@nosana/node 1.1.71 → 1.1.73-rc

package/README.md

@@ -66,7 +66,7 @@ Options:
 ```
   --provider <provider>     provider used to run the job (choices: "docker", "podman", default: "podman")
   -w, --wallet <wallet>     path to wallet private key (default: "~/.nosana/nosana_key.json")
-  --docker, --podman <URI>  Podman/Docker connection URI (default: "~/.nosana/podman/podman.sock")
+  --docker, --podman <path>  Podman/Docker socket path (default: "~/.nosana/podman/podman.sock")
   -h, --help                display help for command
 ```
 
@@ -79,7 +79,7 @@ Options:
 ```
   --provider <provider>     provider used to run the job (choices: "docker", "podman", default: "podman")
   -w, --wallet <wallet>     path to wallet private key (default: "~/.nosana/nosana_key.json")
-  --docker, --podman <URI>  Podman/Docker connection URI (default: "~/.nosana/podman/podman.sock")
+  --docker, --podman <path>  Podman/Docker socket path (default: "~/.nosana/podman/podman.sock")
   -h, --help                display help for command
 ```
 

package/dist/.env

@@ -1,5 +1,7 @@
 BACKEND_SOLANA_ADDRESS=7rFPFnxjXHC2sfDy3qrDa9pEb4j49oivMuV7e8sYDPmB
 FRP_SERVER_IMAGE=registry.hub.docker.com/nosana/frpc:v1.0.45
+JOB_RUNTIME_IMAGE="nosana/job-runtime:v0.1.0"
+RESOURCE_MANAGER_IMAGE=registry.hub.docker.com/nosana/resource-manager:v1.1.19
 FRP_SERVER_PORT=7000
 MIN_DISK_SPACE=25
 SIGN_MESSAGE="Hello Nosana Node!"

package/dist/package.json

@@ -1,17 +1,20 @@
 {
     "name": "@nosana/node",
-    "version": "1.1.71",
+    "version": "1.1.73-rc",
     "description": "",
     "bin": {
         "nosana-node": "./dist/src/index.js"
     },
     "type": "module",
+    "workspaces": [
+        "packages/*"
+    ],
     "scripts": {
         "dev:start": "./docker-run.sh start --docker /var/run/docker.sock",
         "dev:run": "./docker-run.sh run --docker /var/run/docker.sock",
         "dev:podman:start": "./podman-run.sh start",
         "dev:podman:run": "./podman-run.sh run",
-        "build": "npm run prepare && tsc && cp .env ./dist/ && cp .env.prd ./dist/ && cp .env.dev ./dist/",
+        "build": "npm run prepare && tsc && node scripts/rewrite-dist-imports.mjs dist && cp .env ./dist/ && cp .env.prd ./dist/ && cp .env.dev ./dist/",
         "generate": "npm run generate:host-manager",
         "generate:host-manager": "openapi-typescript https://host-manager.k8s.dev.nos.ci/swagger/json -o ./src/NodeManager/clients/hostManager/schema.d.ts",
         "test": "APP_ENV=development DOCKER_CERT_PATH= vitest run",
@@ -21,10 +24,10 @@
         "publish:next": "npm run build && npm publish --tag=next --access public",
         "publish:public": "npm run build && npm publish --access public",
         "prepare": "npm run generate && ts-patch install && typia patch",
-        "prettier": "prettier --check ./src",
-        "prettier:fix": "prettier --write ./src",
-        "eslint": "eslint ./src",
-        "eslint:fix": "eslint --fix ./src",
+        "prettier": "prettier --check ./src ./packages",
+        "prettier:fix": "prettier --write ./src ./packages",
+        "eslint": "eslint ./src ./packages",
+        "eslint:fix": "eslint --fix ./src ./packages",
         "lint": " npm run eslint",
         "lint:fix": "npm run prettier:fix && npm run eslint:fix"
     },

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/docker/createDockerRunOptions.d.ts

@@ -1,3 +1,3 @@
 import { ContainerCreateOptions } from "dockerode";
 import { RunContainerArgs } from "../interface";
-export declare function createDockerRunOptions(image: string, { name, cmd, gpu, volumes, env, work_dir, entrypoint, aliases, restart_policy, runtime, bind_network_to_container, labels, security, }: RunContainerArgs, gpuOption: string): ContainerCreateOptions;
+export declare function createDockerRunOptions(image: string, { name, cmd, gpu, volumes, env, work_dir, entrypoint, aliases, restart_policy, runtime, bind_network_to_container, labels, security, pid_mode, }: RunContainerArgs, gpuOption: string): ContainerCreateOptions;

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/docker/createDockerRunOptions.js

@@ -10,7 +10,7 @@ function parseRestartPolicy(restart_policy) {
     }
     return undefined;
 }
-export function createDockerRunOptions(image, { name, cmd, gpu, volumes, env, work_dir, entrypoint, aliases, restart_policy, runtime, bind_network_to_container, labels, security, }, gpuOption) {
+export function createDockerRunOptions(image, { name, cmd, gpu, volumes, env, work_dir, entrypoint, aliases, restart_policy, runtime, bind_network_to_container, labels, security, pid_mode, }, gpuOption) {
     const devices = [];
     if (gpu) {
         devices.push({
@@ -73,6 +73,10 @@ export function createDockerRunOptions(image, { name, cmd, gpu, volumes, env, wo
             ...(runtime === 'SEV-SNP' ? { Runtime: runtime } : {}),
             ...(security?.capDrop ? { CapDrop: security.capDrop } : {}),
             ...(security?.pidsLimit ? { PidsLimit: security.pidsLimit } : {}),
+            ...(security?.noNewPrivileges
+                ? { SecurityOpt: ['no-new-privileges'] }
+                : {}),
+            ...(pid_mode ? { PidMode: pid_mode } : {}),
         },
     };
 }

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/docker/dockerExtended/index.d.ts

@@ -1,6 +1,9 @@
 import Dockerode from 'dockerode';
 import { DockerAuth } from '@nosana/sdk';
+import type { PullProgress } from '../../hooks.js';
 export declare class DockerExtended extends Dockerode {
+    private readonly pullProgress?;
+    constructor(options: Dockerode.DockerOptions, pullProgress?: (() => PullProgress) | undefined);
     promisePull(image: string, controller: AbortController, authorisation?: DockerAuth): Promise<unknown>;
     hasImage(image: string): Promise<boolean>;
 }

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/docker/dockerExtended/index.js

@@ -1,15 +1,22 @@
 import Dockerode from 'dockerode';
 import { repoTagsContainsImage } from '../utils/repoTagsContainsImage.js';
-import { createLoggingProxy } from '../../../..//monitoring/proxy/loggingProxy.js';
-import { abortControllerSelector } from '../../../../node/abort/abortControllerSelector.js';
-import { MultiProgressBarReporter } from '../../../../node/utils/multiProgressBarReporter.js';
+/** A pull nobody watches. */
+const silentProgress = {
+    start: () => undefined,
+    update: () => undefined,
+    stop: () => undefined,
+};
 export class DockerExtended extends Dockerode {
+    constructor(options, pullProgress) {
+        super(options);
+        this.pullProgress = pullProgress;
+    }
     async promisePull(image, controller, authorisation) {
-        const multiProgressBarReporter = createLoggingProxy(new MultiProgressBarReporter());
+        const multiProgressBarReporter = this.pullProgress?.() ?? silentProgress;
         return await new Promise((resolve, reject) => this.pull(image, {}, (err, stream) => {
             const destroy = () => {
                 stream.destroy();
-                reject(new Error(`Pulling image aborted due to ${abortControllerSelector().signal.reason}`));
+                reject(new Error(`Pulling image aborted due to ${controller.signal.reason}`));
             };
             if (controller.signal.aborted) {
                 destroy();

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/docker/index.d.ts

@@ -1,26 +1,28 @@
-import { Container, ContainerCreateOptions, ImageInfo, Image, Volume, VolumeCreateResponse, VolumeInspectInfo, ContainerInspectInfo } from 'dockerode';
+import { Container, ContainerCreateOptions, ImageInfo, Image, Volume, VolumeCreateResponse, VolumeInspectInfo, ContainerInspectInfo, ContainerInfo } from 'dockerode';
 import { DockerAuth } from '@nosana/sdk';
-import type { NodeRepository } from '../../../repository/NodeRepository.js';
+import type { OrchestrationHooks } from '../hooks.js';
 import { DockerExtended } from './dockerExtended/index.js';
 import { ContainerOrchestrationInterface, RunContainerArgs } from '../interface.js';
-import { ReturnedStatus } from '../../types.js';
+import { ReturnedStatus } from '../types.js';
 export declare class DockerContainerOrchestration implements ContainerOrchestrationInterface {
-    protected repository?: NodeRepository | undefined;
+    protected hooks: OrchestrationHooks;
     docker: DockerExtended;
-    host: string;
-    port: string;
-    protocol: 'https' | 'http' | 'ssh' | 'socket';
+    socketPath: string;
     name: string;
     gpu: string;
     teeRuntime?: string;
     listeners: Map<string, (() => Promise<void>)[]>;
-    constructor(server: string, gpu: string, teeRuntime?: string, repository?: NodeRepository | undefined);
+    constructor(socketPath: string, gpu: string, teeRuntime?: string, hooks?: OrchestrationHooks);
     checkCustomRuntimeAvailability(runtime: string): Promise<boolean>;
     getContainerByName(name: string): Promise<Container | undefined>;
     getContainersByName(names: string[]): Promise<Container[]>;
     getContainersByLabels(labels: string[], options?: {
         all?: boolean;
     }): Promise<Container[]>;
+    listContainersByLabels(labels: string[], options?: {
+        all?: boolean;
+    }): Promise<ContainerInfo[]>;
+    getContainer(id: string): Container;
     resolveHostPath(path: string): Promise<string>;
     getConnection(): DockerExtended;
     pullImage(image: string, authorisation?: DockerAuth, controller?: AbortController, force?: boolean): Promise<void>;
@@ -38,7 +40,6 @@ export declare class DockerContainerOrchestration implements ContainerOrchestrat
     getRawVolume(name: string): Promise<Volume>;
     deleteVolume(name: string, controller?: AbortController): Promise<void>;
     healthy(): Promise<ReturnedStatus>;
-    getProtocol(): string;
     setupContainerAbortListener(containerId: string, controller: AbortController): void;
     /**
      * Records a container we started so a resync can reap it if a crash orphans
@@ -54,5 +55,5 @@ export declare class DockerContainerOrchestration implements ContainerOrchestrat
     stopAndDeleteContainer(id: string, controller?: AbortController): Promise<ContainerInspectInfo | undefined>;
     isContainerExited(id: string): Promise<boolean>;
     doesContainerExist(id: string): Promise<boolean>;
-    check(): Promise<string>;
+    check(): Promise<void>;
 }

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/docker/index.js

@@ -1,38 +1,20 @@
 import os from 'os';
 import { DockerExtended } from './dockerExtended/index.js';
-import { createSeverObject } from './utils/createServerObject.js';
-import { checkDeprecationDeadline } from './utils/deadline.js';
 import { createDockerRunOptions } from './createDockerRunOptions.js';
-import { liveAbortSignal } from '../../../utils/liveAbortSignal.js';
+import { liveAbortSignal } from '../utils/liveAbortSignal.js';
 export class DockerContainerOrchestration {
-    constructor(server, gpu, teeRuntime, repository) {
-        this.repository = repository;
+    constructor(socketPath, gpu, teeRuntime, hooks = {}) {
+        this.hooks = hooks;
         this.name = 'docker';
         this.gpu = 'all';
         this.listeners = new Map();
         this.gpu = gpu;
         this.teeRuntime = teeRuntime;
-        if (server.startsWith('http') || server.startsWith('ssh')) {
-            const { host, port, protocol } = createSeverObject(server);
-            this.host = host;
-            this.port = port;
-            this.protocol = protocol;
-            this.docker = new DockerExtended({
-                host: this.host,
-                port: this.port,
-                protocol: this.protocol,
-            });
-        }
-        else {
-            // Assume server is a socket path
-            this.protocol = 'socket';
-            if (server.startsWith('~')) {
-                server = server.replace('~', os.homedir());
-            }
-            this.host = server;
-            this.port = '';
-            this.docker = new DockerExtended({ socketPath: this.host });
+        if (socketPath.startsWith('~')) {
+            socketPath = socketPath.replace('~', os.homedir());
         }
+        this.socketPath = socketPath;
+        this.docker = new DockerExtended({ socketPath }, hooks.pullProgress);
     }
     async checkCustomRuntimeAvailability(runtime) {
         // TODO: implement a better check for custom runtimes by creating and starting a basic container with the runtime
@@ -75,20 +57,26 @@ export class DockerContainerOrchestration {
         }
     }
     async getContainersByLabels(labels, options = {}) {
+        const containers = await this.listContainersByLabels(labels, options);
+        return containers.map((info) => this.docker.getContainer(info.Id));
+    }
+    async listContainersByLabels(labels, options = {}) {
         try {
-            const containers = await this.docker.listContainers({
+            return await this.docker.listContainers({
                 all: options.all ?? false,
                 filters: {
                     label: labels,
                     ...(options.all ? {} : { status: ['running'] }),
                 },
             });
-            return containers.map((info) => this.docker.getContainer(info.Id));
         }
         catch (_) {
             throw new Error('could not get containers');
         }
     }
+    getContainer(id) {
+        return this.docker.getContainer(id);
+    }
     async resolveHostPath(path) {
         try {
             // A container's hostname is its id unless overridden, so this finds the
@@ -216,9 +204,6 @@ export class DockerContainerOrchestration {
         }
     }
     async healthy() {
-        if (this.protocol != 'socket') {
-            checkDeprecationDeadline();
-        }
         try {
             const info = await this.docker.info();
             if (typeof info === 'object' && info !== null && info.ID) {
@@ -230,9 +215,6 @@ export class DockerContainerOrchestration {
             return { status: false, error };
         }
     }
-    getProtocol() {
-        return this.protocol;
-    }
     setupContainerAbortListener(containerId, controller) {
         if (controller.signal.aborted) {
             this.stopContainer(containerId);
@@ -255,7 +237,7 @@ export class DockerContainerOrchestration {
     recordContainer(id, name, track = true) {
         if (!track)
             return;
-        this.repository?.trackContainer(id, { name });
+        this.hooks.tracker?.trackContainer(id, { name });
     }
     async runContainer(args, controller) {
         try {
@@ -338,7 +320,7 @@ export class DockerContainerOrchestration {
             });
             // Removed, so forget it. Keyed by the resolved id, matching what
             // `recordContainer` wrote.
-            this.repository?.untrackContainer(info.Id);
+            this.hooks.tracker?.untrackContainer(info.Id);
             return info;
         }
         catch (error) {
@@ -348,7 +330,7 @@ export class DockerContainerOrchestration {
             // Any other failure leaves the container in place, so it stays tracked
             // for the next resync to retry rather than being forgotten while alive.
             if (error.statusCode === 404) {
-                this.repository?.untrackContainer(id);
+                this.hooks.tracker?.untrackContainer(id);
             }
             return undefined;
         }
@@ -378,6 +360,5 @@ export class DockerContainerOrchestration {
         if (!status) {
             throw new Error(`error on container orchestration (docker or podman), error: ${error}`);
         }
-        return `${this.protocol}://${this.host}:${this.port}`;
     }
 }

package/dist/packages/container-orchestrator/src/hooks.d.ts

@@ -0,0 +1,32 @@
+/**
+ * What an orchestrator takes from its host. Everything is optional: the
+ * sidecar passes nothing, the node passes its repository and progress bars.
+ */
+/** Records the containers started through the orchestrator, so the host can
+ * reap what a crash orphaned. Keyed by container id. */
+export interface ContainerTracker {
+    trackContainer(id: string, fields: {
+        name?: string;
+    }): void;
+    untrackContainer(id: string): void;
+}
+/** Reports one image pull's layer progress (the node's terminal bars). */
+export interface PullProgress {
+    start(name: string, options: {
+        format: string;
+    }): void;
+    update(event: {
+        status: string;
+        progressDetail?: {
+            current?: number;
+            total?: number;
+        };
+        id?: string;
+    }): void;
+    stop(name: string): void;
+}
+export interface OrchestrationHooks {
+    tracker?: ContainerTracker;
+    /** Called once per pull; absent means silent pulls. */
+    pullProgress?: () => PullProgress;
+}

package/dist/packages/container-orchestrator/src/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The container runtime behind the node and the job runtime sidecar: one
+ * interface, a Docker and a Podman implementation, and the labels both stamp
+ * on and look up containers by. The package knows nothing about the node;
+ * what it needs from its host (container tracking, pull progress) comes in
+ * through {@link OrchestrationHooks}.
+ */
+export * from './interface.js';
+export * from './labels.js';
+export * from './hooks.js';
+export type { ReturnedStatus } from './types.js';
+export { DockerContainerOrchestration } from './docker/index.js';
+export { PodmanContainerOrchestration } from './podman/index.js';
+export { selectContainerOrchestrationProvider } from './selectContainerOrchestration.js';
+export { createDockerRunOptions } from './docker/createDockerRunOptions.js';
+export { createPodmanRunOptions } from './podman/utils/createPodmanRunOptions.js';
+export { liveAbortSignal } from './utils/liveAbortSignal.js';

package/dist/packages/container-orchestrator/src/index.js

@@ -0,0 +1,16 @@
+/**
+ * The container runtime behind the node and the job runtime sidecar: one
+ * interface, a Docker and a Podman implementation, and the labels both stamp
+ * on and look up containers by. The package knows nothing about the node;
+ * what it needs from its host (container tracking, pull progress) comes in
+ * through {@link OrchestrationHooks}.
+ */
+export * from './interface.js';
+export * from './labels.js';
+export * from './hooks.js';
+export { DockerContainerOrchestration } from './docker/index.js';
+export { PodmanContainerOrchestration } from './podman/index.js';
+export { selectContainerOrchestrationProvider } from './selectContainerOrchestration.js';
+export { createDockerRunOptions } from './docker/createDockerRunOptions.js';
+export { createPodmanRunOptions } from './podman/utils/createPodmanRunOptions.js';
+export { liveAbortSignal } from './utils/liveAbortSignal.js';

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/interface.d.ts

@@ -1,6 +1,6 @@
-import { Container, ImageInfo, Image, Volume, VolumeCreateResponse, VolumeInspectInfo, ContainerCreateOptions, ContainerInspectInfo } from 'dockerode';
+import { Container, ImageInfo, Image, Volume, VolumeCreateResponse, VolumeInspectInfo, ContainerCreateOptions, ContainerInspectInfo, ContainerInfo } from 'dockerode';
 import { DockerAuth, RestartPolicy } from '@nosana/sdk';
-import { ReturnedStatus } from '../types.js';
+import { ReturnedStatus } from './types.js';
 export type RunContainerArgs = {
     name?: string;
     networks?: {
@@ -34,7 +34,11 @@ export type RunContainerArgs = {
     security?: {
         capDrop?: string[];
         pidsLimit?: number;
+        /** Keeps the container's processes from gaining privileges (setuid etc.). */
+        noNewPrivileges?: boolean;
     };
+    /** Shares the host's pid namespace with the container (`--pid=host`). */
+    pid_mode?: 'host';
     /**
      * Runs between create and start with the container handle, so files can be
      * put in place before the entrypoint runs. A failure removes the created
@@ -45,7 +49,7 @@ export type RunContainerArgs = {
 export interface ContainerOrchestrationInterface {
     teeRuntime?: string;
     name: string;
-    host: string;
+    socketPath: string;
     getConnection(): any;
     pullImage(image: string, auth?: DockerAuth, controller?: AbortController, force?: boolean): Promise<void>;
     hasImage(image: string): Promise<boolean>;
@@ -70,6 +74,12 @@ export interface ContainerOrchestrationInterface {
     getContainersByLabels(labels: string[], options?: {
         all?: boolean;
     }): Promise<Container[]>;
+    /** The same selection as {@link getContainersByLabels}, as listings. */
+    listContainersByLabels(labels: string[], options?: {
+        all?: boolean;
+    }): Promise<ContainerInfo[]>;
+    /** A handle on a container by id or name; no round trip. */
+    getContainer(id: string): Container;
     /**
      * The host-side path behind a path the node sees. The node may run in a
      * container with the runtime socket mounted elsewhere, and the daemon
@@ -83,6 +93,5 @@ export interface ContainerOrchestrationInterface {
     isContainerExited(id: string): Promise<boolean>;
     doesContainerExist(id: string): Promise<boolean>;
     healthy(): Promise<ReturnedStatus>;
-    check(): Promise<string>;
-    getProtocol(): string;
+    check(): Promise<void>;
 }

package/dist/packages/container-orchestrator/src/interface.js

@@ -0,0 +1 @@
+export {};

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/labels.d.ts

@@ -4,6 +4,8 @@
  */
 export declare const JOB_LABEL = "com.nosana.job";
 export declare const OP_LABEL = "com.nosana.op";
+/** The operation's execution group (its id when the job set none). */
+export declare const GROUP_LABEL = "com.nosana.group";
 export declare const OP_INDEX_LABEL = "com.nosana.opIndex";
 export declare const SERVICE_LABEL = "com.nosana.service";
 /** Job and operation ids become container names and label values. */

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/labels.js

@@ -4,6 +4,8 @@
  */
 export const JOB_LABEL = 'com.nosana.job';
 export const OP_LABEL = 'com.nosana.op';
+/** The operation's execution group (its id when the job set none). */
+export const GROUP_LABEL = 'com.nosana.group';
 export const OP_INDEX_LABEL = 'com.nosana.opIndex';
 export const SERVICE_LABEL = 'com.nosana.service';
 /** Job and operation ids become container names and label values. */

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/podman/index.d.ts

@@ -1,12 +1,12 @@
 import { Container } from 'dockerode';
-import type { NodeRepository } from '../../../repository/NodeRepository.js';
+import type { OrchestrationHooks } from '../hooks.js';
 import { DockerContainerOrchestration } from '../docker/index.js';
 import { RunContainerArgs } from '../interface.js';
 import { RequestInit, Response } from 'undici';
 export declare class PodmanContainerOrchestration extends DockerContainerOrchestration {
-    private api;
+    private dispatcher;
     name: string;
-    constructor(server: string, gpu: string, teeRuntime?: string, repository?: NodeRepository);
+    constructor(socketPath: string, gpu: string, teeRuntime?: string, hooks?: OrchestrationHooks);
     libPodAPICall(path: string, options: RequestInit): Promise<Response>;
     createNetwork(_name: string, controller?: AbortController): Promise<void>;
     runFlowContainer(image: string, args: RunContainerArgs): Promise<Container>;

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/podman/index.js

@@ -1,27 +1,17 @@
 import { DockerContainerOrchestration } from '../docker/index.js';
 import { createPodmanRunOptions } from './utils/createPodmanRunOptions.js';
 import { fetch, Agent } from 'undici';
-import { liveAbortSignal } from '../../../utils/liveAbortSignal.js';
+import { liveAbortSignal } from '../utils/liveAbortSignal.js';
+const LIBPOD_API = 'http://localhost/v4.5.0/libpod';
 export class PodmanContainerOrchestration extends DockerContainerOrchestration {
-    constructor(server, gpu, teeRuntime, repository) {
-        super(server, gpu, teeRuntime, repository);
+    constructor(socketPath, gpu, teeRuntime, hooks = {}) {
+        super(socketPath, gpu, teeRuntime, hooks);
         this.name = 'podman';
-        if (this.protocol === 'socket') {
-            this.api = `http://localhost/v4.5.0/libpod`;
-        }
-        else {
-            this.api = `${this.protocol}://${this.host}:${this.port}/v4.5.0/libpod`;
-        }
+        // The parent's copy, with `~` expanded; undici takes the path literally.
+        this.dispatcher = new Agent({ connect: { socketPath: this.socketPath } });
     }
     async libPodAPICall(path, options) {
-        if (this.protocol === 'socket') {
-            options.dispatcher = new Agent({
-                connect: {
-                    socketPath: this.host,
-                },
-            });
-        }
-        return fetch(`${this.api}${path}`, options);
+        return fetch(`${LIBPOD_API}${path}`, { ...options, dispatcher: this.dispatcher });
     }
     async createNetwork(_name, controller) {
         try {

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/podman/utils/createPodmanRunOptions.d.ts

@@ -7,6 +7,10 @@ import type { RunContainerArgs } from '../../interface.js';
  * @returns
  */
 export declare function createPodmanRunOptions(image: string, args: RunContainerArgs, gpuOption: string): {
+    pidns?: {
+        nsmode: "host";
+    } | undefined;
+    no_new_privileges?: boolean | undefined;
     resource_limits?: {
         pids: {
             limit: number;
@@ -51,6 +55,10 @@ export declare function createPodmanRunOptions(image: string, args: RunContainer
         options: string[];
     }[] | undefined;
 } | {
+    pidns?: {
+        nsmode: "host";
+    } | undefined;
+    no_new_privileges?: boolean | undefined;
     resource_limits?: {
         pids: {
             limit: number;
@@ -96,6 +104,10 @@ export declare function createPodmanRunOptions(image: string, args: RunContainer
         options: string[];
     }[] | undefined;
 } | {
+    pidns?: {
+        nsmode: "host";
+    } | undefined;
+    no_new_privileges?: boolean | undefined;
     resource_limits?: {
         pids: {
             limit: number;

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/podman/utils/createPodmanRunOptions.js

@@ -1,4 +1,4 @@
-import { ifStringCastToArray } from '../../../../utils/utils.js';
+import { ifStringCastToArray } from '../../utils/ifStringCastToArray.js';
 // These extra types are required because interface.ts
 function parseRestartPolicy(restart_policy) {
     if (typeof restart_policy === 'string') {
@@ -24,7 +24,7 @@ function parseRestartPolicy(restart_policy) {
  * @returns
  */
 export function createPodmanRunOptions(image, args, gpuOption) {
-    const { name, cmd, gpu, volumes, env, aliases, work_dir, entrypoint, restart_policy, labels, security, runtime, } = args;
+    const { name, cmd, gpu, volumes, env, aliases, work_dir, entrypoint, restart_policy, labels, security, runtime, pid_mode, } = args;
     const devices = gpu
         ? gpuOption === 'all'
             ? [
@@ -79,5 +79,7 @@ export function createPodmanRunOptions(image, args, gpuOption) {
         ...(security?.pidsLimit
             ? { resource_limits: { pids: { limit: security.pidsLimit } } }
             : {}),
+        ...(security?.noNewPrivileges ? { no_new_privileges: true } : {}),
+        ...(pid_mode ? { pidns: { nsmode: pid_mode } } : {}),
     };
 }

package/dist/packages/container-orchestrator/src/selectContainerOrchestration.d.ts

@@ -0,0 +1,3 @@
+import type { OrchestrationHooks } from './hooks.js';
+import type { ContainerOrchestrationInterface } from './interface.js';
+export declare function selectContainerOrchestrationProvider(provider: string, socketPath: string, gpu: string, teeRuntime: string | undefined, hooks?: OrchestrationHooks): ContainerOrchestrationInterface;

package/dist/{src/NodeManager/provider/containerOrchestration → packages/container-orchestrator/src}/selectContainerOrchestration.js

@@ -1,14 +1,14 @@
 import { DockerContainerOrchestration } from './docker/index.js';
 import { PodmanContainerOrchestration } from './podman/index.js';
-export function selectContainerOrchestrationProvider(provider, url, gpu, teeRuntime, repository) {
+export function selectContainerOrchestrationProvider(provider, socketPath, gpu, teeRuntime, hooks = {}) {
     if (provider !== 'docker' && teeRuntime === 'SEV-SNP') {
         throw new Error('Custom runtimes are only supported with the Docker provider.');
     }
     switch (provider) {
         case 'podman':
-            return new PodmanContainerOrchestration(url, gpu, teeRuntime, repository);
+            return new PodmanContainerOrchestration(socketPath, gpu, teeRuntime, hooks);
         case 'docker':
         default:
-            return new DockerContainerOrchestration(url, gpu, teeRuntime, repository);
+            return new DockerContainerOrchestration(socketPath, gpu, teeRuntime, hooks);
     }
 }

package/dist/packages/container-orchestrator/src/types.d.ts

@@ -0,0 +1,15 @@
+/** COPY of the node's provider/types.ts ReturnedStatus; the package has no node imports. */
+export type ReturnedStatus<T = undefined> = {
+    status: true;
+    result?: T;
+    error?: never;
+} | {
+    status: false;
+    error: Error | unknown;
+    result?: never;
+};
+declare global {
+    interface Error {
+        eventType?: string;
+    }
+}

package/dist/packages/container-orchestrator/src/types.js

@@ -0,0 +1 @@
+export {};

package/dist/packages/container-orchestrator/src/utils/ifStringCastToArray.d.ts

@@ -0,0 +1,2 @@
+/** COPY of the node's utils.ifStringCastToArray. */
+export declare const ifStringCastToArray: (value: string | string[]) => string[];

package/dist/packages/container-orchestrator/src/utils/ifStringCastToArray.js

@@ -0,0 +1,2 @@
+/** COPY of the node's utils.ifStringCastToArray. */
+export const ifStringCastToArray = (value) => typeof value === 'string' ? [value] : value;

package/dist/src/NodeManager/configs/configs.d.ts

@@ -12,6 +12,12 @@ export type configType = {
     api: {
         port: number;
     };
+    jobRuntime: {
+        containerImage: string;
+    };
+    resourceManager: {
+        containerImage: string;
+    };
     minDiskSpace: number;
     network: 'devnet' | 'mainnet';
 };