alasio 4.0.0

package/dist/cli/src/cluster/docker.js

@@ -0,0 +1,219 @@
+/**
+ * Docker's Engine API, over the Unix socket Docker listens on: as much of it as the local
+ * cluster (./local.ts) needs, its images, network, volumes and containers and commands
+ * run in them, called with node:http, so neither the Docker CLI nor a client library is
+ * needed. Paths are those of API version 1.44 (Docker 25), the oldest it is written for.
+ *
+ * The socket is the one `DOCKER_HOST` names (`unix://PATH`), /var/run/docker.sock when
+ * it names none.
+ */
+import { request as httpRequest, STATUS_CODES } from "node:http";
+import { buffer } from "node:stream/consumers";
+import { Context, Effect, Layer, Result, Schema } from "effect";
+const API_VERSION = "v1.44";
+const DEFAULT_SOCKET = "/var/run/docker.sock";
+/** Docker refused a call, or could not be reached: the status it answered with, when it answered. */
+export class DockerError extends Schema.TaggedError()("DockerError", {
+    /** The call, as its method and path. */
+    call: Schema.String,
+    /** Docker's HTTP status (404 for absent, 409 for a conflict), when it answered. */
+    status: Schema.optional(Schema.Number),
+    /** What Docker answered, or why it could not be reached. */
+    reason: Schema.String,
+}) {
+    get message() {
+        return `Docker ${this.status === undefined ? "failed" : `answered ${this.status} to`} ${this.call}: ${this.reason}`;
+    }
+}
+/** `DOCKER_HOST` names a Docker that is not reached over a Unix socket. */
+export class DockerHostUnsupported extends Schema.TaggedError()("DockerHostUnsupported", {
+    host: Schema.String,
+}) {
+    get message() {
+        return `DOCKER_HOST is ${this.host}, but alasio reaches Docker only over a Unix socket (unix://PATH)`;
+    }
+}
+/** Whether `error` is Docker's answer `status`. */
+export const hasStatus = (status) => (error) => error.status === status;
+/** The socket of the Docker `env` names, by `DOCKER_HOST`. */
+export function dockerSocket(env) {
+    const host = env["DOCKER_HOST"];
+    if (!host)
+        return Result.succeed(DEFAULT_SOCKET);
+    if (host.startsWith("unix://"))
+        return Result.succeed(host.slice("unix://".length));
+    return Result.fail(new DockerHostUnsupported({ host }));
+}
+/** Docker's Engine API, as the local cluster calls it. Objects are addressed by name. */
+export class DockerEngine extends Context.Service()("alasio/cluster/DockerEngine") {
+    /** The Docker `env` names (dockerSocket). */
+    static layer = (env = process.env) => Layer.effect(DockerEngine, Effect.map(Effect.fromResult(dockerSocket(env)), makeDockerEngine));
+}
+const describe = (call) => `${call.method} ${call.path}`;
+const unreachable = (call, cause) => new DockerError({ call: describe(call), reason: cause instanceof Error ? cause.message : String(cause) });
+/** A label filter of a list call, in the JSON Docker's `filters` parameter takes. */
+const labelFilter = (labels) => JSON.stringify({ label: Object.entries(labels).map(([key, value]) => `${key}=${value}`) });
+/** The content of the first regular file in `tar`, a tar archive as Docker's archive endpoint sends one; null when it holds none. */
+export function firstFile(tar) {
+    const BLOCK = 512;
+    for (let offset = 0; offset + BLOCK <= tar.length;) {
+        const header = tar.subarray(offset, offset + BLOCK);
+        // Two zero blocks end an archive.
+        if (header.every((byte) => byte === 0))
+            return null;
+        const size = Number.parseInt(header.toString("latin1", 124, 136).replace(/\0.*$/su, "").trim() || "0", 8);
+        const type = header[156];
+        const start = offset + BLOCK;
+        // "0", or NUL in archives older than POSIX's.
+        if (type === 0x30 || type === 0)
+            return tar.subarray(start, start + size);
+        offset = start + Math.ceil(size / BLOCK) * BLOCK;
+    }
+    return null;
+}
+/**
+ * The output of a command whose exec ran without a terminal: Docker sends it in frames of
+ * an 8-byte header (the stream, 1 for stdout or 2 for stderr, and the size, big-endian, at
+ * byte 4) and what was written.
+ */
+export function demultiplex(raw) {
+    const stdout = [];
+    const stderr = [];
+    for (let offset = 0; offset + 8 <= raw.length;) {
+        const size = raw.readUInt32BE(offset + 4);
+        const payload = raw.subarray(offset + 8, offset + 8 + size);
+        (raw[offset] === 2 ? stderr : stdout).push(payload);
+        offset += 8 + size;
+    }
+    return { stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr) };
+}
+/** The Engine API on the Unix socket `socketPath`. */
+function makeDockerEngine(socketPath) {
+    const send = (call, headers = {}) => {
+        const query = new URLSearchParams();
+        for (const [key, value] of Object.entries(call.query ?? {})) {
+            for (const each of typeof value === "string" ? [value] : value)
+                query.append(key, each);
+        }
+        const body = call.body === undefined ? undefined : JSON.stringify(call.body);
+        const request = httpRequest({
+            socketPath,
+            method: call.method,
+            path: `/${API_VERSION}${call.path}${query.size ? `?${query}` : ""}`,
+            headers: body === undefined ? headers : { ...headers, "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
+        });
+        request.end(body);
+        return request;
+    };
+    const readAll = (call, stream) => Effect.tryPromise({ try: () => buffer(stream), catch: (cause) => unreachable(call, cause) });
+    /** Docker's refusal of `call`: the status of `response`, and the message its body holds. */
+    const refusal = (call, response) => readAll(call, response).pipe(Effect.flatMap((body) => {
+        const status = response.statusCode ?? 0;
+        const text = body.toString("utf8").trim();
+        let reason = text || STATUS_CODES[status] || "no message";
+        try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed === "object" && parsed !== null && "message" in parsed && typeof parsed.message === "string")
+                reason = parsed.message;
+        }
+        catch {
+            // Not JSON: the text is the message.
+        }
+        return Effect.fail(new DockerError({ call: describe(call), status, reason }));
+    }));
+    /** The response to `call`, open while the scope is; a status of 400 or over is its refusal (304, already so, is not). */
+    const open = (call) => Effect.acquireRelease(Effect.callback((resume) => {
+        const request = send(call);
+        request.on("response", (response) => resume(Effect.succeed(response)));
+        request.on("error", (cause) => resume(Effect.fail(unreachable(call, cause))));
+        return Effect.sync(() => request.destroy());
+    }), (response) => Effect.sync(() => response.destroy())).pipe(Effect.tap((response) => ((response.statusCode ?? 0) >= 400 ? refusal(call, response) : Effect.void)));
+    const body = (call) => Effect.scoped(Effect.flatMap(open(call), (response) => readAll(call, response)));
+    /** The JSON Docker answers `call` with, as the Engine API documents it. */
+    const json = (call) => Effect.map(body(call), (content) => JSON.parse(content.toString("utf8")));
+    const orNull = (effect) => effect.pipe(Effect.catchIf(hasStatus(404), () => Effect.succeed(null)));
+    const orGone = (effect) => effect.pipe(Effect.asVoid, Effect.catchIf(hasStatus(404), () => Effect.void));
+    const name = (value) => encodeURIComponent(value);
+    /**
+     * Starts exec `id` attached, `stdin` written to it and then closed, and collects what it
+     * writes until it ends. Docker upgrades the connection to a raw stream for this.
+     */
+    const attach = (id, stdin) => {
+        const call = { method: "POST", path: `/exec/${id}/start`, body: { Detach: false, Tty: false } };
+        return Effect.callback((resume) => {
+            const request = send(call, { Connection: "Upgrade", Upgrade: "tcp" });
+            let stream = null;
+            request.on("upgrade", (_response, socket, head) => {
+                stream = socket;
+                const chunks = [head];
+                socket.on("data", (chunk) => chunks.push(chunk));
+                socket.on("error", (cause) => resume(Effect.fail(unreachable(call, cause))));
+                socket.on("close", () => resume(Effect.succeed(Buffer.concat(chunks))));
+                if (stdin !== undefined)
+                    socket.end(stdin);
+            });
+            // A daemon that answers without upgrading refused.
+            request.on("response", (response) => resume(refusal(call, response)));
+            request.on("error", (cause) => resume(Effect.fail(unreachable(call, cause))));
+            return Effect.sync(() => {
+                request.destroy();
+                stream?.destroy();
+            });
+        });
+    };
+    const exec = Effect.fnUntraced(function* (container, command, { stdin } = {}) {
+        const { Id: id } = yield* json({
+            method: "POST",
+            path: `/containers/${name(container)}/exec`,
+            body: { AttachStdin: stdin !== undefined, AttachStdout: true, AttachStderr: true, Tty: false, Cmd: command },
+        });
+        const { stdout, stderr } = demultiplex(yield* attach(id, stdin));
+        // Docker records the exit code before it closes the exec's streams.
+        const inspect = { method: "GET", path: `/exec/${id}/json` };
+        const { ExitCode: exitCode } = yield* json(inspect);
+        if (exitCode === null)
+            return yield* new DockerError({ call: describe(inspect), reason: `${JSON.stringify(command[0])} has no exit code` });
+        return { exitCode, stdout, stderr: stderr.toString("utf8") };
+    });
+    const pullImage = Effect.fnUntraced(function* (reference) {
+        const call = { method: "POST", path: "/images/create", query: { fromImage: reference } };
+        // A pull that fails once it has begun still answers 200: its progress, one JSON object
+        // a line, ends with the error.
+        const progress = (yield* body(call)).toString("utf8").split("\n").filter((line) => line.trim());
+        for (const line of progress) {
+            const { error } = JSON.parse(line);
+            if (error)
+                return yield* new DockerError({ call: describe(call), reason: error });
+        }
+    });
+    const readFile = Effect.fnUntraced(function* (container, path) {
+        const call = { method: "GET", path: `/containers/${name(container)}/archive`, query: { path } };
+        const file = firstFile(yield* body(call));
+        if (!file)
+            return yield* new DockerError({ call: describe(call), reason: `${path} in ${container} is not a file` });
+        return file;
+    });
+    return DockerEngine.of({
+        version: json({ method: "GET", path: "/version" }),
+        // A reference as it is: the route takes its slashes and colons.
+        inspectImage: (reference) => orNull(json({ method: "GET", path: `/images/${reference}/json` })),
+        pullImage,
+        inspectNetwork: (network) => orNull(json({ method: "GET", path: `/networks/${name(network)}` })),
+        listNetworks: json({ method: "GET", path: "/networks" }),
+        createNetwork: (network) => Effect.asVoid(body({ method: "POST", path: "/networks/create", body: network })),
+        removeNetwork: (network) => orGone(body({ method: "DELETE", path: `/networks/${name(network)}` })),
+        disconnectNetwork: (network, container) => Effect.asVoid(body({ method: "POST", path: `/networks/${name(network)}/disconnect`, body: { Container: container, Force: true } })),
+        createVolume: (volume) => Effect.asVoid(body({ method: "POST", path: "/volumes/create", body: volume })),
+        listVolumes: (labels) => json({ method: "GET", path: "/volumes", query: { filters: labelFilter(labels) } }).pipe(Effect.map(({ Volumes }) => Volumes ?? [])),
+        removeVolume: (volume) => orGone(body({ method: "DELETE", path: `/volumes/${name(volume)}` })),
+        listContainers: (labels) => json({ method: "GET", path: "/containers/json", query: { all: "true", filters: labelFilter(labels) } }),
+        inspectContainer: (container) => orNull(json({ method: "GET", path: `/containers/${name(container)}/json` })),
+        createContainer: (container, spec) => Effect.asVoid(body({ method: "POST", path: "/containers/create", query: { name: container }, body: spec })),
+        startContainer: (container) => Effect.asVoid(body({ method: "POST", path: `/containers/${name(container)}/start` })),
+        stopContainer: (container) => Effect.asVoid(body({ method: "POST", path: `/containers/${name(container)}/stop` })),
+        removeContainer: (container) => orGone(body({ method: "DELETE", path: `/containers/${name(container)}`, query: { force: "true" } })),
+        exec,
+        readFile,
+    });
+}
+//# sourceMappingURL=docker.js.map

package/dist/cli/src/cluster/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../../../src/cluster/docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAA4C,OAAO,IAAI,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE3G,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAE5E,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,qGAAqG;AACrG,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAAC,aAAa,EAAE;IAChF,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC;IACA,IAAa,OAAO;QAClB,OAAO,UAAU,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;IACtH,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CAAC,uBAAuB,EAAE;IAC9G,IAAI,EAAE,MAAM,CAAC,MAAM;CACpB,CAAC;IACA,IAAa,OAAO;QAClB,OAAO,kBAAkB,IAAI,CAAC,IAAI,mEAAmE,CAAC;IACxG,CAAC;CACF;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,KAAkB,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;AAEtG,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,GAAgC;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAgGD,yFAAyF;AACzF,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAyC7C,CAAC,6BAA6B,CAAC;IACjC,6CAA6C;IAC7C,MAAM,CAAU,KAAK,GAAG,CAAC,GAAG,GAAgC,OAAO,CAAC,GAAG,EAAoD,EAAE,CAC3H,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;CAClG;AAUD,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;AAE7E,MAAM,WAAW,GAAG,CAAC,IAAgB,EAAE,KAAc,EAAe,EAAE,CACpE,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE5G,qFAAqF;AACrF,MAAM,WAAW,GAAG,CAAC,MAAwC,EAAU,EAAE,CACvE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAE7F,qIAAqI;AACrI,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC;IAClB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QACnD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QACpD,kCAAkC;QAClC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;QAC7B,8CAA8C;QAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;QAC1E,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,sDAAsD;AACtD,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,MAAM,IAAI,GAAG,CAAC,IAAgB,EAAE,OAAO,GAAqC,EAAE,EAAiB,EAAE;QAC/F,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;gBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,WAAW,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACnE,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;SACtI,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAE,MAAgB,EAAsC,EAAE,CACzF,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAE/F,4FAA4F;IAC5F,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAE,QAAyB,EAAqC,EAAE,CACjG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,MAAM,GAAG,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;QAC1I,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CACH,CAAC;IAEJ,yHAAyH;IACzH,MAAM,IAAI,GAAG,CAAC,IAAgB,EAA4D,EAAE,CAC1F,MAAM,CAAC,cAAc,CACnB,MAAM,CAAC,QAAQ,CAA+B,CAAC,MAAM,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,EACF,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CACpD,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEhH,MAAM,IAAI,GAAG,CAAC,IAAgB,EAAsC,EAAE,CACpE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEnF,2EAA2E;IAC3E,MAAM,IAAI,GAAG,CAAI,IAAgB,EAAiC,EAAE,CAClE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAG,CAAI,MAAqC,EAAwC,EAAE,CAChG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,CAAC,MAA2C,EAAoC,EAAE,CAC/F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhF,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAElE;;;OAGG;IACH,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAA2B,EAAsC,EAAE;QAC7F,MAAM,IAAI,GAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5G,OAAO,MAAM,CAAC,QAAQ,CAAsB,CAAC,MAAM,EAAE,EAAE;YACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBAChD,MAAM,GAAG,MAAM,CAAC;gBAChB,MAAM,MAAM,GAAa,CAAC,IAAI,CAAC,CAAC;gBAChC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxE,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;YACH,mDAAmD;YACnD,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACtB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACtC,SAAiB,EACjB,OAA0B,EAC1B,EAAE,KAAK,EAAE,GAAgB,EAAE;QAE3B,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAA0B;YACtD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO;YAC3C,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,KAAK,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;SAC7G,CAAC,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACjE,oEAAoE;QACpE,MAAM,OAAO,GAAe,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACxE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAuC,OAAO,CAAC,CAAC;QAC1F,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAC5I,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAC,SAAiB;QAC7D,MAAM,IAAI,GAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC;QACrG,uFAAuF;QACvF,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgC,CAAC;YAClE,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAC,SAAiB,EAAE,IAAY;QAC1E,MAAM,IAAI,GAAe,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5G,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,OAAO,SAAS,gBAAgB,EAAE,CAAC,CAAC;QACpH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClD,gEAAgE;QAChE,YAAY,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,SAAS,OAAO,EAAE,CAAC,CAAC;QAC/F,SAAS;QACT,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAChG,YAAY,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxD,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5G,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClG,iBAAiB,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACrI,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACtB,IAAI,CAAiD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CACrI,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAC3C;QACH,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACnI,gBAAgB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7G,eAAe,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjJ,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpH,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAClH,eAAe,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpI,IAAI;QACJ,QAAQ;KACT,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/src/cluster/local.js

@@ -0,0 +1,392 @@
+/**
+ * The local cluster: k3s in Docker, made through Docker's Engine API (./docker.ts) from
+ * alasio's node image (cluster/node), which is k3s with gVisor registered as containerd's
+ * `runsc` runtime and an entrypoint that readies its container for k3s.
+ *
+ * A cluster NAME is a bridge network NAME, a server container NAME-server-0 and agent
+ * containers NAME-agent-I, each with named volumes for what k3s, kubelet and the CNI
+ * keep (NAME-server-0-k3s and so on), so a node made anew, as when its image or settings
+ * change, keeps its state. All of it is labelled as the cluster's, and nothing that is
+ * not is changed. The nodes have fixed addresses in the network's subnet: the server the
+ * second, after the gateway, and the agents those after it. Docker gives fixed addresses
+ * only in a subnet chosen for the network, so one is chosen when none is given: the first
+ * 172.30.N.0/24 no other network overlaps.
+ *
+ * The registries the nodes pull from are k3s's registries.yaml, which the node image's
+ * entrypoint writes from the variable each node is made with, so a node is made anew when
+ * they change, as when its other settings do.
+ *
+ * The API server is published on the loopback only. What is done in the cluster itself,
+ * waiting for it and configuring it, is done with the kubectl k3s carries in the server
+ * node, so this machine needs none of Kubernetes' tools.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+import { KubeConfig } from "@kubernetes/client-node";
+import { Context, Duration, Effect, FileSystem, Layer, Schedule, Schema } from "effect";
+import { imageReference } from "../images.js";
+import { NODE_IMAGE } from "../release.js";
+import { DockerEngine } from "./docker.js";
+/** The cluster cannot be made as asked: something of its name is not its own, or its settings cannot hold. */
+export class ClusterUnusable extends Schema.TaggedError()("ClusterUnusable", {
+    cluster: Schema.String,
+    reason: Schema.String,
+}) {
+    get message() {
+        return `cluster ${this.cluster} cannot be made: ${this.reason}`;
+    }
+}
+/** The cluster did not come up in time: what it was waited for, and why it last was not. */
+export class ClusterNotReady extends Schema.TaggedError()("ClusterNotReady", {
+    cluster: Schema.String,
+    waitingFor: Schema.String,
+    /** How long it was given, in seconds. */
+    within: Schema.Number,
+    reason: Schema.String,
+}) {
+    get message() {
+        return `cluster ${this.cluster} was not ready within ${this.within}s, waiting for ${this.waitingFor}: ${this.reason}`;
+    }
+}
+/** What a wait for the cluster has not seen yet; the wait's ClusterNotReady says it when it gives up. */
+class NotYet extends Schema.TaggedError()("NotYet", {
+    message: Schema.String,
+}) {
+}
+/** A command run in a node exited with another code than 0. */
+export class NodeCommandFailed extends Schema.TaggedError()("NodeCommandFailed", {
+    node: Schema.String,
+    command: Schema.String,
+    exitCode: Schema.Number,
+    stderr: Schema.String,
+}) {
+    get message() {
+        return `${this.command} in ${this.node} exited with ${this.exitCode}${this.stderr.trim() ? `: ${this.stderr.trim()}` : ""}`;
+    }
+}
+/** The local cluster of the options its layer was given. */
+export class LocalCluster extends Context.Service()("alasio/cluster/LocalCluster") {
+    static layer = (options) => Layer.effect(LocalCluster, makeLocalCluster(options));
+}
+const CLUSTER_LABEL = "alasio.cluster";
+const ROLE_LABEL = "alasio.role";
+/** The label of a node's container that says what it was made from: specHash's. */
+const SPEC_LABEL = "alasio.spec";
+/** What a node keeps, each in a volume of its own: the volume's suffix, and where it is mounted. */
+const NODE_VOLUMES = [
+    ["k3s", "/var/lib/rancher/k3s"],
+    ["kubelet", "/var/lib/kubelet"],
+    ["cni", "/var/lib/cni"],
+    ["log", "/var/log"],
+];
+/** The API server's port in the server node. */
+const K3S_PORT = 6443;
+const API_PORT = `${K3S_PORT}/tcp`;
+const K3S_KUBECONFIG = "/etc/rancher/k3s/k3s.yaml";
+/** The token the server made on its first start, which agents join with. */
+const K3S_TOKEN = "/var/lib/rancher/k3s/server/token";
+/** The variable the node image's entrypoint writes k3s's registries.yaml from, before k3s starts. */
+const REGISTRIES_ENV = "ALASIO_REGISTRIES";
+/**
+ * kubelet's thresholds for a machine whose disk the cluster shares with everything else
+ * on it: it evicts only when the disk is nearly full, and collects unused images only then,
+ * so images in use are not evicted.
+ */
+const KUBELET_ARGS = [
+    "--kubelet-arg=eviction-hard=imagefs.available<5%,nodefs.available<5%",
+    "--kubelet-arg=eviction-minimum-reclaim=imagefs.available=1%,nodefs.available=1%",
+    "--kubelet-arg=image-gc-high-threshold=98",
+    "--kubelet-arg=image-gc-low-threshold=95",
+];
+/** gVisor, as the node image registers it with containerd. */
+const GVISOR_RUNTIME_CLASS = { apiVersion: "node.k8s.io/v1", kind: "RuntimeClass", metadata: { name: "gvisor" }, handler: "runsc" };
+// A first start pulls k3s's own images, so it is given minutes.
+const READY_TIMEOUT = "5 minutes";
+const POLL = "1 second";
+/** The `index`th address of the IPv4 subnet `cidr` (a.b.c.d/n), its network address the 0th; null when it has no such host address. */
+export function subnetAddress(cidr, index) {
+    const match = /^(\d+)\.(\d+)\.(\d+)\.(\d+)\/(\d+)$/u.exec(cidr);
+    if (!match)
+        return null;
+    const octets = match.slice(1, 5).map(Number);
+    const prefix = Number(match[5]);
+    if (octets.some((octet) => octet > 255) || prefix > 30)
+        return null;
+    // The last address is the subnet's broadcast address.
+    if (index < 1 || index >= 2 ** (32 - prefix) - 1)
+        return null;
+    const network = octets.reduce((value, octet) => value * 256 + octet, 0);
+    const address = network - (network % 2 ** (32 - prefix)) + index;
+    return [24, 16, 8, 0].map((shift) => Math.floor(address / 2 ** shift) % 256).join(".");
+}
+/** The first and last addresses of the IPv4 subnet `cidr`, as numbers; null when it is none. */
+function subnetRange(cidr) {
+    const match = /^(\d+)\.(\d+)\.(\d+)\.(\d+)\/(\d+)$/u.exec(cidr);
+    if (!match)
+        return null;
+    const octets = match.slice(1, 5).map(Number);
+    const prefix = Number(match[5]);
+    if (octets.some((octet) => octet > 255) || prefix > 32)
+        return null;
+    const size = 2 ** (32 - prefix);
+    const first = octets.reduce((value, octet) => value * 256 + octet, 0);
+    return [first - (first % size), first - (first % size) + size - 1];
+}
+/** The first 172.30.N.0/24 that overlaps none of the `taken` subnets (others than IPv4 are not in the way), or null when all do. Pure, for tests. */
+export function freeSubnet(taken) {
+    const ranges = taken.flatMap((cidr) => {
+        const range = subnetRange(cidr);
+        return range ? [range] : [];
+    });
+    for (let third = 0; third < 256; third++) {
+        const candidate = `172.30.${third}.0/24`;
+        // A /24 written as such always has a range.
+        const [first, last] = subnetRange(candidate);
+        if (!ranges.some(([start, end]) => start <= last && first <= end))
+            return candidate;
+    }
+    return null;
+}
+/**
+ * CoreDNS's NodeHosts, a hosts file, with `aliases`: k3s keeps a line for each node in
+ * it, which stays, and every other line is the cluster's aliases, which are replaced.
+ * Pure, for tests.
+ */
+export function nodeHostsWith(nodeHosts, nodes, aliases) {
+    const kept = nodeHosts.split("\n").filter((line) => line.trim().split(/\s+/u).slice(1).some((host) => nodes.includes(host)));
+    return [...kept, ...aliases.map(({ ip, hostnames }) => `${ip} ${hostnames.join(" ")}`)].join("\n");
+}
+/**
+ * The kubeconfig k3s wrote in the server node (`k3sYaml`), named after the cluster and
+ * pointed at the API server's port on the loopback; null when it is not a kubeconfig with
+ * a cluster and a user, as while k3s writes it.
+ */
+export function localKubeconfig(k3sYaml, cluster, apiPort) {
+    const written = new KubeConfig();
+    try {
+        written.loadFromString(k3sYaml);
+    }
+    catch {
+        return null;
+    }
+    const server = written.getCurrentCluster();
+    const user = written.getCurrentUser();
+    if (!server || !user)
+        return null;
+    const local = new KubeConfig();
+    local.loadFromOptions({
+        clusters: [{ ...server, name: cluster, server: `https://127.0.0.1:${apiPort}` }],
+        users: [{ ...user, name: cluster }],
+        contexts: [{ name: cluster, cluster, user: cluster }],
+        currentContext: cluster,
+    });
+    return local.exportConfig();
+}
+/** k3s's registries.yaml of `registries`, written as JSON, which YAML reads as it is. Pure, for tests. */
+export function registriesYaml({ mirrors = {}, configs = {} }) {
+    return JSON.stringify({
+        mirrors,
+        configs: Object.fromEntries(Object.entries(configs).map(([host, { tls }]) => [
+            host,
+            { tls: { ca_file: tls.caFile, cert_file: tls.certFile, key_file: tls.keyFile, insecure_skip_verify: tls.insecureSkipVerify } },
+        ])),
+    });
+}
+/** A digest of `spec` that two specs share only when they are the same. */
+const specHash = (spec) => createHash("sha256").update(JSON.stringify(spec)).digest("hex");
+const makeLocalCluster = Effect.fnUntraced(function* ({ name: cluster, apiPort, storagePath, image = imageReference(NODE_IMAGE), subnet, hostAliases = [], mounts = [], agents = 0, registries, readyTimeout = READY_TIMEOUT, poll = POLL, }) {
+    const docker = yield* DockerEngine;
+    const fs = yield* FileSystem.FileSystem;
+    const labels = { [CLUSTER_LABEL]: cluster };
+    const server = `${cluster}-server-0`;
+    const nodes = [server, ...Array.from({ length: agents }, (_, index) => `${cluster}-agent-${index}`)];
+    const unusable = (reason) => new ClusterUnusable({ cluster, reason });
+    /**
+     * The container of `node`, with what every node has: privileged, as k3s in Docker needs,
+     * its volumes, the storage directory and the host mounts, and the registries.
+     */
+    const nodeContainer = (node, role, address, command, env) => ({
+        Image: image,
+        Hostname: node,
+        Cmd: command,
+        Env: [...env, ...(registries ? [`${REGISTRIES_ENV}=${registriesYaml(registries)}`] : [])],
+        Labels: { ...labels, [ROLE_LABEL]: role },
+        ...(role === "server" ? { ExposedPorts: { [API_PORT]: {} } } : {}),
+        HostConfig: {
+            Privileged: true,
+            Init: true,
+            CgroupnsMode: "private",
+            RestartPolicy: { Name: "unless-stopped" },
+            SecurityOpt: ["label=disable"],
+            Tmpfs: { "/run": "", "/var/run": "" },
+            Mounts: [
+                ...NODE_VOLUMES.map(([suffix, target]) => ({ Type: "volume", Source: `${node}-${suffix}`, Target: target })),
+                { Type: "bind", Source: storagePath, Target: storagePath },
+                ...mounts.map(({ source, target, readOnly = false }) => ({ Type: "bind", Source: source, Target: target, ReadOnly: readOnly })),
+            ],
+            ExtraHosts: hostAliases.flatMap(({ ip, hostnames }) => hostnames.map((hostname) => `${hostname}:${ip}`)),
+            ...(role === "server" ? { PortBindings: { [API_PORT]: [{ HostIp: "127.0.0.1", HostPort: String(apiPort) }] } } : {}),
+        },
+        NetworkingConfig: { EndpointsConfig: { [cluster]: { IPAMConfig: { IPv4Address: address } } } },
+    });
+    /** The cluster's network, made unless it exists; its subnet, which must be `subnet` when that is given. */
+    const ensureNetwork = Effect.fnUntraced(function* () {
+        const existing = yield* docker.inspectNetwork(cluster);
+        if (existing && existing.Labels?.[CLUSTER_LABEL] !== cluster)
+            return yield* unusable(`a network named ${cluster} is not its own`);
+        let network = existing;
+        if (!network) {
+            const chosen = subnet ?? freeSubnet((yield* docker.listNetworks).flatMap(({ IPAM }) => (IPAM.Config ?? []).flatMap(({ Subnet }) => Subnet ?? [])));
+            if (!chosen)
+                return yield* unusable("every 172.30.N.0/24 is another network's: give the cluster a subnet");
+            yield* Effect.logInfo(`making network ${cluster} (${chosen})`);
+            yield* docker.createNetwork({ Name: cluster, Driver: "bridge", IPAM: { Config: [{ Subnet: chosen }] }, Labels: labels });
+            network = yield* docker.inspectNetwork(cluster);
+        }
+        const actual = network?.IPAM.Config?.[0]?.Subnet;
+        if (!actual)
+            return yield* unusable(`network ${cluster} has no subnet`);
+        if (subnet && actual !== subnet)
+            return yield* unusable(`network ${cluster} has the subnet ${actual}, not ${subnet}`);
+        return actual;
+    });
+    /** The `index`th node's address in `networkSubnet`. */
+    const nodeAddress = (networkSubnet, index) => {
+        const address = subnetAddress(networkSubnet, 2 + index);
+        return address ? Effect.succeed(address) : Effect.fail(unusable(`its subnet ${networkSubnet} has no room for ${nodes.length} nodes`));
+    };
+    /** `node`'s container made as `spec` says, anew when it was made otherwise, and running. */
+    const ensureNode = Effect.fnUntraced(function* (node, spec) {
+        const hash = specHash(spec);
+        const existing = yield* docker.inspectContainer(node);
+        if (existing && existing.Config.Labels?.[CLUSTER_LABEL] !== cluster)
+            return yield* unusable(`a container named ${node} is not one of its nodes`);
+        const current = existing !== null && existing.Config.Labels?.[SPEC_LABEL] === hash;
+        if (existing && !current) {
+            yield* Effect.logInfo(`making node ${node} anew, from its current image and settings`);
+            yield* docker.stopContainer(node);
+            yield* docker.removeContainer(node);
+        }
+        if (!current) {
+            yield* Effect.logInfo(`making node ${node}`);
+            yield* Effect.forEach(NODE_VOLUMES, ([suffix]) => docker.createVolume({ Name: `${node}-${suffix}`, Labels: labels }), { discard: true });
+            yield* docker.createContainer(node, { ...spec, Labels: { ...spec.Labels, [SPEC_LABEL]: hash } });
+        }
+        if (!current || !existing.State.Running) {
+            yield* Effect.logInfo(`starting node ${node}`);
+            yield* docker.startContainer(node);
+        }
+    });
+    /** The output of `command` in `node`, which fails unless it exits with 0. */
+    const inNode = (node, command, options) => docker.exec(node, command, options).pipe(Effect.flatMap(({ exitCode, stdout, stderr }) => exitCode === 0 ? Effect.succeed(stdout) : Effect.fail(new NodeCommandFailed({ node, command: command.join(" "), exitCode, stderr }))));
+    const kubectl = (args, options) => inNode(server, ["kubectl", ...args], options);
+    /** `check` once it succeeds, tried every `poll` for `readyTimeout`; why it last failed, when it never does. */
+    const awaitReady = (waitingFor, check) => Effect.logInfo(`waiting for ${waitingFor}`).pipe(Effect.andThen(check.pipe(Effect.mapError((error) => new ClusterNotReady({ cluster, waitingFor, within: Duration.toSeconds(readyTimeout), reason: error.message })), Effect.retry(Schedule.max([Schedule.spaced(poll), Schedule.during(readyTimeout)])))));
+    /** When each node's container last started, in milliseconds since the epoch. */
+    const startTimes = Effect.forEach(nodes, (node) => Effect.map(docker.inspectContainer(node), (container) => [node, Date.parse(container?.State.StartedAt ?? "")])).pipe(Effect.map((entries) => new Map(entries)));
+    /**
+     * Every node ready, by a Ready condition its kubelet reported since its container
+     * started: one from before, which a node stopped while ready keeps until its kubelet
+     * reports again, is not yet the node's. The condition's heartbeat is to the second.
+     */
+    const nodesReady = (started) => kubectl(["get", "nodes", "--output=json"]).pipe(Effect.flatMap((stdout) => {
+        const { items } = JSON.parse(stdout.toString("utf8"));
+        const ready = new Set(items
+            .filter((node) => node.status?.conditions?.some(({ type, status, lastHeartbeatTime }) => type === "Ready" && status === "True" && lastHeartbeatTime !== undefined
+            && new Date(lastHeartbeatTime).getTime() >= Math.floor((started.get(node.metadata?.name ?? "") ?? Infinity) / 1000) * 1000))
+            .map((node) => node.metadata?.name));
+        const waiting = nodes.filter((node) => !ready.has(node));
+        return waiting.length === 0 ? Effect.void : Effect.fail(new NotYet({ message: `not reported ready since started: ${waiting.join(", ")}` }));
+    }));
+    /** CoreDNS's NodeHosts with the host aliases, patched only when they differ, and only over the version read. */
+    const applyHostAliases = Effect.gen(function* () {
+        const coredns = JSON.parse((yield* kubectl(["--namespace=kube-system", "get", "configmap", "coredns", "--output=json"])).toString("utf8"));
+        const nodeHosts = coredns.data?.["NodeHosts"] ?? "";
+        const desired = nodeHostsWith(nodeHosts, nodes, hostAliases);
+        if (desired === nodeHosts)
+            return;
+        const patch = { metadata: { resourceVersion: coredns.metadata?.resourceVersion }, data: { NodeHosts: desired } };
+        yield* kubectl(["--namespace=kube-system", "patch", "configmap", "coredns", "--type=merge", `--patch=${JSON.stringify(patch)}`]);
+    });
+    const writeKubeconfig = Effect.fnUntraced(function* (path) {
+        const content = yield* awaitReady("its kubeconfig", docker.readFile(server, K3S_KUBECONFIG).pipe(Effect.flatMap((written) => {
+            const local = localKubeconfig(written.toString("utf8"), cluster, apiPort);
+            return local ? Effect.succeed(local) : Effect.fail(new NotYet({ message: `${K3S_KUBECONFIG} is not yet a kubeconfig with a cluster and a user` }));
+        })));
+        // Written whole beside it, readable only by its owner, and moved over it.
+        yield* fs.makeDirectory(dirname(path), { recursive: true, mode: 0o700 });
+        const written = `${path}.${randomUUID()}`;
+        yield* fs.writeFileString(written, content, { flag: "wx", mode: 0o600 });
+        yield* fs.rename(written, path);
+        yield* Effect.logInfo(`wrote the kubeconfig of cluster ${cluster} to ${path}`);
+    });
+    const up = Effect.fnUntraced(function* (kubeconfig) {
+        if (!(yield* docker.inspectImage(image))) {
+            yield* Effect.logInfo(`pulling ${image}`);
+            yield* docker.pullImage(image);
+        }
+        const networkSubnet = yield* ensureNetwork();
+        yield* fs.makeDirectory(storagePath, { recursive: true });
+        yield* ensureNode(server, nodeContainer(server, "server", yield* nodeAddress(networkSubnet, 0), [
+            "server",
+            "--disable=traefik",
+            // Where the kubeconfig reaches it.
+            "--tls-san=127.0.0.1",
+            `--default-local-storage-path=${storagePath}`,
+            ...KUBELET_ARGS,
+        ], []));
+        yield* awaitReady("its API server", kubectl(["get", "--raw=/readyz"]));
+        if (agents > 0) {
+            const token = (yield* awaitReady("its token", docker.readFile(server, K3S_TOKEN))).toString("utf8").trim();
+            for (const [index, agent] of nodes.slice(1).entries()) {
+                yield* ensureNode(agent, nodeContainer(agent, "agent", yield* nodeAddress(networkSubnet, 1 + index), ["agent", ...KUBELET_ARGS], [
+                    `K3S_URL=https://${server}:${K3S_PORT}`,
+                    `K3S_TOKEN=${token}`,
+                ]));
+            }
+        }
+        yield* awaitReady("its nodes", Effect.flatMap(startTimes, nodesReady));
+        yield* awaitReady("CoreDNS's NodeHosts", applyHostAliases);
+        yield* awaitReady("the gvisor RuntimeClass", kubectl(["apply", "--filename=-"], { stdin: JSON.stringify(GVISOR_RUNTIME_CLASS) }));
+        yield* writeKubeconfig(kubeconfig);
+        yield* Effect.logInfo(`cluster ${cluster} is up`);
+    });
+    /** The cluster's nodes, the server first. */
+    const existingNodes = docker.listContainers(labels).pipe(Effect.map((found) => found
+        .map((container) => ({
+        name: container.Names[0]?.replace(/^\//u, "") ?? "",
+        role: container.Labels[ROLE_LABEL] === "server" ? "server" : "agent",
+        state: container.State,
+    }))
+        .sort((a, b) => (a.role === b.role ? a.name.localeCompare(b.name) : a.role === "server" ? -1 : 1))));
+    return LocalCluster.of({
+        up,
+        // The agents first, so none is left without its server.
+        down: existingNodes.pipe(Effect.flatMap((found) => Effect.forEach(found.toReversed(), ({ name }) => docker.stopContainer(name), { discard: true })), Effect.andThen(Effect.logInfo(`stopped cluster ${cluster}`))),
+        remove: ({ volumes = false, storage = false } = {}) => Effect.gen(function* () {
+            const found = yield* existingNodes;
+            if (storage && found.some(({ name }) => name === server)) {
+                yield* docker.startContainer(server);
+                yield* inNode(server, ["find", storagePath, "-mindepth", "1", "-delete"]);
+            }
+            yield* Effect.forEach(found, ({ name }) => docker.removeContainer(name), { discard: true });
+            const network = yield* docker.inspectNetwork(cluster);
+            if (network?.Labels?.[CLUSTER_LABEL] === cluster) {
+                // Docker removes no network a container is on: others' (a collector given an
+                // address on it, say) are taken off it, and keep running.
+                yield* Effect.forEach(Object.values(network.Containers ?? {}), ({ Name }) => docker.disconnectNetwork(cluster, Name).pipe(Effect.andThen(Effect.logInfo(`took ${Name} off network ${cluster}`))), { discard: true });
+                yield* docker.removeNetwork(cluster);
+            }
+            if (volumes)
+                yield* Effect.forEach(yield* docker.listVolumes(labels), ({ Name }) => docker.removeVolume(Name), { discard: true });
+            if (storage)
+                yield* fs.remove(storagePath, { recursive: true, force: true });
+            yield* Effect.logInfo(`removed cluster ${cluster}${volumes ? " and its volumes" : ""}${storage ? `, and ${storagePath}` : ""}`);
+        }),
+        status: Effect.all({
+            docker: Effect.map(docker.version, ({ Version }) => Version),
+            nodes: existingNodes,
+        }),
+    });
+});
+//# sourceMappingURL=local.js.map