devchain-cli 0.24.1 → 0.25.0

package/dist/server/modules/remotes/host/host-docker.service.js

@@ -8,26 +8,44 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HostDockerService = void 0;
+const docker_project_resources_1 = require("../docker/docker-project-resources");
 const docker_archive_journal_1 = require("../../core/controllers/docker-archive-journal");
 const common_1 = require("@nestjs/common");
+const tar_1 = require("tar");
 const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
+const node_net_1 = require("node:net");
 const node_path_1 = require("node:path");
 const node_stream_1 = require("node:stream");
 const promises_2 = require("node:stream/promises");
 const error_types_1 = require("../../../common/errors/error-types");
+const vm_home_path_1 = require("../../../common/filesystem/vm-home-path");
 const docker_engine_client_1 = require("../../core/controllers/docker-engine.client");
 const docker_archive_1 = require("../../core/controllers/docker-archive");
 const docker_runtime_1 = require("../../core/controllers/docker-runtime");
+const docker_image_metadata_1 = require("../../core/controllers/docker-image-metadata");
 const docker_settings_1 = require("../../core/controllers/docker-settings");
 const host_docker_dto_1 = require("./host-docker.dto");
+const host_ipv4_routes_1 = require("./host-ipv4-routes");
+const host_docker_volume_associations_store_1 = require("./host-docker-volume-associations.store");
+const projectMounted = (container) => ({
+    labels: container.Config.Labels ?? {},
+    mounts: (container.Mounts ?? []).map((mount) => ({ type: mount.Type, source: mount.Source })),
+});
 let HostDockerService = class HostDockerService {
     archives;
-    constructor(archives) {
+    associations;
+    routes;
+    constructor(archives, associations, routes = host_ipv4_routes_1.readHostIPv4Routes) {
         this.archives = archives;
+        this.associations = associations;
+        this.routes = routes;
     }
     async version(signal) {
         return (await docker_engine_client_1.DockerEngineClient.connect(signal)).version(signal);
@@ -41,13 +59,32 @@ let HostDockerService = class HostDockerService {
             });
         return client;
     }
-    async scan(paths, signal, apiVersion, holderVolumes) {
+    async scan(paths, signal, apiVersion, holderVolumes, networkNames) {
         const client = await this.engine(signal, apiVersion);
         const info = client.connectedInfo ?? (await client.info(signal));
         if (!info.Architecture)
             throw new docker_engine_client_1.DockerEngineError('invalid-response', 'Docker architecture is unavailable');
         const containers = await client.json('GET', '/containers/json?all=true', undefined, { signal });
         const volumes = await client.json('GET', '/volumes', undefined, { signal });
+        let networks;
+        let routes;
+        if (networkNames) {
+            const listed = await client.json('GET', '/networks', undefined, { signal });
+            networks = await Promise.all(listed.map(async (network) => {
+                const subnets = (0, docker_settings_1.ipv4Ranges)(network.IPAM?.Config).map((range) => range.Subnet);
+                if (!networkNames.includes(network.Name))
+                    return { name: network.Name, subnets };
+                const inspect = await client.json('GET', `/networks/${encodeURIComponent(network.Name)}`, undefined, { signal });
+                const addresses = Object.entries(inspect.Containers ?? {}).flatMap(([containerId, endpoint]) => {
+                    const address = endpoint.IPv4Address?.split('/')[0];
+                    return address && (0, node_net_1.isIPv4)(address)
+                        ? [{ address, containerId, containerName: endpoint.Name.replace(/^\//, '') }]
+                        : [];
+                });
+                return { name: network.Name, subnets, addresses };
+            }));
+            routes = await this.routes(signal);
+        }
         const existence = [];
         for (const path of paths) {
             signal?.throwIfAborted();
@@ -62,31 +99,41 @@ let HostDockerService = class HostDockerService {
             }
         }
         const metadata = new Map();
-        if (holderVolumes) {
-            const holders = containers.filter((container) => container.Mounts?.some((m) => (m.Type === 'volume' && m.Name && holderVolumes.includes(m.Name)) ||
+        const users = new Map();
+        const holderIds = new Set(holderVolumes
+            ? containers
+                .filter((container) => container.Mounts?.some((m) => (m.Type === 'volume' && m.Name && holderVolumes.includes(m.Name)) ||
                 (m.Type === 'bind' &&
                     m.Source &&
-                    paths.some((p) => inside(p, m.Source) || inside(m.Source, p)))));
-            await Promise.all(holders.map(async (container) => {
-                try {
-                    const inspect = await client.json('GET', `/containers/${encodeURIComponent(container.Id)}/json`, undefined, { signal });
+                    paths.some((p) => (0, vm_home_path_1.inside)(p, m.Source) || (0, vm_home_path_1.inside)(m.Source, p)))))
+                .map((container) => container.Id)
+            : []);
+        await Promise.all(containers.map(async (container) => {
+            try {
+                const inspect = await client.json('GET', `/containers/${encodeURIComponent(container.Id)}/json`, undefined, { signal });
+                if (typeof inspect.Config?.User === 'string')
+                    users.set(container.Id, inspect.Config.User);
+                if (holderIds.has(container.Id))
                     metadata.set(container.Id, {
                         created: inspect.Created,
                         startedAt: inspect.State?.StartedAt,
                         running: inspect.State?.Running,
                     });
-                }
-                catch {
-                    signal?.throwIfAborted();
+            }
+            catch {
+                signal?.throwIfAborted();
+                if (holderIds.has(container.Id))
                     metadata.set(container.Id, {});
-                }
-            }));
-        }
+            }
+        }));
         signal?.throwIfAborted();
         return {
             architecture: info.Architecture,
             containers: containers.map((container) => ({
                 id: container.Id,
+                ...(container.ImageID ? { image: container.ImageID } : {}),
+                ...(container.Image ? { imageReference: container.Image } : {}),
+                ...(users.has(container.Id) ? { user: users.get(container.Id) } : {}),
                 ...(metadata.has(container.Id) && { metadata: metadata.get(container.Id) }),
                 name: container.Names[0]?.replace(/^\//, '') ?? container.Id,
                 labels: container.Labels ?? {},
@@ -103,6 +150,7 @@ let HostDockerService = class HostDockerService {
                 labels: volume.Labels ?? {},
             })),
             paths: existence,
+            ...(networks ? { networks, routes } : {}),
         };
     }
     async capacity(paths, signal) {
@@ -110,7 +158,7 @@ let HostDockerService = class HostDockerService {
         if (paths.some((path) => !(0, node_path_1.isAbsolute)(path) ||
             (0, node_path_1.normalize)(path) !== path ||
             path.includes('\0') ||
-            !inside(path, home)))
+            !(0, vm_home_path_1.inside)(path, home)))
             throw new error_types_1.AppError('Capacity paths must be absolute normalized paths under VM home', 'DOCKER_BIND_OUTSIDE_HOME', 403);
         const results = [];
         const canonicalHome = await (0, promises_1.realpath)(home).catch(() => null);
@@ -119,8 +167,8 @@ let HostDockerService = class HostDockerService {
             try {
                 if (canonicalHome === null)
                     throw new Error();
-                const resolved = await (0, promises_1.realpath)(await nearestExisting(path, home));
-                if (!inside(resolved, canonicalHome))
+                const resolved = await (0, promises_1.realpath)(await (0, vm_home_path_1.nearestExisting)(path, home));
+                if (!(0, vm_home_path_1.inside)(resolved, canonicalHome))
                     throw new Error();
                 const sample = await (0, docker_runtime_1.dockerFilesystem)(resolved);
                 if (!sample || !Number.isFinite(sample.freeBytes) || sample.freeBytes < 0)
@@ -149,27 +197,43 @@ let HostDockerService = class HostDockerService {
         }
         return { ids: present };
     }
+    async matchImages(refs, signal, apiVersion) {
+        const client = await this.engine(signal, apiVersion);
+        const images = [];
+        for (const ref of new Set(refs)) {
+            const image = await (0, docker_engine_client_1.optionalDockerJson)(client, `/images/${encodeURIComponent(ref)}/json`, signal);
+            if (image)
+                images.push({ ref, id: image.Id, metadata: (0, docker_image_metadata_1.dockerImageMetadata)(image) });
+        }
+        return { images };
+    }
     async loadImage(body, signal, apiVersion) {
         const client = await this.engine(signal, apiVersion);
+        const references = await uploadToEngine(body, (toEngine) => this.loadReferences(client, toEngine, signal));
+        const images = new Map();
+        for (const reference of references) {
+            const inspect = await (0, docker_engine_client_1.optionalDockerJson)(client, `/images/${encodeURIComponent(reference)}/json`, signal);
+            if (!inspect?.Id)
+                continue;
+            const image = images.get(inspect.Id) ?? {
+                id: inspect.Id,
+                layers: inspect.RootFS?.Layers ?? [],
+                references: [],
+            };
+            if (!image.references.includes(reference))
+                image.references.push(reference);
+            images.set(inspect.Id, image);
+        }
+        return { images: [...images.values()] };
+    }
+    async loadReferences(client, archive, signal) {
         const response = await client.stream('POST', '/images/load?quiet=1', {
-            body,
+            body: archive,
             headers: { 'Content-Type': 'application/x-tar' },
             signal,
         });
         const references = [];
-        let line = '';
-        const consume = (value) => {
-            if (!value.trim())
-                return;
-            let message;
-            try {
-                message = JSON.parse(value);
-            }
-            catch {
-                throw new docker_engine_client_1.DockerEngineError('invalid-response', 'Invalid Docker image load response');
-            }
-            if (message.error || message.errorDetail)
-                throw new docker_engine_client_1.DockerEngineError('engine-error', 'Docker image load failed');
+        await (0, docker_engine_client_1.readDockerImageProgress)(response, 'load', (message) => {
             if (typeof message.stream !== 'string')
                 return;
             for (const prefix of ['Loaded image: ', 'Loaded image ID: ']) {
@@ -179,33 +243,8 @@ let HostDockerService = class HostDockerService {
                 if (reference)
                     references.push(reference);
             }
-        };
-        try {
-            for await (const chunk of response) {
-                line += chunk.toString('utf8');
-                let newline;
-                while ((newline = line.indexOf('\n')) >= 0) {
-                    consume(line.slice(0, newline));
-                    line = line.slice(newline + 1);
-                }
-                if (line.length > 1024 * 1024)
-                    throw new docker_engine_client_1.DockerEngineError('invalid-response', 'Docker image load response exceeds limit');
-            }
-            consume(line);
-        }
-        finally {
-            response.destroy();
-        }
-        const images = [];
-        const seen = new Set();
-        for (const reference of references) {
-            const inspect = await (0, docker_engine_client_1.optionalDockerJson)(client, `/images/${encodeURIComponent(reference)}/json`, signal);
-            if (!inspect?.Id || seen.has(inspect.Id))
-                continue;
-            seen.add(inspect.Id);
-            images.push({ id: inspect.Id, layers: inspect.RootFS?.Layers ?? [] });
-        }
-        return { images };
+        });
+        return references;
     }
     async saveImage(id, signal, apiVersion) {
         const client = await this.engine(signal, apiVersion);
@@ -226,16 +265,25 @@ let HostDockerService = class HostDockerService {
         const client = await this.engine(signal, apiVersion);
         const old = await (0, docker_engine_client_1.optionalDockerJson)(client, `/networks/${encodeURIComponent(input.name)}`, signal);
         if (old) {
-            this.requireOwner(old.Labels, input.projectId, true);
+            if (!input.shared)
+                this.requireOwner(old.Labels, input.projectId, true);
             return { Id: old.Id, created: false };
         }
+        if (input.ipam) {
+            const overlap = (0, docker_settings_1.overlappingIPv4Range)(input.ipam.Config.map((range) => range.Subnet), await this.routes(signal));
+            if (overlap)
+                throw new error_types_1.AppError(`Network ${input.name} home range overlaps VM on-link route ${overlap}. Change the network range on the PC, then connect again.`, 'DOCKER_NETWORK_ROUTE_OVERLAP', 409);
+        }
         const created = await client.json('POST', '/networks/create', {
             Name: input.name,
             Driver: 'bridge',
             Internal: input.internal,
             Attachable: input.attachable,
             Options: input.options,
-            Labels: { ...input.labels, [host_docker_dto_1.DOCKER_PROJECT_LABEL]: input.projectId },
+            ...(input.ipam ? { IPAM: input.ipam } : {}),
+            Labels: input.shared
+                ? input.labels
+                : { ...input.labels, [host_docker_dto_1.DOCKER_PROJECT_LABEL]: input.projectId },
         }, { signal });
         return { Id: created.Id, created: true };
     }
@@ -268,22 +316,47 @@ let HostDockerService = class HostDockerService {
                 .map((container) => ({ id: container.Id, labels: container.Labels ?? {} })),
         };
     }
-    async remove(kind, id, projectId, signal, apiVersion) {
+    async remove(kind, id, projectId, signal, apiVersion, projectRoot) {
+        await this.validateProjectRoot(projectRoot);
         const client = await this.engine(signal, apiVersion);
-        const resource = await client.json('GET', `/${kind}/${encodeURIComponent(id)}${kind === 'containers' ? '/json' : ''}`, undefined, { signal });
+        const forgetGoneVolume = async (error) => {
+            if (kind === 'volumes' && (0, docker_engine_client_1.isDockerNotFound)(error))
+                await this.associations.delete(id);
+        };
+        let resource;
+        try {
+            resource = await client.json('GET', `/${kind}/${encodeURIComponent(id)}${kind === 'containers' ? '/json' : ''}`, undefined, { signal });
+        }
+        catch (error) {
+            await forgetGoneVolume(error);
+            throw error;
+        }
         const labels = kind === 'containers' ? resource.Config.Labels : resource.Labels;
-        if (labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] !== projectId) {
+        if (kind === 'volumes') {
+            await this.requireVolume(client, { Name: id, Labels: labels }, projectId, signal);
+        }
+        else if (labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] !== projectId) {
             if (kind !== 'containers' ||
-                labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] ||
-                !(await this.composeHolder(client, resource, projectId, signal)))
+                (0, docker_project_resources_1.foreignProjectOwner)(labels, projectId) ||
+                !(await this.composeHolder(client, resource, projectId, signal, projectRoot)))
                 this.requireOwner(labels, projectId);
         }
         const exactId = kind === 'volumes' ? id : resource.Id;
         if (!exactId)
             throw new docker_engine_client_1.DockerEngineError('invalid-response', 'Docker resource identity is missing');
-        if (kind === 'containers')
+        if (kind === 'containers') {
+            await this.recordMountedVolumes(client, resource, projectId, signal, projectRoot);
             await (0, docker_engine_client_1.changeDockerContainerState)(client, exactId, 'stop', signal);
-        await client.json('DELETE', `/${kind}/${encodeURIComponent(exactId)}`, undefined, { signal });
+        }
+        try {
+            await client.json('DELETE', `/${kind}/${encodeURIComponent(exactId)}`, undefined, { signal });
+        }
+        catch (error) {
+            await forgetGoneVolume(error);
+            throw error;
+        }
+        if (kind === 'volumes')
+            await this.associations.delete(id);
     }
     async writeArchive(input, body, signal, apiVersion) {
         const client = await this.engine(signal, apiVersion);
@@ -292,38 +365,11 @@ let HostDockerService = class HostDockerService {
         const helper = await this.archives.create(client, input.image, [layout.mount], signal);
         const hash = (0, node_crypto_1.createHash)('sha256');
         let bytes = 0;
-        const toEngine = new node_stream_1.PassThrough();
-        const received = (async () => {
-            for await (const chunk of body) {
+        try {
+            await uploadToEngine(body, (toEngine) => (0, docker_archive_1.writeDockerArchive)(client, helper.id, toEngine, signal, layout.writePath), (chunk) => {
                 hash.update(chunk);
                 bytes += chunk.length;
-                if (toEngine.destroyed || toEngine.writableEnded)
-                    continue;
-                if (!toEngine.write(chunk))
-                    await new Promise((done) => {
-                        const settle = () => {
-                            toEngine.off('drain', settle).off('close', settle);
-                            done();
-                        };
-                        toEngine.on('drain', settle).on('close', settle);
-                    });
-            }
-            if (!toEngine.destroyed)
-                toEngine.end();
-        })();
-        try {
-            await Promise.all([
-                received,
-                (0, docker_archive_1.writeDockerArchive)(client, helper.id, toEngine, signal, layout.writePath).catch((error) => {
-                    body.destroy();
-                    throw error;
-                }),
-            ]);
-        }
-        catch (error) {
-            toEngine.destroy();
-            await received.catch(() => undefined);
-            throw error;
+            });
         }
         finally {
             await this.archives.cleanup(client, helper);
@@ -331,31 +377,64 @@ let HostDockerService = class HostDockerService {
         return { sha256: hash.digest('hex'), bytes };
     }
     async prepareBinds(input, signal, apiVersion) {
-        const home = (0, node_os_1.homedir)();
-        const canonicalHome = await (0, promises_1.realpath)(home);
-        for (const { path, replace, image, file } of input.paths) {
+        for (const { path, replace, image, file, owner } of input.paths) {
             signal?.throwIfAborted();
-            if (path === home || !inside(path, home))
-                throw new error_types_1.AppError('Bind paths must be under the VM home', 'DOCKER_BIND_OUTSIDE_HOME', 403);
-            const existing = await nearestExisting(path);
-            const resolved = await (0, promises_1.realpath)(existing);
-            if (!inside(resolved, canonicalHome))
-                throw new error_types_1.AppError('Bind paths must be under the VM home', 'DOCKER_BIND_OUTSIDE_HOME', 403);
-            if (existing === path && (await (0, promises_1.lstat)(path)).isSymbolicLink())
-                throw new error_types_1.AppError('Bind paths must not be links', 'DOCKER_BIND_OUTSIDE_HOME', 403);
+            const { existing, resolved } = await (0, vm_home_path_1.assertVmHomePath)(path, {
+                code: 'DOCKER_BIND_OUTSIDE_HOME',
+                message: 'Bind paths must be under the VM home',
+                linkMessage: 'Bind paths must not be links',
+            });
             if (file) {
                 await (0, promises_1.mkdir)((0, node_path_1.dirname)(path), { recursive: true });
-                continue;
+                if (!replace)
+                    continue;
+                if (existing === path && (await (0, promises_1.lstat)(resolved)).isDirectory())
+                    await this.clearBindUnlessEmpty(path, resolved, image, signal, apiVersion);
+                await (0, promises_1.rm)(path, { recursive: true, force: true });
+                await (0, promises_1.writeFile)(path, '', { flag: 'wx' });
             }
-            if (replace && existing === path) {
-                if (!(await (0, promises_1.lstat)(resolved)).isDirectory())
-                    await (0, promises_1.rm)(path, { force: true });
-                else if (!(await (0, promises_1.readdir)(resolved).then((entries) => entries.length === 0, () => false)))
-                    await this.clearBind(path, resolved, image, signal, apiVersion);
+            else {
+                if (replace && existing === path) {
+                    if (!(await (0, promises_1.lstat)(resolved)).isDirectory())
+                        await (0, promises_1.rm)(path, { force: true });
+                    else
+                        await this.clearBindUnlessEmpty(path, resolved, image, signal, apiVersion);
+                }
+                await (0, promises_1.mkdir)(path, { recursive: true });
+            }
+            if (owner &&
+                (existing !== path || replace) &&
+                (replace || owner.uid !== process.getuid?.() || owner.gid !== process.getgid?.())) {
+                const client = await this.engine(signal, apiVersion);
+                const helper = await this.archives.create(client, image, [{ Type: 'bind', Source: (0, node_path_1.dirname)(path), Target: '/data' }], signal);
+                try {
+                    const header = new tar_1.Header({
+                        path: (0, node_path_1.basename)(path),
+                        type: file ? 'File' : 'Directory',
+                        mode: file ? 0o644 : 0o755,
+                        uid: owner.uid,
+                        gid: owner.gid,
+                        size: 0,
+                    });
+                    const needsPax = header.encode();
+                    const blocks = [
+                        ...(needsPax ? [new tar_1.Pax(header).encode()] : []),
+                        header.block,
+                        Buffer.alloc(1024),
+                    ];
+                    await (0, docker_archive_1.writeDockerArchive)(client, helper.id, node_stream_1.Readable.from(blocks), signal, '/data');
+                }
+                finally {
+                    await this.archives.cleanup(client, helper);
+                }
             }
-            await (0, promises_1.mkdir)(path, { recursive: true });
         }
     }
+    async clearBindUnlessEmpty(path, target, image, signal, apiVersion) {
+        const empty = await (0, promises_1.readdir)(target).then((entries) => entries.length === 0, () => false);
+        if (!empty)
+            await this.clearBind(path, target, image, signal, apiVersion);
+    }
     async clearBind(path, target, image, signal, apiVersion) {
         try {
             await this.archives.clearBind(await this.engine(signal, apiVersion), image, target, signal);
@@ -382,23 +461,18 @@ let HostDockerService = class HostDockerService {
         }
         return { stopped };
     }
-    async stopContainer(id, projectId, signal, apiVersion) {
+    async stopContainer(id, projectId, signal, apiVersion, projectRoot) {
+        await this.validateProjectRoot(projectRoot);
         const client = await this.engine(signal, apiVersion);
         const container = await client.json('GET', `/containers/${encodeURIComponent(id)}/json`, undefined, { signal });
         const labels = container.Config.Labels ?? {};
-        if (labels[host_docker_dto_1.DOCKER_PROJECT_LABEL] !== projectId) {
-            const compose = labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL];
-            const owned = !labels[host_docker_dto_1.DOCKER_PROJECT_LABEL] &&
-                compose !== undefined &&
-                (await this.composeOwnsProjectVolume(client, compose, projectId, signal));
-            if (!owned)
-                this.requireOwner(labels, projectId);
-        }
+        if (!(await this.projectHolder(client, container, projectId, signal, projectRoot)))
+            this.requireOwner(labels, projectId);
         await (0, docker_engine_client_1.changeDockerContainerState)(client, container.Id, 'stop', signal);
     }
     async readArchive(input, signal, apiVersion) {
         const client = await this.engine(signal, apiVersion);
-        const source = await this.archiveSource(client, input, signal);
+        const source = await this.archiveSource(client, input, signal, true);
         const layout = (0, docker_archive_1.dockerArchiveLayout)(input.mountType, source);
         const helper = await this.archives.create(client, input.image, [{ ...layout.mount, ReadOnly: true }], signal);
         let archive;
@@ -423,16 +497,45 @@ let HostDockerService = class HostDockerService {
         })();
         return output;
     }
+    async validateProjectRoot(root) {
+        if (root === undefined)
+            return;
+        const code = 'DOCKER_PROJECT_ROOT_INVALID';
+        if (!(0, node_path_1.isAbsolute)(root) || (0, node_path_1.normalize)(root) !== root || root.includes('\0'))
+            throw new error_types_1.AppError('Project root must be an absolute, normalized path', code, 400);
+        try {
+            await (0, vm_home_path_1.assertVmHomePath)(root, {
+                code,
+                message: 'Project root must be below the VM home and cannot be the home itself',
+                linkMessage: 'Project root must not be a link',
+            });
+        }
+        catch (error) {
+            if (error instanceof error_types_1.AppError)
+                throw new error_types_1.AppError(error.message, code, 400);
+            throw error;
+        }
+    }
     requireOwner(labels, projectId, conflict = false) {
         if (labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] !== projectId)
             throw new error_types_1.AppError('Docker resource is not owned by this imported project', 'DOCKER_OWNERSHIP_REQUIRED', conflict ? 409 : 403);
     }
-    async composeOwnsProjectVolume(client, compose, projectId, signal) {
+    async projectHolder(client, container, projectId, signal, projectRoot) {
+        const mounted = projectMounted(container);
+        if ((0, docker_project_resources_1.projectContainer)(mounted, projectRoot, projectId))
+            return true;
+        if ((0, docker_project_resources_1.foreignProjectOwner)(mounted.labels, projectId) || !mounted.labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL])
+            return false;
+        return (0, docker_project_resources_1.projectContainer)(mounted, projectRoot, projectId, await this.projectVolumes(client, projectId, signal));
+    }
+    async projectVolumes(client, projectId, signal) {
         const { Volumes } = await client.json('GET', `/volumes?filters=${encodeURIComponent(JSON.stringify({ label: [`${host_docker_dto_1.DOCKER_PROJECT_LABEL}=${projectId}`] }))}`, undefined, { signal });
-        return (Volumes?.some((volume) => volume.Labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] === projectId &&
-            volume.Labels?.[host_docker_dto_1.COMPOSE_PROJECT_LABEL] === compose) ?? false);
+        return (Volumes ?? []).map((volume) => ({ labels: volume.Labels ?? {} }));
     }
-    async composeHolder(client, container, projectId, signal) {
+    async composeHolder(client, container, projectId, signal, projectRoot) {
+        const mounted = projectMounted(container);
+        if ((0, docker_project_resources_1.projectContainer)(mounted, projectRoot, projectId))
+            return true;
         const compose = container.Config.Labels?.[host_docker_dto_1.COMPOSE_PROJECT_LABEL];
         if (!compose)
             return false;
@@ -440,16 +543,16 @@ let HostDockerService = class HostDockerService {
             if (mount.Type !== 'volume' || !mount.Name)
                 continue;
             const volume = await client.json('GET', `/volumes/${encodeURIComponent(mount.Name)}`, undefined, { signal });
-            if (volume.Labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] === projectId &&
-                volume.Labels?.[host_docker_dto_1.COMPOSE_PROJECT_LABEL] === compose)
+            if ((0, docker_project_resources_1.projectContainer)(mounted, projectRoot, projectId, [{ labels: volume.Labels ?? {} }]))
                 return true;
         }
         return false;
     }
-    async archiveSource(client, input, signal) {
+    async archiveSource(client, input, signal, read = false) {
+        await this.validateProjectRoot(input.projectRoot);
         if (input.mountType === 'volume') {
             const volume = await client.json('GET', `/volumes/${encodeURIComponent(input.source)}`, undefined, { signal });
-            this.requireOwner(volume.Labels, input.projectId);
+            await this.requireVolume(client, volume, input.projectId, signal, read, input.projectRoot);
             return volume.Name;
         }
         try {
@@ -459,7 +562,7 @@ let HostDockerService = class HostDockerService {
                 (0, promises_1.realpath)((0, node_os_1.homedir)()),
                 (0, promises_1.realpath)(file ? (0, node_path_1.dirname)(requested) : requested),
             ]);
-            if (!inside(resolved, home))
+            if (!(0, vm_home_path_1.inside)(resolved, home))
                 throw new Error();
             return file ? (0, node_path_1.join)(resolved, (0, node_path_1.basename)(requested)) : resolved;
         }
@@ -467,25 +570,93 @@ let HostDockerService = class HostDockerService {
             throw new error_types_1.AppError('Bind archive paths must exist under the VM home', 'DOCKER_BIND_OUTSIDE_HOME', 403);
         }
     }
+    async liveContainers(client, signal) {
+        const containers = await client.json('GET', '/containers/json?all=true', undefined, { signal });
+        return containers.map((container) => ({
+            labels: container.Labels ?? {},
+            mounts: (container.Mounts ?? []).map((mount) => ({
+                type: mount.Type,
+                source: mount.Source,
+            })),
+        }));
+    }
+    async requireVolume(client, volume, projectId, signal, read = false, projectRoot) {
+        if (volume.Labels?.[host_docker_dto_1.DOCKER_PROJECT_LABEL] === projectId)
+            return;
+        const labels = volume.Labels ?? {};
+        if ((0, docker_project_resources_1.foreignProjectOwner)(labels, projectId) || !labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL])
+            this.requireOwner(labels, projectId);
+        if (this.associations.matches(projectId, volume.Name, labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL]))
+            return;
+        if (!read)
+            this.requireOwner(labels, projectId);
+        const live = await this.liveContainers(client, signal);
+        if (!(0, docker_project_resources_1.projectVolume)(labels, live, projectRoot, projectId) &&
+            !(0, docker_project_resources_1.projectVolume)(labels, live, projectRoot, projectId, await this.projectVolumes(client, projectId, signal)))
+            this.requireOwner(labels, projectId);
+    }
+    async recordMountedVolumes(client, container, projectId, signal, projectRoot) {
+        const names = [
+            ...new Set((container.Mounts ?? []).filter((m) => m.Type === 'volume' && m.Name).map((m) => m.Name)),
+        ];
+        if (!names.length)
+            return;
+        const live = await this.liveContainers(client, signal);
+        const volumes = await this.projectVolumes(client, projectId, signal);
+        const records = [];
+        for (const name of names) {
+            const volume = await (0, docker_engine_client_1.optionalDockerJson)(client, `/volumes/${encodeURIComponent(name)}`, signal);
+            const labels = volume?.Labels ?? {};
+            if (volume &&
+                labels[host_docker_dto_1.DOCKER_PROJECT_LABEL] === undefined &&
+                labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL] &&
+                (0, docker_project_resources_1.projectVolume)(labels, live, projectRoot, projectId, volumes))
+                records.push({ volume: name, composeProject: labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL] });
+        }
+        await this.associations.record(projectId, records);
+    }
 };
 exports.HostDockerService = HostDockerService;
 exports.HostDockerService = HostDockerService = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [docker_archive_journal_1.DockerArchiveJournal])
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(host_ipv4_routes_1.HOST_IPV4_ROUTES)),
+    __metadata("design:paramtypes", [docker_archive_journal_1.DockerArchiveJournal,
+        host_docker_volume_associations_store_1.HostDockerVolumeAssociationsStore, Function])
 ], HostDockerService);
-function inside(path, root) {
-    return path === root || path.startsWith(root + node_path_1.sep);
-}
-async function nearestExisting(path, stop) {
-    for (let candidate = path;; candidate = (0, node_path_1.dirname)(candidate)) {
-        try {
-            await (0, promises_1.lstat)(candidate);
-            return candidate;
+async function uploadToEngine(body, send, onChunk) {
+    const toEngine = new node_stream_1.PassThrough();
+    const received = (async () => {
+        for await (const chunk of body) {
+            onChunk?.(chunk);
+            if (toEngine.destroyed || toEngine.writableEnded)
+                continue;
+            if (!toEngine.write(chunk))
+                await new Promise((done) => {
+                    const settle = () => {
+                        toEngine.off('drain', settle).off('close', settle);
+                        done();
+                    };
+                    toEngine.on('drain', settle).on('close', settle);
+                });
         }
-        catch (error) {
-            if (error.code !== 'ENOENT' || candidate === stop)
+        if (!toEngine.destroyed)
+            toEngine.end();
+    })();
+    try {
+        const [answer] = await Promise.all([
+            send(toEngine).catch((error) => {
+                body.destroy();
                 throw error;
-        }
+            }),
+            received,
+        ]);
+        return answer;
+    }
+    catch (error) {
+        toEngine.destroy();
+        await received.catch(() => undefined);
+        throw error;
     }
 }
 //# sourceMappingURL=host-docker.service.js.map