Object.keys(env).length ? { env } : {}),
                 ...(Object.keys(envRefs).length ? { envRefs } : {}),
                 ...(dependsOn.length ? { dependsOn } : {}),
+                ...(Object.keys(dependsOnConditions).length ? { dependsOnConditions } : {}),
+                ...(buildArgs ? { buildArgs } : {}),
+                ...(logging ? { logging } : {}),
                 ...(container ? { container } : {}),
                 ...(extraPorts.length ? { extraPorts } : {}),
                 ...(sidecarOf ? { sidecarOf } : {}),

package/dist/flisk.js

@@ -9,7 +9,7 @@ export const SERVICE_MANIFEST_SCHEMA_URL = "https://flisk.sh/schema.service.json
  * release after 1.4.10 (flisk#2646) accepts a bring-your-own port outside 4000-5999 and two-letter
  * names, which this importer now writes. Stated, not checked: it does not read the installed version.
  */
-export const MIN_CORE_VERSION = "1.4.26";
+export const MIN_CORE_VERSION = "1.4.28";
 /**
  * The core change that runs a registered Tiltfile (`orchestration.source: "tiltfile"`) from `flisk up`. Stated, not
  * checked, like MIN_CORE_VERSION.
@@ -26,7 +26,7 @@ export const HEALTH_CHECK_PATH_PATTERN = /^\/[a-z0-9/-]*$/;
  * An image reference, which may hold Compose variables `${NAME}`, `${NAME:-default}` and `${NAME-default}` (postgres:${PG_VERSION:-18}-alpine);
  * Compose resolves them from the project .env. Nothing else: no quotes, spaces or newlines that could change generated YAML.
  */
-export const IMAGE_PATTERN = /^(?:[A-Za-z0-9._/:@-]|\$\{[A-Za-z_][A-Za-z0-9_]*(?::?-[A-Za-z0-9._/:@-]+)?\})+$/;
+export const IMAGE_PATTERN = /^(?:[A-Za-z0-9._/:@-]|\$\{[A-Za-z_][A-Za-z0-9_]*(?::?-[A-Za-z0-9._/:@-]+|:?\?[A-Za-z0-9 !#%&()*+,./:;<=>?@[\]^_|~-]*)?\})+$/;
 /** A DNS name for a network alias: letters, digits, '-', '_' and '.'. */
 export const NETWORK_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,252}$/;
 const KEBAB = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -50,6 +50,17 @@ export function findProjectRoot(start) {
         dir = parent;
     }
 }
+/**
+ * A project name Flisk accepts (flisk#1519): lowercase letters, digits, - and _, starting with a letter or digit.
+ * "Lychee" becomes "lychee", "My App" becomes "my-app".
+ */
+export function projectNameFor(projectRoot) {
+    const name = basename(projectRoot)
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]+/g, "-")
+        .replace(/^[-_]+|-+$/g, "");
+    return name || "project";
+}
 /**
  * The minimal `.flisk/project.json` an import writes when the repo is not a Flisk project yet: the given stacks in
  * Pre-Alpha, no optional infrastructure, and discovery of every `services/<stack>/<name>` folder. A copy of the minimum
@@ -58,7 +69,7 @@ export function findProjectRoot(start) {
 export function defaultProjectConfig(projectRoot, preAlpha) {
     return {
         version: "1.0",
-        project: { name: basename(projectRoot), version: "1.0.0" },
+        project: { name: projectNameFor(projectRoot), version: "1.0.0" },
         phases: {
             pre_alpha: { name: "Pre-Alpha", ...preAlpha },
             alpha: { name: "Alpha", description: "", enabledStacks: [] },

package/dist/merge.js

@@ -76,6 +76,11 @@ function mergeGroup(name, dir, members, resolve) {
         ...firstOf(ordered, "models"),
         ...firstOf(ordered, "profiles"),
         ...firstOf(ordered, "envFile"),
+        ...firstOf(ordered, "buildArgs"),
+        ...firstOf(ordered, "logging"),
+        dependsOnConditions: Object.fromEntries([...ordered]
+            .reverse()
+            .flatMap((c) => Object.entries(c.dependsOnConditions ?? {}).map(([d, v]) => [resolve(d), v]))),
         ...firstOf(ordered, "healthCheck"),
         ...(ordered.find((c) => c.sidecarOf)?.sidecarOf
             ? { sidecarOf: resolve(ordered.find((c) => c.sidecarOf)?.sidecarOf) }

package/dist/write.js

@@ -40,9 +40,15 @@ function looksSecret(value) {
  * `ARG` lines for the Compose variables in an image, so `FROM postgres:${POSTGRES_VERSION:-18}-alpine` can use them:
  * Docker substitutes only build arguments declared before FROM. The default is the expression's.
  */
+function imageArgExpressions(image) {
+    const out = {};
+    for (const m of image.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)[^}]*\}/g))
+        out[m[1]] ??= m[0];
+    return out;
+}
 function buildArgLines(image) {
     const args = new Map();
-    for (const m of image.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::?-([^}]*))?\}/g))
+    for (const m of image.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::?-([^}]*)|:?\?[^}]*)?\}/g))
         if (!args.has(m[1]))
             args.set(m[1], m[2]);
     return [...args]
@@ -179,7 +185,13 @@ export function planWrites(plan, force) {
         }
         if (status !== "exists")
             used.set(path, port);
-        const dependsOn = service.dependsOn.filter((d) => d !== service.name && names.has(d));
+        // A Compose condition is kept as a { name, condition } entry (Flisk 1.4.28); a plain dependency stays a name.
+        const dependsOn = service.dependsOn
+            .filter((d) => d !== service.name && names.has(d))
+            .map((d) => {
+            const condition = service.dependsOnConditions[d];
+            return condition ? { name: d, condition } : d;
+        });
         const dropped = service.dependsOn.filter((d) => d !== service.name && !names.has(d));
         if (dropped.length)
             notes.push(`dependsOn not written, not in this import: ${dropped.join(", ")}`);
@@ -249,6 +261,20 @@ export function planWrites(plan, force) {
         // Omit `image` from service.json so Flisk builds from the Dockerfile instead of pulling the tag.
         // Flisk has no container `command`, so a Compose `command` on an image becomes the CMD of a one-line Dockerfile.
         const files = [];
+        // Build arguments: Compose build.args for a Dockerfile build, and, for a generated Dockerfile on an image with
+        // variables, each variable with its own expression, so the project's .env reaches `ARG NAME` before FROM.
+        const imageArgs = !service.dockerfile &&
+            service.image &&
+            (service.containerCommand || service.containerEntrypoint)
+            ? imageArgExpressions(service.image)
+            : {};
+        const buildArgsAll = {
+            ...(service.dockerfile ? (service.buildArgs ?? {}) : {}),
+            ...imageArgs,
+        };
+        const buildArgs = Object.keys(buildArgsAll).length ? buildArgsAll : undefined;
+        if (service.buildArgs && !service.dockerfile)
+            notes.push("build.args not written: the service has no build of its own");
         const wrapWithCommand = !service.dockerfile &&
             service.image &&
             (service.containerCommand || service.containerEntrypoint);
@@ -326,7 +352,14 @@ export function planWrites(plan, force) {
                 return [];
             }
             const rel = relative(serviceDir, absolute).split("\\").join("/") || ".";
-            return [{ ...volume, source: rel.startsWith(".") ? rel : `./${rel}` }];
+            const path = rel.startsWith(".") ? rel : `./${rel}`;
+            // `${NAME:-./path}` keeps reading NAME; its default is made relative to the service directory.
+            const source = volume.fromEnv
+                ? `\${${volume.fromEnv.name}${volume.fromEnv.op}${path}}`
+                : path;
+            if (volume.fromEnv)
+                notes.push(`volume ${volume.target} reads its path from ${volume.fromEnv.name}; the default is written relative to this service.json`);
+            return [{ ...volume, source }];
         });
         // env_file paths are relative to the service directory in service.json, and must stay inside the project.
         // With the project .env tracked by git, secrets live in another local file, which Flisk then reads as envFile.
@@ -354,6 +387,8 @@ export function planWrites(plan, force) {
             ...source,
             ...(isPrivate ? { exposeViaProxy: false } : {}),
             ...(dependsOn.length ? { dependsOn } : {}),
+            ...(buildArgs ? { buildArgs } : {}),
+            ...(service.logging ? { logging: service.logging } : {}),
             ...(Object.keys(env).length
                 ? { env: Object.fromEntries(Object.entries(env).sort(([a], [b]) => a.localeCompare(b))) }
                 : {}),
@@ -370,10 +405,11 @@ export function planWrites(plan, force) {
             ...(volumes.length
                 ? {
                     // `name` keeps the Docker volume the Compose install already has, so its data is used with no copy.
-                    volumes: volumes.map(({ source, target, readOnly, name }) => ({
+                    volumes: volumes.map(({ source, target, readOnly, name, selinux }) => ({
                         source,
                         target,
                         ...(readOnly ? { readOnly } : {}),
+                        ...(selinux ? { selinux } : {}),
                         ...(name ? { name } : {}),
                     })),
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flisk-sh/flisk-import",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Import a repository's root docker-compose.yml into Flisk service.json files, or register its Tiltfile.",
   "type": "module",
   "license": "MIT",