@runeditrun/rer 0.0.0-stage → 0.1.1

package/modules/container/remote/files.py

@@ -0,0 +1,275 @@
+"""Private dirfd custody, including verification of the live pathname chain."""
+import os, stat, json, pwd, uuid, fcntl, re
+
+
+def refuse(message):
+    raise RuntimeError(message)
+
+
+def metadata(info, directory=False, ancestor=False):
+    kind = stat.S_ISDIR if directory else stat.S_ISREG
+    owners = {0, os.getuid()} if ancestor else {os.getuid()}
+    mask = 0o022 if ancestor else 0o077
+    if not kind(info.st_mode) or info.st_uid not in owners or info.st_mode & mask or (not directory and info.st_nlink != 1):
+        refuse('Unsafe host path ownership, permissions or type')
+    return info
+
+
+def checked(fd, directory=False, ancestor=False):
+    return metadata(os.fstat(fd), directory, ancestor)
+
+
+def same_inode(left, right):
+    if right is None or (left.st_dev, left.st_ino) != (right.st_dev, right.st_ino):
+        refuse('Host deployment path changed')
+
+
+def directory(parent, name, create=False, ancestor=False):
+    if create:
+        try:
+            os.mkdir(name, 0o700, dir_fd=parent)
+        except FileExistsError:
+            pass
+    fd = os.open(name, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=parent)
+    try:
+        checked(fd, True, ancestor)
+        return fd
+    except BaseException:
+        os.close(fd)
+        raise
+
+
+def file_info(parent, name):
+    try:
+        metadata(os.stat(name, dir_fd=parent, follow_symlinks=False))
+        fd = os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent)
+    except FileNotFoundError:
+        return None
+    try:
+        return checked(fd)
+    finally:
+        os.close(fd)
+
+
+def read_json(parent, name):
+    metadata(os.stat(name, dir_fd=parent, follow_symlinks=False))
+    fd = os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent)
+    try:
+        checked(fd)
+        with os.fdopen(os.dup(fd)) as stream:
+            return json.load(stream)
+    finally:
+        os.close(fd)
+
+
+def exclusive(parent, name, content):
+    fd = os.open(name, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600, dir_fd=parent)
+    try:
+        checked(fd)
+        with os.fdopen(os.dup(fd), 'wb') as stream:
+            stream.write(content.encode())
+            stream.flush()
+            os.fsync(stream.fileno())
+        return checked(fd)
+    finally:
+        os.close(fd)
+
+
+def retain_file(parent, name):
+    # Identity plus exact bytes: a same-UID file transplanted from another
+    # installation passes every ownership and permission check.
+    try:
+        metadata(os.stat(name, dir_fd=parent, follow_symlinks=False))
+        fd = os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent)
+    except FileNotFoundError:
+        return None
+    try:
+        info = checked(fd)
+        with os.fdopen(os.dup(fd), 'rb') as stream:
+            return info, stream.read(65537)
+    finally:
+        os.close(fd)
+
+
+def same_file(parent, name, retained):
+    current = retain_file(parent, name)
+    if retained is None or current is None:
+        if retained is not current:
+            refuse('Host deployment path changed')
+        return
+    same_inode(retained[0], current[0])
+    if current[1] != retained[1]:
+        refuse('Host deployment file changed')
+
+
+def open_install(plan):
+    # Do not resolve symlinks before checking them. System ancestors may belong
+    # to root; the account home and private deployment tree must belong to uid.
+    home = pwd.getpwuid(os.getuid()).pw_dir
+    if not home.startswith('/') or any(part in ('.', '..') for part in home.split('/')):
+        refuse('Unsafe account home')
+    fd = os.open('/', os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+    checked(fd, True, True)
+    chain = [('/', fd, True)]
+    for part in filter(None, home.split('/')):
+        nxt = directory(fd, part, ancestor=True)
+        chain.append((part, nxt, True))
+        fd = nxt
+    info = os.fstat(fd)
+    if info.st_uid != os.getuid():
+        refuse('Account home is not owned by login user')
+    base = directory(fd, '.rer-host', create=True)
+    chain.append(('.rer-host', base, False))
+    # One host-account lock also serializes creation and binding admission for
+    # cooperating installs. The pathname chain is checked independently of it.
+    file_info(base, 'deploy.lock')
+    lock = os.open('deploy.lock', os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600, dir_fd=base)
+    checked(lock)
+    fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+    created = False
+    try:
+        os.mkdir(plan['name'], 0o700, dir_fd=base)
+        created = True
+    except FileExistsError:
+        pass
+    install = directory(base, plan['name'])
+    chain.append((plan['name'], install, False))
+    if created:
+        exclusive(install, 'owner.json', json.dumps(plan['labels']))
+    if read_json(install, 'owner.json') != plan['labels']:
+        refuse('Installation ownership mismatch')
+    validate_install(chain, lock, plan)
+    return install, lock, home + '/.rer-host/' + plan['name'], chain
+
+
+def validate_install(chain, lock, plan):
+    # A retained dirfd remains usable after rename. Check each original edge
+    # from / as well, so it cannot silently become a detached installation.
+    parent = None
+    for name, fd, ancestor in chain:
+        info = checked(fd, True, ancestor)
+        if parent is not None:
+            linked = metadata(os.stat(name, dir_fd=parent, follow_symlinks=False), True, ancestor)
+            same_inode(info, linked)
+        parent = fd
+    if os.fstat(chain[-3][1]).st_uid != os.getuid():
+        refuse('Account home is not owned by login user')
+    same_inode(checked(lock), file_info(chain[-2][1], 'deploy.lock'))
+    install = chain[-1][1]
+    if read_json(install, 'owner.json') != plan['labels']:
+        refuse('Installation ownership mismatch')
+    validate_tree(install)
+
+
+def validate_tree(install):
+    checked(install, True)
+    for entry in os.listdir(install):
+        if entry in ('owner.json', 'current.json'):
+            file_info(install, entry)
+        elif re.fullmatch(r'current-[0-9a-f]{32}', entry):
+            file_info(install, entry)
+        elif re.fullmatch(r'(generation|stage)-[0-9a-f]{32}', entry):
+            child = directory(install, entry)
+            try:
+                for name in os.listdir(child):
+                    if name not in ('settings.env', 'compose.yaml', 'Caddyfile'):
+                        refuse('Unexpected deployment file')
+                    file_info(child, name)
+            finally:
+                os.close(child)
+        else:
+            refuse('Unexpected installation path')
+
+
+def stage_files(install, files):
+    token = uuid.uuid4().hex
+    stage = 'stage-' + token
+    os.mkdir(stage, 0o700, dir_fd=install)
+    fd = directory(install, stage)
+    try:
+        records = {}
+        for name, contents in files.items():
+            records[name] = (contents, exclusive(fd, name, contents))
+        os.fsync(fd)
+        return stage, 'generation-' + token, fd, records
+    except BaseException:
+        os.close(fd)
+        raise
+
+
+def validate_generation(install, name, fd, records):
+    validate_generation_entries(install, name, fd, {filename: created for filename, (_, created) in records.items()})
+    for filename, (contents, created) in records.items():
+        file = os.open(filename, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=fd)
+        try:
+            same_inode(created, checked(file))
+            with os.fdopen(os.dup(file), 'rb') as stream:
+                if stream.read(len(contents.encode()) + 1) != contents.encode():
+                    refuse('Host deployment file changed')
+        finally:
+            os.close(file)
+
+
+def validate_generation_entries(install, name, fd, entries):
+    same_inode(checked(fd, True), metadata(os.stat(name, dir_fd=install, follow_symlinks=False), True))
+    if set(os.listdir(fd)) != set(entries):
+        refuse('Unexpected deployment file')
+    for filename, created in entries.items():
+        same_inode(created, file_info(fd, filename))
+
+
+def retain_generation(install, name):
+    fd = directory(install, name)
+    try:
+        entries = {}
+        for filename in os.listdir(fd):
+            if filename not in ('settings.env', 'compose.yaml', 'Caddyfile'):
+                refuse('Unexpected deployment file')
+            info = file_info(fd, filename)
+            if info is None:
+                refuse('Host deployment path changed')
+            entries[filename] = info
+        validate_generation_entries(install, name, fd, entries)
+        return fd, entries
+    except BaseException:
+        os.close(fd)
+        raise
+
+
+def publish_generation(install, stage, generation):
+    validate_tree(install)
+    os.rename(stage, generation, src_dir_fd=install, dst_dir_fd=install)
+
+
+def commit_manifest(install, generation, current):
+    # A single atomic commit points to a complete generation; interrupted
+    # transfers cannot make an existing installation run partial configuration.
+    # Only the manifest retained before asynchronous work may be replaced.
+    content = json.dumps({'generation': generation})
+    pending = 'current-' + uuid.uuid4().hex
+    committed = (exclusive(install, pending, content), content.encode())
+    try:
+        same_file(install, pending, committed)
+        same_file(install, 'current.json', current)
+        os.replace(pending, 'current.json', src_dir_fd=install, dst_dir_fd=install)
+        os.fsync(install)
+        same_file(install, 'current.json', committed)
+        return committed
+    finally:
+        remaining = file_info(install, pending)
+        if remaining is not None:
+            same_inode(committed[0], remaining)
+            os.unlink(pending, dir_fd=install)
+
+
+def remove_generation(install, name, fd, entries):
+    # A private path can still have been replaced by the same login UID.
+    # Validate the whole retained generation before removing any member, then
+    # require the captured identity again immediately before each deletion.
+    validate_generation_entries(install, name, fd, entries)
+    for entry, created in entries.items():
+        same_inode(checked(fd, True), metadata(os.stat(name, dir_fd=install, follow_symlinks=False), True))
+        same_inode(created, file_info(fd, entry))
+        os.unlink(entry, dir_fd=fd)
+    same_inode(checked(fd, True), metadata(os.stat(name, dir_fd=install, follow_symlinks=False), True))
+    os.rmdir(name, dir_fd=install)

package/modules/container/remote/resources.py

@@ -0,0 +1,157 @@
+"""Operate only on fresh Docker inventory, never on stored executable config."""
+import subprocess, socket, io, tarfile
+
+
+def docker(*args, input=None):
+    result = subprocess.run(['docker', *args], input=input, capture_output=True, text=not isinstance(input, bytes), timeout=120)
+    if result.returncode:
+        # Docker may echo environment/configuration. Never propagate its output.
+        refuse('Docker host operation failed: ' + args[0])
+    return (result.stdout.decode() if isinstance(result.stdout, bytes) else result.stdout).strip()
+
+
+def inspect(kind, names):
+    return json.loads(docker(kind, 'inspect', *names)) if names else []
+
+
+def labels_for(plan, role):
+    return {**plan['labels'], 'io.runeditrun.role': role}
+
+
+def check_labels(plan, role, actual):
+    if any((actual or {}).get(key) != value for key, value in labels_for(plan, role).items()):
+        refuse('Docker resource ownership mismatch: ' + role)
+
+
+def inventory(plan):
+    resources = {'container': {}, 'volume': {}, 'network': {}}
+    # Inventory every container so foreign mounts, network peers and occupied
+    # bindings are accounted for, even when they carry no RER label at all.
+    containers = inspect('container', docker('container', 'ls', '-aq').split())
+    for item in containers:
+        resources['container'][item['Name'].lstrip('/')] = item
+    for kind in ('volume', 'network'):
+        names = docker(kind, 'ls', '--format', '{{.Name}}').splitlines()
+        for item in inspect(kind, names):
+            resources[kind][item['Name']] = item
+    expected = {'container': ['app', 'caddy'], 'volume': ['data', 'caddy', 'caddy-config'], 'network': ['ingress']}
+    owned = {'container': {}, 'volume': {}, 'network': {}}
+    for kind, objects in resources.items():
+        for name, item in objects.items():
+            labels = item.get('Config', {}).get('Labels') if kind == 'container' else item.get('Labels')
+            matching_name = name in [plan['name'] + '-' + role for role in expected[kind]]
+            matching_owner = (labels or {}).get('io.runeditrun.installation') == plan['labels']['io.runeditrun.installation']
+            # Old compose-labelled extra services can otherwise be selected by
+            # compose down. Refuse these too rather than silently adopting them.
+            matching_compose = (labels or {}).get('com.docker.compose.project') == plan['name']
+            if matching_name or matching_owner or matching_compose:
+                role = name.removeprefix(plan['name'] + '-')
+                if role not in expected[kind] or name != plan['name'] + '-' + role:
+                    refuse('Unexpected Docker installation resource')
+                check_labels(plan, role, labels)
+                owned[kind][role] = item
+                if kind == 'volume' and (item.get('Driver') != 'local' or item.get('Options')):
+                    refuse('Unsafe Docker volume driver/options')
+                if kind == 'network' and (item.get('Driver') != 'bridge' or item.get('Options') or item.get('Internal') or item.get('ConfigOnly')):
+                    refuse('Unsafe Docker ingress network')
+    owned_ids = {item['Id'] for item in owned['container'].values()}
+    for item in containers:
+        if item['Id'] not in owned_ids:
+            if any(mount.get('Name') in {v['Name'] for v in owned['volume'].values()} for mount in item.get('Mounts', [])):
+                refuse('Foreign container uses installation volume')
+    for network in owned['network'].values():
+        if any(key not in owned_ids for key in (network.get('Containers') or {})):
+            refuse('Foreign container uses installation network')
+    return owned, containers
+
+
+def admit_ports(plan, owned, containers):
+    own_ids = {item['Id'] for item in owned['container'].values()}
+    for binding in plan['ports']:
+        address, port, _ = binding.split(':')
+        occupied_by_own = False
+        for item in containers:
+            if not item.get('State', {}).get('Running'):
+                continue
+            for entries in (item.get('NetworkSettings', {}).get('Ports') or {}).values():
+                for entry in entries or []:
+                    overlap = address == '0.0.0.0' or entry['HostIp'] in ('0.0.0.0', '::', address)
+                    if entry['HostPort'] == port and overlap:
+                        if item['Id'] not in own_ids:
+                            refuse('Host ingress binding is already occupied')
+                        occupied_by_own = True
+        if not occupied_by_own:
+            with socket.socket() as listener:
+                try:
+                    listener.bind((address, int(port)))
+                except OSError:
+                    refuse('Host ingress binding is unavailable')
+
+
+def label_args(plan, role):
+    return [arg for key, value in labels_for(plan, role).items() for arg in ('--label', key + '=' + value)]
+
+
+def prepare_resources(plan, owned):
+    # Images and persistent resources must be available before stopping service.
+    app = json.loads(docker('image', 'inspect', plan['digest']))[0]
+    if app['Id'] != plan['digest']:
+        refuse('Application image identity mismatch')
+    caddy = None
+    if not plan['local']:
+        if not docker('image', 'ls', '--quiet', 'caddy:2.10.2'):
+            docker('image', 'pull', 'caddy:2.10.2')
+        caddy = json.loads(docker('image', 'inspect', 'caddy:2.10.2'))[0]['Id']
+    for role in (['data'] if plan['local'] else ['data', 'caddy', 'caddy-config']):
+        if role not in owned['volume']:
+            docker('volume', 'create', *label_args(plan, role), plan['name'] + '-' + role)
+    if 'ingress' not in owned['network']:
+        docker('network', 'create', '--driver', 'bridge', *label_args(plan, 'ingress'), plan['name'] + '-ingress')
+    return caddy
+
+
+def replace_containers(plan, validate, files, caddy):
+    # Configuration is the exact content checked in the owned generation.
+    # Never ask either Docker client or daemon to reopen a host pathname after
+    # shutdown; their filesystem/process namespaces may also be different.
+    archive = io.BytesIO()
+    if caddy:
+        content = files['Caddyfile'].encode()
+        with tarfile.open(fileobj=archive, mode='w') as bundle:
+            entry = tarfile.TarInfo('Caddyfile')
+            entry.size, entry.mode = len(content), 0o600
+            bundle.addfile(entry, io.BytesIO(content))
+    owned, containers = inventory(plan)
+    admit_ports(plan, owned, containers)
+    validate()
+    # Stop by immutable IDs, with fresh labels on each individual operation.
+    # rm never uses -v: persistent data survives replacement and failures.
+    for role, item in owned['container'].items():
+        current = inspect('container', [item['Id']])[0]
+        check_labels(plan, role, current['Config'].get('Labels'))
+        validate()
+        docker('container', 'stop', '--time', '10', item['Id'])
+        check_labels(plan, role, inspect('container', [item['Id']])[0]['Config'].get('Labels'))
+        docker('container', 'rm', item['Id'])
+    common = ['--restart', 'unless-stopped', '--network', plan['name'] + '-ingress']
+    app = ['container', 'create', '--name', plan['name'] + '-app', *label_args(plan, 'app'), *common, '--network-alias', 'app', '--env-file', '/dev/stdin', '--env', 'PORT=8080', '--env', 'RER_IMAGE_DIGEST=' + plan['digest'], '--mount', 'type=volume,source=' + plan['name'] + '-data,target=/data']
+    if plan['local']:
+        for binding in plan['ports']:
+            app.extend(['--publish', binding])
+    else:
+        app.extend(['--env', 'TRUSTED_PROXY=caddy'])
+    app.append(plan['digest'])
+    inventory(plan)
+    app_id = docker(*app, input=files['settings.env'])
+    if caddy:
+        args = ['container', 'create', '--name', plan['name'] + '-caddy', *label_args(plan, 'caddy'), *common, '--network-alias', 'caddy', '--mount', 'type=volume,source=' + plan['name'] + '-caddy,target=/data', '--mount', 'type=volume,source=' + plan['name'] + '-caddy-config,target=/config']
+        for binding in plan['ports']:
+            args.extend(['--publish', binding])
+        args.append(caddy)
+        inventory(plan)
+        caddy_id = docker(*args)
+        check_labels(plan, 'caddy', inspect('container', [caddy_id])[0]['Config'].get('Labels'))
+        docker('container', 'cp', '-', caddy_id + ':/etc/caddy/', input=archive.getvalue())
+        docker('container', 'start', caddy_id)
+    check_labels(plan, 'app', inspect('container', [app_id])[0]['Config'].get('Labels'))
+    docker('container', 'start', app_id)

package/modules/container/runner.mjs

@@ -0,0 +1,10 @@
+import { spawn } from 'node:child_process';
+import { join } from 'node:path';
+export function superviseRunner({ root, manifest, settings, failed }) {
+ if (!manifest.runner) return { running:()=>true, async close(){} };
+ const child=spawn(process.execPath,[join(root,'runner',manifest.runner.entry)],{cwd:join(root,'runner'),env:{...process.env,...settings},stdio:['ignore','ignore','ignore']});
+ let stopping=false;
+ child.once('error',()=>{if(!stopping)failed();});
+ child.once('exit',()=>{if(!stopping)failed();});
+ return { running:()=>child.exitCode===null&&child.signalCode===null, async close(){stopping=true;if(child.exitCode!==null||child.signalCode!==null)return;child.kill('SIGTERM');await new Promise(resolve=>{const timer=setTimeout(()=>child.kill('SIGKILL'),35000);child.once('exit',()=>{clearTimeout(timer);resolve();});});} };
+}

package/modules/container/ssh-plan.mjs

@@ -0,0 +1,44 @@
+import { createHash } from 'node:crypto';
+import { ingressBindings } from '../deploy-kit/container-config.mjs';
+export { ingressBindings } from '../deploy-kit/container-config.mjs';
+
+export function installationIdentity(project, environment = 'production') {
+ if (typeof project !== 'string' || !/^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-]*)*$/.test(project) || project.length > 512 || !/^[a-z][a-z0-9-]{0,39}$/.test(environment)) throw Error('Invalid installation identity');
+ const identity = createHash('sha256').update(JSON.stringify([project, environment])).digest('hex');
+ return { name: `rer-${identity}`, labels: { 'io.runeditrun.managed': 'ssh-v1', 'io.runeditrun.installation': identity, 'io.runeditrun.project': project, 'io.runeditrun.environment': environment } };
+}
+
+
+export function deploymentPlan({ declaration, settings, environment, digest, ingress }) {
+ const { name, labels } = installationIdentity(declaration.project, environment);
+ if (!/^sha256:[a-f0-9]{64}$/.test(digest)) throw Error('Invalid Docker image digest');
+ const origin = settings[declaration.originVar] ?? settings.PUBLIC_ORIGIN;
+ if (!origin) throw Error('Declare the public origin in the private env file');
+ const url = new URL(origin);
+ if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.pathname !== '/' || url.search || url.hash) throw Error('Invalid public origin');
+ const local = /^(localhost|127\.0\.0\.1|\[::1\])$/.test(url.hostname);
+ if (!local && url.protocol !== 'https:') throw Error('Production ingress requires HTTPS');
+ if (local && url.protocol !== 'http:') throw Error('Loopback qualification requires an HTTP origin');
+ const hostnames = [url.hostname];
+ for (const variable of declaration.container?.hostVariables ?? []) {
+  const hostname = settings[variable];
+  if (!hostname || !/^(?=.{1,253}$)[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/i.test(hostname)) throw Error('Invalid declared ingress hostname');
+  if (!hostnames.includes(hostname)) hostnames.push(hostname);
+ }
+ const bindings = ingressBindings({ ...declaration.container?.ingress, ...ingress });
+ const roleLabels = role => ({ ...labels, 'io.runeditrun.role': role });
+ const volume = role => ({ name: `${name}-${role}`, labels: roleLabels(role) });
+ const ports = local ? [`127.0.0.1:${url.port || 80}:8080`] : [`${bindings.address}:${bindings.httpPort}:80`, `${bindings.address}:${bindings.httpsPort}:443`];
+ const compose = { name, services: { app: { image: digest, container_name: `${name}-app`, labels: roleLabels('app'), restart: 'unless-stopped', environment: { RER_IMAGE_DIGEST: digest, PORT: '8080', ...(local ? {} : { TRUSTED_PROXY: 'caddy' }) }, env_file: [{ path: 'settings.env', format: 'raw' }], volumes: ['data:/data'], networks: ['ingress'], ...(local ? { ports } : {}) } }, volumes: { data: volume('data') }, networks: { ingress: { name: `${name}-ingress`, labels: roleLabels('ingress') } } };
+ if (!local) {
+  compose.services.caddy = { image: 'caddy:2.10.2', container_name: `${name}-caddy`, labels: roleLabels('caddy'), restart: 'unless-stopped', ports, configs: [{ source: 'caddy', target: '/etc/caddy/Caddyfile' }], volumes: ['caddy:/data', 'caddy-config:/config'], networks: ['ingress'] };
+  compose.volumes.caddy = volume('caddy'); compose.volumes['caddy-config'] = volume('caddy-config');
+ }
+ // Listener ports are internal. A TCP/SNI proxy must preserve the public
+ // authority and route ACME HTTP/TLS challenges to these private bindings.
+ const sites = hostnames.map(hostname => `https://${hostname}`).join(', ');
+ const redirects = hostnames.map(hostname => `http://${hostname} {\n redir https://${hostname}${url.port ? ':' + url.port : ''}{uri} permanent\n}`).join('\n');
+ const caddyfile = `{\n auto_https disable_redirects\n}\n${sites} {\n reverse_proxy app:8080\n}\n${redirects}\n`;
+ if (!local) compose.configs = { caddy: { content: caddyfile } };
+ return { name, labels, origin, digest, local, ports, compose, caddyfile };
+}

package/modules/container/ssh.mjs

@@ -0,0 +1,63 @@
+import { spawn, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { deploymentPlan } from './ssh-plan.mjs';
+import { deployInputs } from './deploy-input.mjs';
+const execute=promisify(execFile);
+export const quote=value=>"'"+String(value).replaceAll("'","'\\''")+"'";
+export function sshTarget(value){
+ let url;try{url=new URL(value);}catch{throw new Error('Host must be ssh://user@host[:port]');}
+ if(url.protocol!=='ssh:'||url.password||url.search||url.hash||!['','/'].includes(url.pathname)||!url.username||!/^[a-zA-Z0-9_.-]+$/.test(url.username)||!/^([a-zA-Z0-9.-]+|\[[0-9a-fA-F:]+\])$/.test(url.hostname))throw new Error('Invalid ssh host');
+ const args=['-o','BatchMode=yes','-o','StrictHostKeyChecking=yes'];
+ if(process.env.RER_SSH_IDENTITY)args.push('-i',resolve(process.env.RER_SSH_IDENTITY));
+ if(process.env.RER_SSH_KNOWN_HOSTS)args.push('-o','UserKnownHostsFile='+resolve(process.env.RER_SSH_KNOWN_HOSTS));
+ if(url.port)args.push('-p',url.port);args.push(url.username+'@'+url.hostname.replace(/^\[|\]$/g,''));return args;
+}
+export async function deploySSH({root,host,image,envFile,environment='production',localOnlyKeys=[],dryRun=false,ingress}) {
+ const ssh=sshTarget(host),{declaration,settings,encoded}=await deployInputs({root,envFile,localOnlyKeys});
+ const {stdout:digestText}=await execute('docker',['image','inspect','--format','{{.Id}}',image]);
+ const plan=deploymentPlan({declaration,settings,environment,digest:digestText.trim(),ingress});
+ const directory=join(root,'.rer/container/deploy');await mkdir(directory,{recursive:true,mode:0o700});
+ await writeFile(join(directory,'compose.yaml'),JSON.stringify(plan.compose,null,2)+'\n',{mode:0o600});
+ await writeFile(join(directory,'Caddyfile'),plan.caddyfile,{mode:0o600});
+ if(dryRun)return{dryRun:true,deployed:false,origin:plan.origin,installation:'.rer-host/'+plan.name,compose:join(directory,'compose.yaml')};
+ // The code is transferred from this installation's maintained CLI. No remote
+ // Python, shell or compose file is ever imported or executed from disk.
+ const source=(await Promise.all(['files','resources','deploy'].map(name=>readFile(new URL('./remote/'+name+'.py',import.meta.url),'utf8')))).join('\n');
+ const command='python3 -I -c '+quote(source);
+ const remote=async payload=>{
+  const child=spawn('ssh',[...ssh,command],{stdio:['pipe','pipe','pipe']});
+  const result=completed(child,true);child.stdin.on('error',()=>{});child.stdin.end(JSON.stringify(payload));return result;
+ };
+ // This also proves Python and Docker availability, filesystem custody and
+ // existing resource ownership before loading an image or sending secrets.
+ await remote({plan,phase:'check'});
+ const load=spawn('ssh',[...ssh,'docker load'],{stdio:['pipe','pipe','pipe']}),save=spawn('docker',['save',plan.digest],{stdio:['ignore','pipe','pipe']});
+ load.stdin.on('error',()=>{});save.stdout.pipe(load.stdin);
+ try{await Promise.all([completed(save),completed(load)]);}finally{if(save.exitCode===null)save.kill('SIGTERM');if(load.exitCode===null)load.kill('SIGTERM');}
+ const result=JSON.parse(await remote({plan,files:{'settings.env':encoded,'compose.yaml':JSON.stringify(plan.compose,null,2)+'\n','Caddyfile':plan.caddyfile}}));
+ const end=Date.now()+60000;
+ while(Date.now()<end){
+  try{const response=await fetch(plan.origin+'/health',{signal:AbortSignal.timeout(3000)});if(response.ok){const health=await response.json();if(health.platform==='container'&&health.deployment?.versionId===plan.digest)return{deployed:true,origin:plan.origin,imageDigest:plan.digest,...result};}}catch{}
+  await new Promise(resolve=>setTimeout(resolve,250));
+ }
+ throw new Error('Container public health did not become ready; inspect host logs');
+}
+
+const hostRefusals=new Set(['Unsafe host path ownership, permissions or type','Unsafe account home','Account home is not owned by login user','Host deployment path changed','Host deployment file changed','Installation ownership mismatch','Unexpected deployment file','Unexpected installation path','Unexpected Docker installation resource','Unsafe Docker volume driver/options','Unsafe Docker ingress network','Foreign container uses installation volume','Foreign container uses installation network','Host ingress binding is already occupied','Host ingress binding is unavailable','Application image identity mismatch','Host deployment refused: unsafe path or failed operation']);
+function hostFailure(stderr){
+ const reason=stderr.trim();
+ const message=hostRefusals.has(reason)||/^Docker resource ownership mismatch: (app|caddy|caddy-config|data|ingress)$/.test(reason)||/^Docker host operation failed: (image|volume|network|container)$/.test(reason)?reason:'SSH host operation failed';
+ return Object.assign(Error(message),{code:'SSH_HOST_REFUSAL'});
+}
+function completed(child, capture=false) {
+ return new Promise((resolve,reject)=>{
+  let stdout='',stderr='';
+  const timer=setTimeout(()=>{child.kill('SIGTERM');reject(Error('Host operation timed out'));},120000);
+  child.stdout?.on('data',chunk=>{if(capture&&stdout.length<1024*1024)stdout+=chunk;});
+  child.stderr?.on('data',chunk=>{if(capture&&stderr.length<2048)stderr+=chunk;});
+  child.once('error',()=>{clearTimeout(timer);reject(Error('Host operation failed'));});
+  child.once('close',code=>{clearTimeout(timer);code===0?resolve(stdout):reject(capture?hostFailure(stderr):Error('Host operation failed'));});
+ });
+}

package/modules/container/transfer.mjs

@@ -0,0 +1,27 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { D1 } from './adapters/d1.mjs';
+import { Objects } from './adapters/objects.mjs';
+import { ensurePortabilitySchema } from './portability-schema.mjs';
+import { migrate } from './migrations.mjs';
+import { createPortability } from '../portability/index.mjs';
+import { migrationReplay } from '../portability/migration-history.mjs';
+import { exportArchive, importArchive } from '../portability/files.mjs';
+let db,platform,worker;
+try {
+ const spec=JSON.parse(await readFile('/private/transfer.json','utf8')),manifest=JSON.parse(await readFile('/app/container.json','utf8'));
+ const buckets={};
+ if(manifest.engine==='node'){
+  db=new D1('/data/'+spec.binding+'.sqlite');await migrate(db,manifest.migrations[spec.binding]);await ensurePortabilitySchema(db,manifest.portabilityMigrations);
+  platform=new DatabaseSync('/data/platform.sqlite');
+  for(const [name,binding]of Object.entries(spec.buckets))buckets[name]=new Objects(platform,'/data/objects',binding);
+ }else{
+  const {workerEngine}=await import('./worker-engine.mjs');worker=await workerEngine({root:'/app',data:'/data',manifest,settings:{}});db=worker.databases[spec.binding];
+  for(const [name,binding]of Object.entries(spec.buckets))buckets[name]=worker.objects[binding];
+ }
+ const service=await createPortability({db,buckets,policy:spec.policy,migrations:async()=>migrationReplay(manifest.migrations[spec.binding],spec.policy)});
+ const receipt=await(spec.direction==='export'?exportArchive:importArchive)(service,'/archive/'+spec.file,spec.transient,spec.journal);
+ console.log(JSON.stringify(receipt));
+}catch(cause){console.error('Container transfer refused or failed:',cause.name);process.exitCode=1;}
+finally{await worker?.close();await db?.close?.();platform?.close();}

package/modules/container/worker-engine.mjs

@@ -0,0 +1,32 @@
+import { Miniflare, convertV4MiniflareOptions } from 'miniflare';
+import { readdir } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+import { rootCertificates } from 'node:tls';
+import { ensurePortabilitySchema } from './portability-schema.mjs';
+import { migrate } from './migrations.mjs';
+async function files(root) { const result = []; for (const item of await readdir(root, { withFileTypes: true })) { const path = join(root, item.name); if (item.isDirectory()) result.push(...await files(path)); else if (/\.(m?js)$/.test(item.name)) result.push(path); } return result; }
+export async function workerEngine({ root, data, manifest, settings, edge }) {
+ const config = manifest.config, directory = join(root, 'dist/server'), entry = join(root, manifest.entry);
+ const modules = [entry, ...(await files(directory)).filter(path => path !== entry)].map(path => ({ type: 'ESModule', path }));
+ const app = { name:'app', modules, modulesRoot:directory, compatibilityDate:config.compatibility_date, compatibilityFlags:config.compatibility_flags,
+  bindings:{ ...config.vars, ...settings }, d1Databases:Object.fromEntries((config.d1_databases ?? []).map(item => [item.binding, item.database_name])),
+  r2Buckets:Object.fromEntries((config.r2_buckets ?? []).map(item => [item.binding, item.bucket_name])),
+  durableObjects:Object.fromEntries((config.durable_objects?.bindings ?? []).map(item => [item.name, { className:item.class_name, useSQLite:true }])),
+  queueProducers:Object.fromEntries((config.queues?.producers ?? []).map(item => [item.binding, item.queue])),
+  queueConsumers:Object.fromEntries((config.queues?.consumers ?? []).map(item => [item.queue, { maxBatchSize:item.max_batch_size, maxRetries:item.max_retries }])),
+  assets:{ directory:join(root, 'dist/client'), binding:config.assets?.binding ?? 'ASSETS', routerConfig:{ has_user_worker:true }, run_worker_first:config.assets?.run_worker_first ?? false },
+  outboundService: edge ? request => edge(request, request => mf.getWorker('egress').then(worker => worker.fetch(request))) : 'egress',
+ };
+ const mf = new Miniflare(convertV4MiniflareOptions({ host:'127.0.0.1',port:0,cf:false,resourcePersistencePath:data,unsafeLocalExplorer:false,
+  workers:[{ name:'ingress',modules:true,script:`export default {fetch(request,env){const observed=request.headers.get('x-rer-original-url');if(!observed)return new Response(null,{status:400});const url=new URL(observed),headers=new Headers(request.headers);headers.delete('x-rer-original-url');headers.set('host',url.host);return env.APP.fetch(new Request(url,{method:request.method,headers,redirect:'manual',...(!['GET','HEAD'].includes(request.method)?{body:request.body}:{})}))}}`,serviceBindings:{ APP:'app' } }, app,
+   { name:'egress',modules:true,script:'export default {fetch(request,env){return env.NETWORK.fetch(request)}}',serviceBindings:{ NETWORK:{ network:{ allow:['public'],tlsOptions:{ trustBrowserCas:true,trustedCertificates:[...rootCertificates] } } } } }],
+ }));
+ await mf.ready; const databases = {}, objects = {};
+ for (const [binding, plan] of Object.entries(manifest.migrations)) { const db = await mf.getD1Database(binding, 'app'); databases[binding] = db; await migrate(db, plan); await ensurePortabilitySchema(db, manifest.portabilityMigrations); }
+ for (const bucket of config.r2_buckets ?? []) objects[bucket.binding] = await mf.getR2Bucket(bucket.binding, 'app');
+ const worker = await mf.getWorker('app');
+ return { mf, databases, objects, app:worker,
+  fetch(request) { const headers = new Headers(request.headers); headers.set('x-rer-original-url', request.url); return mf.dispatchFetch(request.url, { method:request.method,headers,body:request.body,duplex:'half',redirect:'manual' }); },
+  scheduled:event => worker.scheduled(event), async drain() {}, dead:() => 0, close:() => mf.dispose(),
+ };
+}