@intentius/chant-lexicon-docker 0.124.45 → 0.124.48

package/src/import/live-export.test.ts

@@ -0,0 +1,271 @@
+/**
+ * docker live export (#4388): a compose project read from a fake Engine API
+ * is mapped back to the compose document it was created from, and
+ * `chant import --from` regenerates its services.
+ */
+
+import { describe, expect, test, vi } from "vitest";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { join, resolve } from "path";
+import { liveImportFromPlugins } from "@intentius/chant/cli/commands/import";
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+import { dockerPlugin } from "../plugin";
+import { exportResources, projectFor } from "../export-resources";
+import { engineAddress, readTar, singleFileText, type DockerEngine } from "./engine";
+import {
+  composeFromLive,
+  configCandidates,
+  serviceContainers,
+  type ContainerInspect,
+  type ImageInspect,
+  type LiveService,
+} from "./live-export";
+import { tarOf } from "./testdata/tar";
+
+const pkgDir = resolve(import.meta.dirname, "../..");
+
+const compose = (project: string, service: string, extra: Record<string, string> = {}) => ({
+  "com.docker.compose.project": project,
+  "com.docker.compose.service": service,
+  "com.docker.compose.container-number": "1",
+  "com.docker.compose.oneoff": "False",
+  ...extra,
+});
+
+const PG_IMAGE: ImageInspect = {
+  Config: {
+    Cmd: ["postgres"],
+    Entrypoint: ["docker-entrypoint.sh"],
+    Env: ["PATH=/usr/bin", "PGDATA=/var/lib/postgresql/data"],
+    Labels: null,
+  },
+};
+
+const db: ContainerInspect = {
+  Id: "db1",
+  Config: {
+    Image: "postgres:16-alpine",
+    Cmd: ["postgres"],
+    Entrypoint: ["docker-entrypoint.sh"],
+    Env: ["POSTGRES_DB=app", "PATH=/usr/bin", "PGDATA=/var/lib/postgresql/data"],
+    Labels: compose("shop", "db", { "app.kubernetes.io/managed-by": "chant" }),
+    Healthcheck: { Test: ["CMD", "pg_isready"], Interval: 5e9, Timeout: 2e9, Retries: 5 },
+  },
+  HostConfig: { PortBindings: {}, RestartPolicy: { Name: "no" } },
+  Mounts: [{ Type: "volume", Name: "shop_pgdata", Destination: "/var/lib/postgresql/data", RW: true }],
+  NetworkSettings: { Networks: { shop_default: {} } },
+};
+
+const API_IMAGE: ImageInspect = { Config: { Cmd: ["node", "server.js"], Env: ["NODE_ENV=production"], WorkingDir: "/app" } };
+
+const api: ContainerInspect = {
+  Id: "api1",
+  Config: {
+    Image: "shop/api:1.0",
+    Cmd: ["node", "server.js", "--settings=/etc/api/settings.json"],
+    Env: ["NODE_ENV=production", "DATABASE_URL=postgres://db/app"],
+    Labels: compose("shop", "api", { "com.docker.compose.depends_on": "db:service_healthy:false", team: "web" }),
+    WorkingDir: "/app",
+  },
+  HostConfig: {
+    PortBindings: { "8080/tcp": [{ HostIp: "", HostPort: "8080" }, { HostIp: "::", HostPort: "8080" }], "9000/udp": [{ HostIp: "127.0.0.1", HostPort: "9000" }] },
+    RestartPolicy: { Name: "on-failure", MaximumRetryCount: 3 },
+  },
+  Mounts: [
+    { Type: "bind", Source: "/srv/shop/static", Destination: "/app/static", RW: false },
+    { Type: "volume", Name: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", Destination: "/tmp/cache", RW: true },
+    { Type: "volume", Name: "shared-logs", Destination: "/var/log/api", RW: true },
+  ],
+  NetworkSettings: { Networks: { shop_default: {}, shop_backend: {} } },
+};
+
+const SETTINGS = '{ "feature": true }\n';
+
+function fakeEngine(): { engine: DockerEngine; paths: string[] } {
+  const paths: string[] = [];
+  const ok = (body: unknown) => ({ status: 200, body: Buffer.from(JSON.stringify(body)) });
+  const engine: DockerEngine = async (path) => {
+    paths.push(path);
+    const url = new URL(`http://docker${path}`);
+    if (url.pathname === "/containers/json") {
+      return ok([
+        { Id: "api1", Labels: api.Config!.Labels },
+        { Id: "db1", Labels: db.Config!.Labels },
+        { Id: "api2", Labels: { ...api.Config!.Labels!, "com.docker.compose.container-number": "2" } },
+        { Id: "run1", Labels: { ...api.Config!.Labels!, "com.docker.compose.oneoff": "True" } },
+      ]);
+    }
+    if (url.pathname === "/containers/api1/json") return ok(api);
+    if (url.pathname === "/containers/db1/json") return ok(db);
+    if (url.pathname === `/images/${encodeURIComponent("shop/api:1.0")}/json`) return ok(API_IMAGE);
+    if (url.pathname === "/images/postgres:16-alpine/json") return ok(PG_IMAGE);
+    if (url.pathname === "/containers/api1/archive" && url.searchParams.get("path") === "/etc/api/settings.json") {
+      return { status: 200, body: tarOf(["settings.json", SETTINGS]) };
+    }
+    return { status: 404, body: Buffer.from('{"message":"no such thing"}') };
+  };
+  return { engine, paths };
+}
+
+describe("serviceContainers", () => {
+  test("one container per service, the lowest number, no one-off runs, only the project's", () => {
+    const got = serviceContainers("shop", [
+      { Id: "b", Labels: compose("shop", "api", { "com.docker.compose.container-number": "2" }) },
+      { Id: "a", Labels: compose("shop", "api") },
+      { Id: "r", Labels: compose("shop", "api", { "com.docker.compose.oneoff": "True" }) },
+      { Id: "x", Labels: compose("other", "web") },
+      { Id: "n", Labels: null },
+    ]);
+    expect([...got]).toEqual([["api", "a"]]);
+  });
+});
+
+describe("configCandidates", () => {
+  test("absolute file paths the command names, outside every mount", () => {
+    expect(
+      configCandidates({
+        Config: {
+          Entrypoint: ["/otelcol-contrib"],
+          Cmd: ["--config=/etc/otel/config.yaml", "--set", "x=1", "file:/etc/b.yml", "/data/in.csv", "/usr/bin/run", "--config=/etc/otel/config.yaml"],
+        },
+        Mounts: [{ Type: "volume", Name: "v", Destination: "/data" }],
+      }),
+    ).toEqual(["/etc/otel/config.yaml", "/etc/b.yml"]);
+  });
+});
+
+describe("composeFromLive", () => {
+  const live = (name: string, container: ContainerInspect, image: ImageInspect, files: Record<string, string> = {}): LiveService => ({
+    name,
+    container,
+    image,
+    files,
+  });
+
+  test("drops what the image supplies and what compose writes, and keeps what was declared", () => {
+    const doc = composeFromLive("shop", [live("api", api, API_IMAGE, { "/etc/api/settings.json": SETTINGS }), live("db", db, PG_IMAGE)]);
+    expect(doc).toEqual({
+      services: {
+        api: {
+          image: "shop/api:1.0",
+          command: ["node", "server.js", "--settings=/etc/api/settings.json"],
+          environment: { DATABASE_URL: "postgres://db/app" },
+          labels: { team: "web" },
+          ports: ["8080:8080", "127.0.0.1:9000:9000/udp"],
+          restart: "on-failure:3",
+          depends_on: { db: { condition: "service_healthy" } },
+          volumes: ["/srv/shop/static:/app/static:ro", "/tmp/cache", "shared-logs:/var/log/api"],
+          networks: ["default", "backend"],
+          configs: [{ source: "api-settings", target: "/etc/api/settings.json" }],
+        },
+        db: {
+          image: "postgres:16-alpine",
+          environment: { POSTGRES_DB: "app" },
+          labels: { "app.kubernetes.io/managed-by": "chant" },
+          healthcheck: { test: ["CMD", "pg_isready"], interval: "5s", timeout: "2s", retries: 5 },
+          volumes: ["pgdata:/var/lib/postgresql/data"],
+        },
+      },
+      volumes: { "shared-logs": { external: true }, pgdata: {} },
+      networks: { backend: {} },
+      configs: { "api-settings": { content: SETTINGS } },
+    });
+  });
+
+  test("verbatim keeps what the image supplies, never compose's labels", () => {
+    const doc = composeFromLive("shop", [live("db", db, PG_IMAGE)], { verbatim: true });
+    const svc = (doc.services as Record<string, Record<string, unknown>>).db!;
+    expect(svc.command).toEqual(["postgres"]);
+    expect(svc.entrypoint).toEqual(["docker-entrypoint.sh"]);
+    expect(svc.environment).toEqual({ POSTGRES_DB: "app", PATH: "/usr/bin", PGDATA: "/var/lib/postgresql/data" });
+    expect(svc.labels).toEqual({ "app.kubernetes.io/managed-by": "chant" });
+  });
+});
+
+describe("exportResources against a fake Engine", () => {
+  test("reads the project's services and the config files their commands name", async () => {
+    const { engine, paths } = fakeEngine();
+    const ir = await exportResources({ environment: "shop" }, engine);
+    expect(ir.resources.map((r) => `${r.type}/${r.logicalId}`)).toEqual([
+      "service/api",
+      "service/db",
+      "volume/shared-logs",
+      "volume/pgdata",
+      "network/backend",
+      "config/api-settings",
+    ]);
+    expect(paths.filter((p) => p.includes("/archive"))).toEqual([`/containers/api1/archive?path=${encodeURIComponent("/etc/api/settings.json")}`]);
+    expect(paths.some((p) => p.includes("api2") || p.includes("run1"))).toBe(false);
+  });
+
+  test("owned keeps only services with chant's marker, and says why", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    try {
+      const { engine, paths } = fakeEngine();
+      const ir = await exportResources({ environment: "shop", owned: true }, engine);
+      expect(ir.resources.map((r) => `${r.type}/${r.logicalId}`)).toEqual(["service/db", "volume/pgdata"]);
+      expect(paths.some((p) => p.includes("/archive"))).toBe(false);
+      expect(warn).toHaveBeenCalledTimes(1);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  test("the selector narrows by type and name", async () => {
+    const { engine } = fakeEngine();
+    const ir = await exportResources({ environment: "shop", selector: { type: "service", name: "db" } }, engine);
+    expect(ir.resources.map((r) => r.logicalId)).toEqual(["db"]);
+  });
+
+  test("COMPOSE_PROJECT_NAME names the project, else the environment", () => {
+    const prev = process.env.COMPOSE_PROJECT_NAME;
+    try {
+      delete process.env.COMPOSE_PROJECT_NAME;
+      expect(projectFor("staging")).toBe("staging");
+      process.env.COMPOSE_PROJECT_NAME = "shop";
+      expect(projectFor("staging")).toBe("shop");
+    } finally {
+      if (prev === undefined) delete process.env.COMPOSE_PROJECT_NAME;
+      else process.env.COMPOSE_PROJECT_NAME = prev;
+    }
+  });
+
+  test("a failed listing is an error, not an empty project", async () => {
+    const engine: DockerEngine = async () => ({ status: 500, body: Buffer.from("daemon down") });
+    await expect(exportResources({ environment: "shop" }, engine)).rejects.toThrow(/compose project shop failed \(500\): daemon down/);
+  });
+
+  test("chant import --from regenerates the project's services", async () => {
+    const dir = mkdtempSync(join(pkgDir, ".roundtrip-tmp-"));
+    try {
+      writeFileSync(join(dir, "package.json"), '{ "name": "docker-live", "private": true, "type": "module" }\n');
+      const { engine } = fakeEngine();
+      const plugin: LexiconPlugin = { ...dockerPlugin, exportResources: (options) => exportResources(options, engine) };
+      const result = await liveImportFromPlugins([plugin], { environment: "shop", output: join(dir, "src"), lexicon: "docker", force: true });
+      expect(result.error).toBeUndefined();
+      expect(result.success).toBe(true);
+      const main = result.generatedFiles.map((f) => readFileSync(join(dir, "src", f), "utf-8")).join("\n");
+      expect(main).toContain("export const api = new Service(");
+      expect(main).toContain('image: "postgres:16-alpine"');
+      expect(main).toContain('composeKey("api-settings", new DockerConfig(');
+      expect(main).toContain(JSON.stringify(SETTINGS));
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("engine", () => {
+  test("DOCKER_HOST: unix socket, plain tcp, else the default socket", () => {
+    expect(engineAddress("unix:///run/user/1000/docker.sock")).toEqual({ socketPath: "/run/user/1000/docker.sock" });
+    expect(engineAddress("tcp://10.0.0.5:2375")).toEqual({ host: "10.0.0.5", port: 2375 });
+    expect(engineAddress("")).toEqual({ socketPath: "/var/run/docker.sock" });
+    expect(() => engineAddress("ssh://me@host")).toThrow(/not a unix:\/\/ or tcp:\/\//);
+  });
+
+  test("an archive of one text file gives its text; a directory, several files or bytes do not", () => {
+    expect(singleFileText(tarOf(["config.yaml", "a: 1\n"]))).toBe("a: 1\n");
+    expect(singleFileText(tarOf(["conf.d/", null], ["conf.d/a.yaml", "a: 1\n"]))).toBeUndefined();
+    expect(readTar(tarOf(["x", "y".repeat(700)]))[0]!.data.length).toBe(700);
+  });
+});

package/src/import/live-export.ts

@@ -0,0 +1,359 @@
+/**
+ * Pure export helpers for the docker lexicon (#4388): turn what the Engine API
+ * returns for a compose project's containers back into the compose document a
+ * user would have written, and map it to import IR through `DockerParser`. All
+ * Engine I/O stays in the caller (`../export-resources`).
+ *
+ * A compose project is the set of containers labelled
+ * `com.docker.compose.project=<name>`; each service is the container labelled
+ * `com.docker.compose.service`, the lowest `container-number` when scaled.
+ * One-off containers (`compose run`) are skipped.
+ *
+ * Configs. Outside swarm, a top-level config is not an Engine object. A
+ * `content` config is copied into the container when it is created, and a
+ * `file` config is bind-mounted; neither is named anywhere the Engine keeps.
+ * What the container does keep is its command, so the files a service is
+ * told to read (`--config=/etc/otelcol-contrib/config.yaml`) are the
+ * candidates, and the caller reads each through
+ * `GET /containers/{id}/archive?path=…`, which works for both forms and for a
+ * remote Engine whose host paths are out of reach. A candidate that reads back
+ * as one text file becomes a `content` config mounted at that path, named
+ * `<service>-<file name>` (the original key is not recoverable). A candidate
+ * inside a volume or a directory bind mount belongs to that mount and is not
+ * read.
+ *
+ * The strip. By default fields the image supplies (its command, entrypoint,
+ * environment, labels, working dir and user) are dropped, so a service reaches
+ * the shape it was declared in; `verbatim` keeps them. Compose's own
+ * `com.docker.compose.*` labels are always dropped: compose writes them, and a
+ * declaration that set them would fight it.
+ *
+ * Ownership. The docker serializer stamps no marker, so under `owned` only
+ * services carrying the label marker (`app.kubernetes.io/managed-by: chant`,
+ * set with `defaultLabels`) are exported, and the caller logs that once.
+ */
+
+import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+import type { ParseContext, TemplateIR } from "@intentius/chant/import/parser";
+import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import { DockerParser } from "./parser";
+import { dockerResultToTemplate } from "./adapter";
+
+export const PROJECT_LABEL = "com.docker.compose.project";
+export const SERVICE_LABEL = "com.docker.compose.service";
+const NUMBER_LABEL = "com.docker.compose.container-number";
+const ONEOFF_LABEL = "com.docker.compose.oneoff";
+const DEPENDS_LABEL = "com.docker.compose.depends_on";
+
+type Json = Record<string, unknown>;
+
+/** A container's or an image's healthcheck, durations in nanoseconds. */
+export interface HealthcheckInspect {
+  Test?: string[];
+  Interval?: number;
+  Timeout?: number;
+  Retries?: number;
+  StartPeriod?: number;
+}
+
+/** What `GET /containers/{id}/json` returns, as far as export reads it. */
+export interface ContainerInspect {
+  Id?: string;
+  Name?: string;
+  Config?: {
+    Image?: string;
+    Cmd?: string[] | null;
+    Entrypoint?: string[] | null;
+    Env?: string[] | null;
+    Labels?: Record<string, string> | null;
+    WorkingDir?: string;
+    User?: string;
+    Healthcheck?: HealthcheckInspect | null;
+  };
+  HostConfig?: {
+    PortBindings?: Record<string, Array<{ HostIp?: string; HostPort?: string }> | null> | null;
+    RestartPolicy?: { Name?: string; MaximumRetryCount?: number } | null;
+  };
+  Mounts?: Array<{ Type?: string; Name?: string; Source?: string; Destination?: string; RW?: boolean }>;
+  NetworkSettings?: { Networks?: Record<string, unknown> | null };
+}
+
+/** What `GET /images/{name}/json` returns, as far as export reads it. */
+export interface ImageInspect {
+  Config?: {
+    Cmd?: string[] | null;
+    Entrypoint?: string[] | null;
+    Env?: string[] | null;
+    Labels?: Record<string, string> | null;
+    WorkingDir?: string;
+    User?: string;
+    Healthcheck?: HealthcheckInspect | null;
+  };
+}
+
+/** One service as read from the Engine: its container, its image, and the config files read out of it. */
+export interface LiveService {
+  name: string;
+  container: ContainerInspect;
+  image?: ImageInspect;
+  /** Config target path → the text read from the container. */
+  files: Record<string, string>;
+}
+
+function same(a: unknown, b: unknown): boolean {
+  return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+}
+
+/**
+ * The containers to export, one per service: compose-labelled for `project`,
+ * not one-off, and the lowest container number when a service is scaled.
+ * `summaries` is what `GET /containers/json` returns.
+ */
+export function serviceContainers(project: string, summaries: Array<{ Id?: string; Labels?: Record<string, string> | null }>): Map<string, string> {
+  const best = new Map<string, { id: string; n: number }>();
+  for (const s of summaries) {
+    const labels = s.Labels ?? {};
+    if (labels[PROJECT_LABEL] !== project || !s.Id) continue;
+    if ((labels[ONEOFF_LABEL] ?? "").toLowerCase() === "true") continue;
+    const service = labels[SERVICE_LABEL];
+    if (!service) continue;
+    const n = Number(labels[NUMBER_LABEL] ?? "1") || 1;
+    const prev = best.get(service);
+    if (!prev || n < prev.n) best.set(service, { id: s.Id, n });
+  }
+  return new Map([...best].sort(([a], [b]) => a.localeCompare(b)).map(([service, { id }]) => [service, id]));
+}
+
+function under(path: string, dir: string): boolean {
+  const d = dir.endsWith("/") ? dir : `${dir}/`;
+  return path.startsWith(d);
+}
+
+/**
+ * The paths a container's command names that may be config files: an
+ * absolute path with a file extension, alone or as a `--flag=` value (an
+ * otel `file:` URI included). A path inside a volume, or inside a directory
+ * bind mount, belongs to that mount and is left out.
+ */
+export function configCandidates(container: ContainerInspect): string[] {
+  const args = [...(container.Config?.Entrypoint ?? []), ...(container.Config?.Cmd ?? [])];
+  const mounts = container.Mounts ?? [];
+  const out: string[] = [];
+  for (const arg of args) {
+    let value = arg.startsWith("-") && arg.includes("=") ? arg.slice(arg.indexOf("=") + 1) : arg;
+    if (value.startsWith("file:")) value = value.slice("file:".length);
+    if (!/^\/[^\s,;:]+$/.test(value)) continue;
+    const base = value.split("/").pop()!;
+    if (!/\.[A-Za-z0-9]+$/.test(base)) continue;
+    if (mounts.some((m) => m.Destination && under(value, m.Destination))) continue;
+    if (!out.includes(value)) out.push(value);
+  }
+  return out;
+}
+
+function stripProjectPrefix(project: string, name: string): string | undefined {
+  return name.startsWith(`${project}_`) ? name.slice(project.length + 1) : undefined;
+}
+
+function envMap(env: string[]): Json {
+  const out: Json = {};
+  for (const e of env) {
+    const i = e.indexOf("=");
+    if (i === -1) out[e] = null;
+    else out[e.slice(0, i)] = e.slice(i + 1);
+  }
+  return out;
+}
+
+function duration(ns: number | undefined): string | undefined {
+  if (!ns) return undefined;
+  const ms = ns / 1e6;
+  return ms % 1000 === 0 ? `${ms / 1000}s` : `${ms}ms`;
+}
+
+function portList(bindings: NonNullable<ContainerInspect["HostConfig"]>["PortBindings"]): string[] {
+  const out: string[] = [];
+  for (const [key, binds] of Object.entries(bindings ?? {})) {
+    const [port, proto] = key.split("/");
+    const suffix = proto && proto !== "tcp" ? `/${proto}` : "";
+    if (!binds || binds.length === 0) {
+      out.push(`${port}${suffix}`);
+      continue;
+    }
+    for (const b of binds) {
+      const ip = b.HostIp && b.HostIp !== "0.0.0.0" && b.HostIp !== "::" ? `${b.HostIp}:` : "";
+      out.push(b.HostPort ? `${ip}${b.HostPort}:${port}${suffix}` : `${port}${suffix}`);
+    }
+  }
+  // The Engine may list `::` and `0.0.0.0` bindings of one port separately.
+  return [...new Set(out)];
+}
+
+function dependsOn(label: string | undefined): unknown {
+  if (!label) return undefined;
+  const entries = label
+    .split(",")
+    .map((e) => e.split(":"))
+    .filter(([name]) => !!name);
+  if (entries.length === 0) return undefined;
+  if (entries.every(([, condition, restart]) => (condition ?? "service_started") === "service_started" && restart !== "true")) {
+    return entries.map(([name]) => name);
+  }
+  return Object.fromEntries(
+    entries.map(([name, condition, restart]) => [name, { condition: condition || "service_started", ...(restart === "true" ? { restart: true } : {}) }]),
+  );
+}
+
+/** The compose service a container was created from, and the config files it mounts. */
+function serviceFromContainer(
+  project: string,
+  live: LiveService,
+  verbatim: boolean,
+): { service: Json; configs: Array<{ name: string; target: string; content: string }>; volumes: string[]; networks: string[] } {
+  const c = live.container.Config ?? {};
+  const img = live.image?.Config ?? {};
+  const keep = (live: unknown, image: unknown) => verbatim || !same(live, image);
+  const service: Json = {};
+
+  if (c.Image) service.image = c.Image;
+  if (c.Entrypoint && c.Entrypoint.length > 0 && keep(c.Entrypoint, img.Entrypoint)) service.entrypoint = c.Entrypoint;
+  if (c.Cmd && c.Cmd.length > 0 && keep(c.Cmd, img.Cmd)) service.command = c.Cmd;
+
+  const imageEnv = new Set(img.Env ?? []);
+  const env = (c.Env ?? []).filter((e) => verbatim || !imageEnv.has(e));
+  if (env.length > 0) service.environment = envMap(env);
+
+  const labels: Record<string, string> = {};
+  for (const [k, v] of Object.entries(c.Labels ?? {})) {
+    if (k.startsWith("com.docker.compose.")) continue;
+    if (!verbatim && img.Labels?.[k] === v) continue;
+    labels[k] = v;
+  }
+  if (Object.keys(labels).length > 0) service.labels = labels;
+
+  if (c.WorkingDir && keep(c.WorkingDir, img.WorkingDir ?? "")) service.working_dir = c.WorkingDir;
+  if (c.User && keep(c.User, img.User ?? "")) service.user = c.User;
+
+  if (c.Healthcheck?.Test && c.Healthcheck.Test.length > 0 && keep(c.Healthcheck, img.Healthcheck)) {
+    const h = c.Healthcheck;
+    service.healthcheck = {
+      test: h.Test,
+      ...(duration(h.Interval) ? { interval: duration(h.Interval) } : {}),
+      ...(duration(h.Timeout) ? { timeout: duration(h.Timeout) } : {}),
+      ...(h.Retries ? { retries: h.Retries } : {}),
+      ...(duration(h.StartPeriod) ? { start_period: duration(h.StartPeriod) } : {}),
+    };
+  }
+
+  const ports = portList(live.container.HostConfig?.PortBindings);
+  if (ports.length > 0) service.ports = ports;
+
+  const restart = live.container.HostConfig?.RestartPolicy;
+  if (restart?.Name && restart.Name !== "no") {
+    service.restart = restart.Name === "on-failure" && restart.MaximumRetryCount ? `on-failure:${restart.MaximumRetryCount}` : restart.Name;
+  }
+
+  const deps = dependsOn(c.Labels?.[DEPENDS_LABEL]);
+  if (deps !== undefined) service.depends_on = deps;
+
+  // Mounts: a config read at a mount's destination is that config, not a volume.
+  const volumes: string[] = [];
+  const mountList: string[] = [];
+  for (const m of live.container.Mounts ?? []) {
+    if (!m.Destination || live.files[m.Destination] !== undefined) continue;
+    const ro = m.RW === false ? ":ro" : "";
+    if (m.Type === "volume" && m.Name) {
+      const key = stripProjectPrefix(project, m.Name);
+      if (key) {
+        volumes.push(key);
+        mountList.push(`${key}:${m.Destination}${ro}`);
+      } else if (/^[0-9a-f]{64}$/.test(m.Name)) {
+        mountList.push(m.Destination);
+      } else {
+        volumes.push(m.Name);
+        mountList.push(`${m.Name}:${m.Destination}${ro}`);
+      }
+    } else if (m.Type === "bind" && m.Source) {
+      mountList.push(`${m.Source}:${m.Destination}${ro}`);
+    }
+  }
+  if (mountList.length > 0) service.volumes = mountList;
+
+  const networks: string[] = [];
+  for (const net of Object.keys(live.container.NetworkSettings?.Networks ?? {})) {
+    networks.push(stripProjectPrefix(project, net) ?? net);
+  }
+  const declaredNets = networks.filter((n) => n !== "default");
+  if (declaredNets.length > 0) service.networks = networks;
+
+  const configs = Object.entries(live.files).map(([target, content]) => {
+    const base = target.split("/").pop()!.replace(/\.[^.]*$/, "");
+    return { name: `${live.name}-${base}`, target, content };
+  });
+  if (configs.length > 0) service.configs = configs.map(({ name, target }) => ({ source: name, target }));
+
+  return { service, configs, volumes, networks: declaredNets };
+}
+
+/**
+ * The compose document a project's services were created from. External
+ * volumes and networks (not prefixed with the project name) are declared
+ * `external`.
+ */
+export function composeFromLive(project: string, services: LiveService[], opts: { verbatim?: boolean } = {}): Json {
+  const doc: { services: Json; configs: Json; volumes: Json; networks: Json } = { services: {}, configs: {}, volumes: {}, networks: {} };
+  for (const live of services) {
+    const { service, configs, volumes, networks } = serviceFromContainer(project, live, opts.verbatim ?? false);
+    doc.services[live.name] = service;
+    for (const cfg of configs) doc.configs[cfg.name] = { content: cfg.content };
+    for (const v of volumes) {
+      const owned = (live.container.Mounts ?? []).some((m) => m.Name === `${project}_${v}`);
+      doc.volumes[v] = owned ? {} : { external: true };
+    }
+    for (const n of networks) {
+      const owned = Object.keys(live.container.NetworkSettings?.Networks ?? {}).includes(`${project}_${n}`);
+      doc.networks[n] = owned ? {} : { external: true };
+    }
+  }
+  const out: Json = { services: doc.services };
+  for (const section of ["volumes", "networks", "configs"] as const) {
+    if (Object.keys(doc[section]).length > 0) out[section] = doc[section];
+  }
+  return out;
+}
+
+/** Whether a container carries chant's label marker. */
+export function isChantOwned(container: ContainerInspect): boolean {
+  return hasOwnershipMarker(container.Config?.Labels ?? undefined, LABEL_OWNERSHIP_KEYS);
+}
+
+/**
+ * Build export IR from one compose project's services, through
+ * {@link DockerParser} as the single compose → IR mapping. `owned` keeps only
+ * services carrying chant's marker; `selector` narrows by IR type (`service`,
+ * `config`, …) and compose key. `reparse(context)` parses the same document
+ * again with a `ParseContext`, so `chant import --from` hands a collector
+ * config to the otel importer, as a file import does (#3373).
+ */
+export function buildExportFromProject(
+  project: string,
+  services: LiveService[],
+  opts: { verbatim?: boolean; selector?: ResourceSelector; owned?: boolean } = {},
+): ExportedTemplate {
+  const kept = opts.owned ? services.filter((s) => isChantOwned(s.container)) : services;
+  if (kept.length === 0) return { resources: [], parameters: [] };
+  const doc = composeFromLive(project, kept, { verbatim: opts.verbatim });
+  const parse = (context?: ParseContext): TemplateIR =>
+    select(dockerResultToTemplate(new DockerParser().parseDocument(doc, context)), opts.selector);
+  return { ...parse(), reparse: (context) => parse(context) };
+}
+
+function select(ir: TemplateIR, selector: ResourceSelector | undefined): TemplateIR {
+  if (!selector || (selector.type === undefined && selector.name === undefined)) return ir;
+  return {
+    ...ir,
+    resources: ir.resources.filter(
+      (r) => (selector.type === undefined || r.type === selector.type) && (selector.name === undefined || r.logicalId === selector.name),
+    ),
+  };
+}

package/src/import/parser.ts

@@ -7,6 +7,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseYAML } from "@intentius/chant/yaml";
+import type { ParseContext } from "@intentius/chant/import/parser";
+import { delegateEmbedded } from "./embedded";
 
 export interface ServiceIR {
   kind: "service";
@@ -125,12 +127,20 @@ function extractProps(
  * Converts YAML to an IR consumable by the TypeScript generator.
  */
 export class DockerParser {
-  parse(content: string): ParseResult {
+  /**
+   * With `context.embedded` (`chant import`), a config's `content` another
+   * lexicon owns (a collector config) is handed to it (see ./embedded.ts).
+   * Without it, every config is kept as written.
+   */
+  parse(content: string, context?: ParseContext): ParseResult {
     if (!content.trim()) return { entities: [], warnings: [] };
+    return this.parseDocument(parseYAML(content) as Record<string, unknown>, context);
+  }
 
+  /** The same as {@link parse}, over a compose document already read (live export builds one). */
+  parseDocument(doc: Record<string, unknown> | undefined, context?: ParseContext): ParseResult {
     const entities: DockerIR[] = [];
     const warnings: string[] = [];
-    const doc = parseYAML(content) as Record<string, unknown>;
     const fields = composeFields();
 
     const known = new Set<string>(SECTIONS.map((s) => s.section));
@@ -150,6 +160,13 @@ export class DockerParser {
       }
     }
 
+    if (context?.embedded) {
+      const configs = new Map(entities.filter((e): e is ConfigIR => e.kind === "config").map((e) => [e.name, e.props]));
+      const services = doc?.services;
+      delegateEmbedded(configs, services && typeof services === "object" && !Array.isArray(services) ? (services as Record<string, unknown>) : undefined, context.embedded);
+      for (const e of entities) if (e.kind === "config") e.props = configs.get(e.name)!;
+    }
+
     return { entities, warnings };
   }
 }