@geminixiang/mikan 1.3.0 → 1.4.0

package/dist/sandbox/provisioner.js

@@ -4,29 +4,19 @@ import { readFileSync, statSync } from "node:fs";
 import { isAbsolute, relative } from "node:path";
 import { promisify } from "node:util";
 import * as log from "../log.js";
+import { isPublishedSandboxImage } from "./published-image.js";
 import { reportUserFacingError } from "../observability/index.js";
 const execFileAsync = promisify(execFile);
-function isDockerNotFoundError(err) {
-    if (!err || typeof err !== "object")
-        return false;
-    const stderr = err.stderr;
-    const message = err.message;
-    const haystack = `${typeof stderr === "string" ? stderr : ""}\n${typeof message === "string" ? message : ""}`.toLowerCase();
-    return (haystack.includes("no such network") ||
-        haystack.includes("no such container") ||
-        haystack.includes("no such object") ||
-        haystack.includes("network not found") ||
-        /network [^\n]+ not found/.test(haystack) ||
-        /error: no such [^\n]+/.test(haystack));
-}
-import { errorMessage } from "../unknown-values.js";
-import { sweepOrphanedCommands } from "./container.js";
+import { errorMessage, isRecord } from "../unknown-values.js";
+import { containerEngine } from "./engine.js";
 export class DockerContainerManager {
     static { this.MANAGED_LABEL = "mikan.managed=true"; }
     static { this.IMAGE_MODE_LABEL = "mikan.sandbox=image"; }
     static { this.VAULT_ID_LABEL_KEY = "mikan.vault-id"; }
     static { this.CONVERSATION_ID_LABEL_KEY = "mikan.conversation-id"; }
     static { this.MOUNT_SIGNATURE_LABEL_KEY = "mikan.mount-signature"; }
+    static { this.NETWORK_LABEL_KEY = "mikan.network"; }
+    static { this.IMAGE_ID_LABEL_KEY = "mikan.image-id"; }
     constructor(image, options = {}) {
         this.image = image;
         this.state = new Map();
@@ -37,6 +27,14 @@ export class DockerContainerManager {
         this.limits = options.limits;
         this.boostLimits = options.boostLimits;
         this.execFileImpl = options.execFileImpl ?? execFileAsync;
+        this.configuredEngine = options.engine;
+        this.timeZone = options.timeZone ?? Intl.DateTimeFormat().resolvedOptions().timeZone;
+    }
+    get engine() {
+        return this.configuredEngine ?? containerEngine();
+    }
+    run(args) {
+        return this.execFileImpl(this.engine, args);
     }
     static containerName(containerKey) {
         return `mikan-sandbox-${containerKey}`;
@@ -75,11 +73,14 @@ export class DockerContainerManager {
                 : await this.runtimeDrift(containerKey, containerName, mounts, status);
             if (drift) {
                 log.logInfo(`Container ${containerName} is out of date (${drift}); replacing container`);
+                const leftBehind = await this.imageLeftBehind(containerName);
                 await this.replaceContainer(containerKey, containerName, mounts, options);
                 log.logInfo(`Container ${containerName} replaced from image ${this.image}`);
+                if (leftBehind)
+                    await this.removeImageIfUnused(leftBehind);
             }
             else if (status === "stopped") {
-                await this.execFileImpl("docker", ["start", containerName]);
+                await this.run(["start", containerName]);
                 log.logInfo(`Container ${containerName} started`);
             }
             else if (status === "missing") {
@@ -126,13 +127,18 @@ export class DockerContainerManager {
     getBoostLimits() {
         return this.boostLimits;
     }
+    markUsed(containerKey) {
+        const state = this.state.get(containerKey);
+        if (state)
+            state.lastUsed = Date.now();
+    }
     stop(containerKey) {
         return this.serialize(containerKey, () => this.stopInner(containerKey));
     }
     async stopInner(containerKey) {
         const containerName = this.getContainerName(containerKey);
         try {
-            await this.execFileImpl("docker", ["stop", containerName]);
+            await this.run(["stop", containerName]);
             this.setState(containerKey, "stopped", containerName);
             this.boostedKeys.delete(containerKey);
             this.overrideLimits.delete(containerKey);
@@ -153,7 +159,7 @@ export class DockerContainerManager {
             throw new Error(`Failed to remove container ${containerName}`);
         }
         try {
-            await this.execFileImpl("docker", ["network", "rm", networkName]);
+            await this.run(["network", "rm", networkName]);
             log.logInfo(`Network ${networkName} removed`);
         }
         catch (err) {
@@ -192,9 +198,6 @@ export class DockerContainerManager {
             const lastUsed = details.startedAtMs ?? Date.now();
             this.state.set(containerKey, { status, lastUsed, containerName });
         }
-        await Promise.all(Array.from(this.state.values())
-            .filter((state) => state.status === "running")
-            .map((state) => sweepOrphanedCommands(state.containerName, this.execFileImpl)));
         const running = Array.from(this.state.values()).filter((s) => s.status === "running").length;
         const stopped = this.state.size - running;
         log.logInfo(`Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`);
@@ -229,7 +232,9 @@ export class DockerContainerManager {
         if (mounts.length > 0) {
             labels.push("--label", `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`);
         }
-        await this.execFileImpl("docker", [
+        labels.push("--label", `${DockerContainerManager.NETWORK_LABEL_KEY}=${networkName}`);
+        labels.push("--label", `${DockerContainerManager.IMAGE_ID_LABEL_KEY}=${await this.pulledImageId()}`);
+        await this.run([
             "run",
             "-d",
             "--name",
@@ -242,6 +247,8 @@ export class DockerContainerManager {
             "no-new-privileges",
             "--pids-limit",
             "1024",
+            "--env",
+            `TZ=${this.timeZone}`,
             ...labels,
             ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),
             ...this.mountArgs(mounts),
@@ -261,7 +268,7 @@ export class DockerContainerManager {
     resourceLimitArgs(limits) {
         const args = [];
         if (limits?.cpus)
-            args.push("--cpus", limits.cpus);
+            args.push(...cpuQuotaArgs(limits.cpus));
         if (limits?.memory) {
             args.push("--memory", limits.memory);
             args.push("--memory-swap", limits.memory);
@@ -274,7 +281,7 @@ export class DockerContainerManager {
             return;
         const args = ["update", ...limitArgs, containerName];
         try {
-            await this.execFileImpl("docker", args);
+            await this.run(args);
         }
         catch (err) {
             log.logWarning(`Failed to apply resource limits to container ${containerName}`, errorMessage(err));
@@ -284,7 +291,7 @@ export class DockerContainerManager {
                 operation: "apply_resource_limits",
                 severity: "warning",
                 context: {
-                    sandboxType: "image",
+                    sandboxType: "oci",
                     containerKey,
                     containerName,
                     limitArgCount: limitArgs.length,
@@ -323,14 +330,8 @@ export class DockerContainerManager {
         if (mounts.length === 0)
             return false;
         const expected = this.mountSignature(mounts);
-        const { stdout } = await this.execFileImpl("docker", [
-            "inspect",
-            "-f",
-            `{{index .Config.Labels "${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}"}}`,
-            containerName,
-        ]);
-        const actual = this.normalizeDockerValue(stdout.trim());
-        return actual !== expected;
+        return ((await this.label(containerName, DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY)) !==
+            expected);
     }
     mountSignature(mounts) {
         const payload = mounts
@@ -354,50 +355,95 @@ export class DockerContainerManager {
             return "missing";
         }
     }
-    async inspectBindMounts(containerName) {
-        const { stdout } = await this.execFileImpl("docker", [
+    async label(containerName, key) {
+        const { stdout } = await this.run([
             "inspect",
             "-f",
-            "{{json .HostConfig.Binds}}",
+            `{{index .Config.Labels "${key}"}}`,
             containerName,
         ]);
-        const payload = stdout.trim();
-        const parsed = JSON.parse(payload.length > 0 ? payload : "null");
-        if (parsed === null) {
-            return [];
-        }
-        if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== "string")) {
-            throw new Error(`Unexpected docker bind mount payload for container "${containerName}"`);
-        }
-        return [...parsed].toSorted();
+        return this.normalizeDockerValue(stdout.trim());
+    }
+    async inspectBindMounts(containerName) {
+        const { stdout } = await this.run(["inspect", "-f", "{{json .Mounts}}", containerName]);
+        return parseBindMounts(stdout, containerName)
+            .map((mount) => `${mount.source}:${mount.target}${mount.readOnly ? ":ro" : ""}`)
+            .toSorted();
     }
     async hasImageDrift(containerName) {
         const desired = await this.localImageId();
         if (!desired)
             return false;
-        const { stdout } = await this.execFileImpl("docker", [
+        return (await this.label(containerName, DockerContainerManager.IMAGE_ID_LABEL_KEY)) !== desired;
+    }
+    async localImageId() {
+        try {
+            const { stdout } = await this.run(["image", "inspect", "-f", "{{.Id}}", this.image]);
+            return this.normalizeDockerValue(stdout.trim());
+        }
+        catch {
+            return undefined;
+        }
+    }
+    prepareImage() {
+        this.imagePull ??= this.pullImage();
+        return this.imagePull;
+    }
+    async pullImage() {
+        try {
+            await this.run(["pull", this.image]);
+            log.logInfo(`Sandbox image ${this.image} is current`);
+        }
+        catch (err) {
+            log.logWarning(`Could not pull sandbox image ${this.image}; offices keep the local image if there is one`, errorMessage(err));
+        }
+    }
+    async imageLeftBehind(containerName) {
+        const { stdout } = await this.run([
             "inspect",
             "-f",
-            "{{.Image}}",
+            `{{.Config.Image}}\t{{index .Config.Labels "${DockerContainerManager.IMAGE_ID_LABEL_KEY}"}}`,
             containerName,
         ]);
-        return stdout.trim() !== desired;
+        const [reference = "", label] = stdout.trim().split("\t");
+        const imageId = this.normalizeDockerValue(label);
+        if (imageId && imageId === (await this.localImageId()))
+            return undefined;
+        if (reference !== this.image && isPublishedSandboxImage(reference))
+            return reference;
+        if (imageId && (await this.isUnnamedImage(imageId)))
+            return imageId;
+        return undefined;
     }
-    async localImageId() {
+    async isUnnamedImage(imageId) {
         try {
-            const { stdout } = await this.execFileImpl("docker", [
-                "image",
-                "inspect",
-                "-f",
-                "{{.Id}}",
-                this.image,
-            ]);
-            return this.normalizeDockerValue(stdout.trim());
+            const { stdout } = await this.run(["image", "inspect", "-f", "{{len .RepoTags}}", imageId]);
+            return stdout.trim() === "0";
         }
         catch {
-            return undefined;
+            return false;
         }
     }
+    async removeImageIfUnused(image) {
+        try {
+            await this.run(["rmi", image]);
+            log.logInfo(`Removed sandbox image ${image}, which no container uses`);
+        }
+        catch {
+            return;
+        }
+    }
+    async pulledImageId() {
+        await this.imagePull;
+        const local = await this.localImageId();
+        if (local)
+            return local;
+        await this.run(["pull", this.image]);
+        const pulled = await this.localImageId();
+        if (!pulled)
+            throw new Error(`Image ${this.image} has no ID after pulling it`);
+        return pulled;
+    }
     async replaceContainer(containerKey, containerName, mounts, options) {
         const removed = await this.forceRemoveContainer(containerName, `Container ${containerName} removed for replacement`, `Failed to remove container ${containerName} for replacement`);
         if (!removed)
@@ -406,25 +452,21 @@ export class DockerContainerManager {
     }
     async hasNetworkModeDrift(containerKey, containerName) {
         const expected = DockerContainerManager.networkName(containerKey);
-        const { stdout } = await this.execFileImpl("docker", [
-            "inspect",
-            "-f",
-            "{{.HostConfig.NetworkMode}}",
-            containerName,
-        ]);
-        return stdout.trim() !== expected;
+        return (await this.label(containerName, DockerContainerManager.NETWORK_LABEL_KEY)) !== expected;
     }
     async ensureNetwork(containerKey) {
         const networkName = DockerContainerManager.networkName(containerKey);
-        try {
-            await this.execFileImpl("docker", ["network", "inspect", networkName]);
+        const { stdout } = await this.run([
+            "network",
+            "ls",
+            "--filter",
+            `name=^${networkName}$`,
+            "--format",
+            "{{.Name}}",
+        ]);
+        if (this.parseNameLines(stdout).includes(networkName))
             return networkName;
-        }
-        catch (err) {
-            if (!isDockerNotFoundError(err))
-                throw err;
-        }
-        await this.execFileImpl("docker", [
+        await this.run([
             "network",
             "create",
             "--driver",
@@ -439,25 +481,26 @@ export class DockerContainerManager {
         ]);
         return networkName;
     }
+    async containerExists(containerName) {
+        const { stdout } = await this.run([
+            "ps",
+            "-a",
+            "--filter",
+            `name=^${containerName}$`,
+            "--format",
+            "{{.Names}}",
+        ]);
+        return this.parseNameLines(stdout).includes(containerName);
+    }
     async inspectStatus(containerName) {
-        try {
-            const { stdout } = await this.execFileImpl("docker", [
-                "inspect",
-                "-f",
-                "{{.State.Running}}",
-                containerName,
-            ]);
-            return stdout.trim() === "true" ? "running" : "stopped";
-        }
-        catch (err) {
-            if (isDockerNotFoundError(err))
-                return "missing";
-            throw err;
-        }
+        if (!(await this.containerExists(containerName)))
+            return "missing";
+        const { stdout } = await this.run(["inspect", "-f", "{{.State.Running}}", containerName]);
+        return stdout.trim() === "true" ? "running" : "stopped";
     }
     async listContainerNamesByLabel() {
         try {
-            const { stdout } = await this.execFileImpl("docker", [
+            const { stdout } = await this.run([
                 "ps",
                 "-a",
                 "--filter",
@@ -482,16 +525,17 @@ export class DockerContainerManager {
     }
     async inspectContainerDetails(containerName) {
         try {
-            const { stdout } = await this.execFileImpl("docker", [
+            const { stdout } = await this.run([
                 "inspect",
                 "-f",
-                `{{.State.Running}}\t{{.State.StartedAt}}\t{{json .HostConfig.Binds}}`,
+                `{{.State.Running}}\t{{.State.StartedAt}}\t{{json .Mounts}}`,
                 containerName,
             ]);
-            const [runningRaw, startedAtRaw, bindsRaw] = stdout.trim().split("\t");
+            const [runningRaw, startedAtRaw, mountsRaw] = stdout.trim().split("\t");
             const running = runningRaw === "true";
-            const startedAtMs = this.parseDockerTimestamp(startedAtRaw);
-            return { running, startedAtMs, bindSources: parseBindSources(bindsRaw) };
+            const startedAtMs = parseEngineTimestamp(this.normalizeDockerValue(startedAtRaw));
+            const bindSources = parseBindMounts(mountsRaw ?? "", containerName).map((mount) => mount.source);
+            return { running, startedAtMs, bindSources };
         }
         catch (err) {
             log.logWarning(`Failed to inspect container ${containerName} during reconcile`, errorMessage(err));
@@ -504,13 +548,6 @@ export class DockerContainerManager {
         const trimmed = value.trim();
         return trimmed.length > 0 ? trimmed : undefined;
     }
-    parseDockerTimestamp(value) {
-        const normalized = this.normalizeDockerValue(value);
-        if (!normalized || normalized.startsWith("0001-"))
-            return undefined;
-        const parsed = Date.parse(normalized);
-        return Number.isNaN(parsed) ? undefined : parsed;
-    }
     containerKeyFromContainerName(containerName) {
         const prefix = DockerContainerManager.containerName("");
         if (!containerName.startsWith(prefix))
@@ -520,26 +557,51 @@ export class DockerContainerManager {
     }
     async forceRemoveContainer(containerName, successLog, failureLog) {
         try {
-            await this.execFileImpl("docker", ["rm", "-f", containerName]);
+            if (await this.containerExists(containerName)) {
+                await this.run(["kill", containerName]).catch(() => undefined);
+                await this.run(["rm", "-f", containerName]);
+            }
             log.logInfo(successLog);
             return true;
         }
         catch (err) {
-            const message = errorMessage(err);
-            if (/no such container/i.test(message))
-                return true;
-            log.logWarning(failureLog, message);
+            log.logWarning(failureLog, errorMessage(err));
             return false;
         }
     }
 }
-function parseBindSources(raw) {
-    const parsed = JSON.parse(raw && raw.length > 0 ? raw : "null");
-    if (!Array.isArray(parsed))
+const CPU_PERIOD_MICROSECONDS = 100_000;
+function cpuQuotaArgs(cpus) {
+    const quota = Math.round(Number(cpus) * CPU_PERIOD_MICROSECONDS);
+    if (!Number.isFinite(quota) || quota <= 0)
+        throw new Error(`Invalid CPU limit: ${cpus}`);
+    return ["--cpu-period", String(CPU_PERIOD_MICROSECONDS), "--cpu-quota", String(quota)];
+}
+function parseBindMounts(raw, containerName) {
+    const payload = raw.trim();
+    const parsed = JSON.parse(payload.length > 0 ? payload : "null");
+    if (parsed === null)
         return [];
-    return parsed
-        .filter((bind) => typeof bind === "string")
-        .map((bind) => bind.split(":", 1)[0] ?? bind);
+    if (!Array.isArray(parsed)) {
+        throw new Error(`Unexpected mount payload for container "${containerName}"`);
+    }
+    return parsed.flatMap((entry) => {
+        if (!isRecord(entry) || entry.Type !== "bind")
+            return [];
+        const { Source: source, Destination: target, RW: writable } = entry;
+        if (typeof source !== "string" || typeof target !== "string")
+            return [];
+        return [{ source, target, readOnly: writable === false }];
+    });
+}
+const ENGINE_LOCAL_TIMESTAMP = /^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2}(?:\.\d+)?) ([+-]\d{2})(\d{2})/;
+function parseEngineTimestamp(value) {
+    if (!value || value.startsWith("0001-"))
+        return undefined;
+    const local = ENGINE_LOCAL_TIMESTAMP.exec(value);
+    const iso = local ? `${local[1]}T${local[2]}${local[3]}:${local[4]}` : value;
+    const parsed = Date.parse(iso);
+    return Number.isNaN(parsed) ? undefined : parsed;
 }
 function mountsWithin(sources, root) {
     return sources.some((source) => {