@norskvideo/ctl-test-harness 0.1.38 → 0.1.39

package/container-net.d.ts

@@ -88,7 +88,33 @@ export declare function studioBaseFrom(studio: StudioReach, publishHost: string,
  *  In a container the id also appears as the hostname, but cgroup is present in
  *  both cgroup v1 (`/docker/<id>`) and v2 (`docker-<id>.scope`) layouts. */
 export declare function parseOwnContainerId(cgroupText: string): string | null;
-export declare function ownContainerId(read?: () => string): string | null;
+/** This process's own container id, or null on a bare host.
+ *
+ *  The cgroup id is preferred and costs nothing, but it is not reliable: under
+ *  cgroup NAMESPACES — docker's default for years — a container sees `0::/` and
+ *  no id at all, so cgroup alone reports "not in a container" from inside one.
+ *  That false negative is why `ensureRunnerOnNetwork` has been attaching nothing
+ *  on every docker-outside-of-docker runner while its caller read the verdict as
+ *  success.
+ *
+ *  The fallback does not guess at the hostname's shape. `/.dockerenv` answers
+ *  "is THIS process containerised", which is the question, and `docker inspect`
+ *  arbitrates what the hostname names — docker's default hostname is the short
+ *  id, and compose sets it to the service name, which inspect resolves as well.
+ *  Both must agree, so a bare host that merely shares a name with a container
+ *  still resolves to null. */
+export declare function resolveContainerId(opts: {
+    cgroupText: string | null;
+    inContainer: boolean;
+    hostname: string;
+    isDockerObject: (id: string) => boolean;
+}): string | null;
+export declare function ownContainerId(opts?: {
+    read?: () => string;
+    inContainer?: boolean;
+    hostname?: string;
+    isDockerObject?: (id: string) => boolean;
+}): string | null;
 /** `docker network connect` is not idempotent — a second attach errors. Treat
  *  the "already attached" variants as success so setup can call this blindly. */
 export declare function isAlreadyOnNetworkError(stderr: string): boolean;
@@ -103,8 +129,12 @@ type Runner = (cmd: string, args: string[]) => RunResult;
  *  `failed` (a real error the caller should surface). */
 export declare function ensureRunnerOnNetwork(opts?: {
     network?: string;
-    /** Explicit id (tests). Omitted -> read from /proc/self/cgroup. `null` forces the not-in-container branch. */
+    /** Explicit id (tests). Omitted -> resolved by `ownContainerId`. `null` forces the not-in-container branch. */
     containerId?: string | null;
+    /** Leaf inputs for that resolution (tests), so the whole chain can be
+     *  exercised without docker. Omitted -> the real cgroup, /.dockerenv,
+     *  hostname and `docker inspect`. */
+    detect?: Parameters<typeof ownContainerId>[0];
     run?: Runner;
 }): "attached" | "already" | "not-in-container" | "failed";
 export {};

package/container-net.js

@@ -30,7 +30,8 @@
 // switch: `direct` on the Linux DooD CI box, `publish` (the default) everywhere
 // else. Nothing here changes behaviour until a caller opts a suite into `direct`.
 import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { hostname } from "node:os";
 // Mirrors of norsk-ctl's @norsk-ctl/shared constants — re-declared (not imported)
 // because this package doesn't depend on the ctl backend, exactly as
 // studio-state.ts re-declares MEDIA_HTTP_PORT. Source of truth:
@@ -136,13 +137,47 @@ export function parseOwnContainerId(cgroupText) {
     const m = cgroupText.match(/[0-9a-f]{64}/);
     return m ? m[0] : null;
 }
-export function ownContainerId(read = () => readFileSync("/proc/self/cgroup", "utf-8")) {
+/** This process's own container id, or null on a bare host.
+ *
+ *  The cgroup id is preferred and costs nothing, but it is not reliable: under
+ *  cgroup NAMESPACES — docker's default for years — a container sees `0::/` and
+ *  no id at all, so cgroup alone reports "not in a container" from inside one.
+ *  That false negative is why `ensureRunnerOnNetwork` has been attaching nothing
+ *  on every docker-outside-of-docker runner while its caller read the verdict as
+ *  success.
+ *
+ *  The fallback does not guess at the hostname's shape. `/.dockerenv` answers
+ *  "is THIS process containerised", which is the question, and `docker inspect`
+ *  arbitrates what the hostname names — docker's default hostname is the short
+ *  id, and compose sets it to the service name, which inspect resolves as well.
+ *  Both must agree, so a bare host that merely shares a name with a container
+ *  still resolves to null. */
+export function resolveContainerId(opts) {
+    const fromCgroup = opts.cgroupText === null ? null : parseOwnContainerId(opts.cgroupText);
+    if (fromCgroup)
+        return fromCgroup;
+    if (!opts.inContainer || !opts.hostname)
+        return null;
+    return opts.isDockerObject(opts.hostname) ? opts.hostname : null;
+}
+function dockerKnows(id) {
+    return spawnSync("docker", ["inspect", "-f", "{{.Id}}", id], { encoding: "utf-8" }).status === 0;
+}
+export function ownContainerId(opts = {}) {
+    const read = opts.read ?? (() => readFileSync("/proc/self/cgroup", "utf-8"));
+    let cgroupText;
     try {
-        return parseOwnContainerId(read());
+        cgroupText = read();
     }
     catch {
-        return null;
+        cgroupText = null;
     }
+    return resolveContainerId({
+        cgroupText,
+        inContainer: opts.inContainer ?? existsSync("/.dockerenv"),
+        hostname: opts.hostname ?? hostname(),
+        isDockerObject: opts.isDockerObject ?? dockerKnows,
+    });
 }
 /** `docker network connect` is not idempotent — a second attach errors. Treat
  *  the "already attached" variants as success so setup can call this blindly. */
@@ -159,7 +194,7 @@ const defaultRunner = (cmd, args) => {
  *  `failed` (a real error the caller should surface). */
 export function ensureRunnerOnNetwork(opts = {}) {
     const network = opts.network ?? DOCKER_NETWORK_NAME;
-    const id = opts.containerId === undefined ? ownContainerId() : opts.containerId;
+    const id = opts.containerId === undefined ? ownContainerId(opts.detect) : opts.containerId;
     if (!id)
         return "not-in-container";
     const run = opts.run ?? defaultRunner;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-test-harness",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "type": "module",
   "exports": {
     ".": {

package/smoke.js

@@ -235,8 +235,16 @@ export async function runProductSmoke(slug, spec, deps = defaultSmokeDeps) {
         const started = deps.startDaemon(storeDir, { port: ports.daemonPort, seedConfig: false });
         daemon = started.daemon;
         await started.ready;
-        if (mode === "direct" && deps.ensureNetwork() === "failed") {
-            throw new Error("could not join the runner to norsk-net for direct reach");
+        if (mode === "direct") {
+            // Say which verdict it was. "not-in-container" used to be the SILENT
+            // outcome on every docker-outside-of-docker runner, because the cgroup-only
+            // detection could not see through a cgroup namespace; direct reach then
+            // worked or not by luck of the runner already being on norsk-net, and
+            // nothing in the log distinguished the two.
+            const verdict = deps.ensureNetwork();
+            deps.log(`runner network for direct reach: ${verdict}`);
+            if (verdict === "failed")
+                throw new Error("could not join the runner to norsk-net for direct reach");
         }
         // Register.
         const licenseFile = spec.product.licenseFile ?? deps.licenseFile();