@getmonoceros/workbench 1.26.0 → 1.26.3

package/bundled-components/services/rustfs/component.yml

@@ -6,11 +6,23 @@ service:
   image: rustfs/rustfs:latest
   defaultPort: 9000
   dataMount: /data
+  # rustfs runs as a fixed non-root uid (10001) and must write its
+  # bind-mounted /data. The apply-created host data dir is owned by the
+  # apply user; on native Linux (no Docker-Desktop ownership remapping)
+  # uid 10001 can't write it and rustfs exits with a FATAL "Read-only file
+  # system". Running as root lets it write the mount — the same de-facto
+  # situation as postgres (whose image starts as root and chowns its data
+  # dir). Verified on a native Ubuntu host.
+  user: '0:0'
   healthcheck:
     test: [CMD, curl, -f, 'http://localhost:9000/minio/health/live']
     interval: 10s
     timeout: 5s
     retries: 5
+  client:
+    # `aws s3 --endpoint-url "$RUSTFS_URL" …` with AWS_* from RUSTFS_ACCESS_KEY /
+    # RUSTFS_SECRET_KEY (the briefing tells the agent the vars).
+    apt: [awscli]
   connectionEnv:
     URL: http://${host}:${port}
     HOST: ${host}

package/dist/bin.js

@@ -189,6 +189,12 @@ var init_schema = __esm({
         "Invalid service name. Use lowercase letters, digits, '_' or '-' (must start with a letter or digit)."
       ),
       image: z.string().min(1, "Service image must not be empty."),
+      // Compose `user:` for the service container (e.g. "0:0"). Set for images
+      // that run as a fixed non-root uid but must write a host bind-mounted
+      // dataMount — without it they can't write the apply-created data dir on
+      // native Linux and exit (e.g. rustfs). Curated entries bake this from the
+      // catalog; a builder can also set it by hand.
+      user: z.string().min(1).optional(),
       // In-container port the service listens on. Used by
       // `monoceros tunnel <name> <service>` to forward without an explicit
       // port argument. NOT a host port mapping — host exposure goes through
@@ -727,6 +733,16 @@ var init_descriptor = __esm({
       image: z2.string().min(1),
       defaultPort: z2.number().int().positive().optional(),
       dataMount: z2.string().optional(),
+      /**
+       * Compose `user:` for the service container (e.g. `"0:0"`). Needed for
+       * images that run as a fixed non-root uid yet must write a host
+       * bind-mounted `dataMount`: a freshly-created host data dir is owned by
+       * the apply user, and on native Linux (no Docker-Desktop ownership
+       * remapping) such an image cannot write it and exits. Running as root
+       * lets it write the mount — the same de-facto situation as postgres,
+       * whose image starts as root and chowns its data dir. E.g. rustfs.
+       */
+      user: z2.string().min(1).optional(),
       healthcheck: HealthcheckSchema.optional(),
       /**
        * Connection env injected into the WORKSPACE container so the app / agent
@@ -2180,6 +2196,7 @@ function resolveService(entry2) {
     ...entry2.port !== void 0 ? { port: entry2.port } : {},
     env: entry2.env ? { ...entry2.env } : {},
     volumes: entry2.volumes ? [...entry2.volumes] : [],
+    ...entry2.user ? { user: entry2.user } : {},
     ...entry2.healthcheck ? { healthcheck: entry2.healthcheck } : {},
     ...entry2.restart ? { restart: entry2.restart } : {},
     ...entry2.command ? { command: entry2.command } : {},
@@ -2206,6 +2223,7 @@ function expandCuratedService(name) {
       )
     } : {},
     ...def.dataMount ? { volumes: [`data:${def.dataMount}`] } : {},
+    ...def.user ? { user: def.user } : {},
     ...def.healthcheck ? { healthcheck: def.healthcheck } : {},
     // Bake the connection-env templates into the yml (suffix → template) so
     // they travel with the service: a renamed/duplicated instance keeps them,
@@ -2312,6 +2330,7 @@ var init_catalog = __esm({
           ...Object.keys(env).length > 0 ? { env } : {},
           ...svc.healthcheck ? { healthcheck: svc.healthcheck } : {},
           ...svc.dataMount ? { dataMount: svc.dataMount } : {},
+          ...svc.user ? { user: svc.user } : {},
           defaultPort: svc.defaultPort,
           ...svc.vscodeExtensions ? { vscodeExtensions: svc.vscodeExtensions } : {},
           ...svc.connectionEnv ? { connectionEnv: svc.connectionEnv } : {},
@@ -2326,6 +2345,8 @@ var init_catalog = __esm({
 // src/init/service-doc.ts
 function renderServiceObjectBody(svc) {
   const lines = [`name: ${svc.name}`, `image: ${svc.image}`];
+  if (svc.user !== void 0)
+    lines.push(`user: '${svc.user.replace(/'/g, "''")}'`);
   if (svc.port !== void 0) lines.push(`port: ${svc.port}`);
   if (svc.env && Object.keys(svc.env).length > 0) {
     lines.push("env:");
@@ -2354,6 +2375,12 @@ function renderServiceObjectBody(svc) {
     if (svc.healthcheck.startPeriod)
       lines.push(`  startPeriod: ${svc.healthcheck.startPeriod}`);
   }
+  if (svc.connectionEnv && Object.keys(svc.connectionEnv).length > 0) {
+    lines.push("connectionEnv:");
+    for (const [k, v] of Object.entries(svc.connectionEnv)) {
+      lines.push(`  ${k}: '${v.replace(/'/g, "''")}'`);
+    }
+  }
   return lines;
 }
 function renderCustomService(name, image) {
@@ -3066,6 +3093,9 @@ function buildComposeYaml(opts, dockerMode = "rootful") {
   for (const svc of opts.services) {
     lines.push(`  ${svc.name}:`);
     lines.push(`    image: ${svc.image}`);
+    if (svc.user !== void 0) {
+      lines.push(`    user: ${composeScalar(svc.user)}`);
+    }
     if (svc.restart) {
       lines.push(`    restart: ${svc.restart}`);
     }
@@ -7310,7 +7340,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.26.0" : "dev";
+    CLI_VERSION = true ? "1.26.3" : "dev";
   }
 });