flisk-import 0.4.0 → 0.5.0

package/README.md

@@ -13,9 +13,10 @@ flisk import . --yes         # write service.json files and project setup
 - **Reads one file:** the root `docker-compose.yml`. Not `compose.yaml`, override files, nested Compose files, Dockerfiles on their own, `package.json`, or Procfiles.
 - **Writes:** one bring-your-own `service.json` per Compose service, plus `.flisk/project.json` if the repo is not a Flisk project yet. It never edits the Compose file or overwrites a `service.json` without `--force`.
 - **Keeps:** the service names (`db` stays `db`, so it stays the hostname), the build context and Dockerfile (or the image), the container port as written (3000, 80, 5432), `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
+- **Runtime keys:** named volumes and bind mounts inside the project (`volumes`), `cap_add`, `cap_drop`, `init`, `read_only`, `user`, `security_opt` and `shm_size` (`container`), extra published ports (`extraPorts`, on 127.0.0.1 only), `network_mode: service:<name>` (`sidecarOf`) and `restart`.
 - **Environment:** names go into `service.json` as `secrets.required`; literal values are copied to the project `.env`, which is added to `.gitignore`. Values in `.env` already are kept, and `${VAR}` values are left for you.
-- **Drops, and says so:** volumes, `command`, `env_file` and every other untranslated key; services with `profiles`, `extends`, an out-of-tree build or a `${VAR}` image.
-- **Does not start anything.** Run `flisk up` with Flisk core **1.4.11 or later**. The importer does not check the core version.
+- **Drops, and says so:** `command`, `env_file` and every other untranslated key; anonymous volumes and paths outside the project; `network_mode` other than `service:<name>`; services with `profiles`, `extends`, an out-of-tree build or a `${VAR}` image.
+- **Does not start anything.** Run `flisk up` with Flisk core **1.4.24 or later**. The importer does not check the core version.
 - **Exit codes:** `0` when the plan succeeds (`--dry-run`, files written, or all `service.json` files already exist), `1` when no root `docker-compose.yml` or mappable service is found, and `2` when the write prompt is declined or closed without an answer (`Nothing written.`).
 
 See [docs/import.md](docs/import.md) for the full mapping and limits. `flisk import` is the core CLI command backed by this package.
@@ -32,7 +33,7 @@ flisk import tiltfile dev/Tiltfile --yes # a named file, or a folder that holds
 
 - **Path:** `[path]` defaults to `Tiltfile`; a folder means `<folder>/Tiltfile`. It is resolved from the current directory. The project root is the nearest folder with `.flisk/project.json`, else the current directory.
 - **Writes:** only `.flisk/project.json`, with `"orchestration": { "source": "tiltfile", "path": "<path from the project root>" }`. Every other key is kept. Without a `project.json`, it creates the same minimal one as the Compose import, with only the proxy stack. It never edits the Tiltfile.
-- **Refuses (exit 1):** a missing Tiltfile, a path inside `.flisk/`, a path with a quote or control character, and a `project.json` that already sets `orchestration` (pass `--force` to replace it).
+- **Refuses (exit 1):** a missing Tiltfile, a path inside `.flisk/` (also through a symlink), a path with a quote or control character, a `project.json` that is not a JSON object or lacks the fields `flisk up` needs, and a `project.json` that already sets `orchestration` (pass `--force` to replace it).
 - **Exit codes:** the same as the Compose import: `0` for `--dry-run` or a write, `1` for a refusal, `2` when the prompt is declined or closed (`Nothing written.`).
 - **Needs** a Flisk core that runs an imported Tiltfile ([flisk#2849](https://github.com/flisk-sh/flisk/pull/2849)). The importer does not check the core version.
 

package/dist/detectors/compose.js

@@ -22,8 +22,10 @@ const NON_HTTP_PORTS = new Set([
 ]);
 /**
  * Service keys this detector translates. Every other key is named in the report: Flisk runs a
- * bring-your-own container without volumes, command overrides, env files and the rest.
- * `healthcheck` only contributes an HTTP path; `environment` only contributes names.
+ * bring-your-own container without command overrides, env files and the rest.
+ * `healthcheck` only contributes an HTTP path; `environment` only contributes names. The runtime keys
+ * (capabilities, volumes, network_mode, restart) map onto service.json fields; a value that cannot be
+ * carried over is named on its own line instead.
  */
 const TRANSLATED_KEYS = new Set([
     "image",
@@ -32,7 +34,155 @@ const TRANSLATED_KEYS = new Set([
     "environment",
     "depends_on",
     "healthcheck",
+    "cap_add",
+    "cap_drop",
+    "init",
+    "read_only",
+    "user",
+    "security_opt",
+    "shm_size",
+    "network_mode",
+    "volumes",
+    "restart",
 ]);
+const CAPABILITY = /^[A-Z_]+$/;
+const USER = /^[A-Za-z0-9_.:-]+$/;
+const SECURITY_OPT = /^[A-Za-z0-9_.:=/-]+$/;
+const VOLUME_NAME = /^[a-z0-9][a-z0-9_-]*$/;
+const CONTAINER_PATH = /^\/[A-Za-z0-9_./-]*$/;
+const HOST_PATH = /^[A-Za-z0-9_./-]+$/;
+const RESTART = new Set(["no", "on-failure", "unless-stopped", "always"]);
+/** Compose `shm_size` as a size string such as 256mb; a number is bytes. */
+function shmSizeOf(value) {
+    if (typeof value === "number" && Number.isInteger(value) && value > 0)
+        return `${value}b`;
+    if (typeof value === "string" && /^[0-9]+([bkmg]b?)?$/i.test(value))
+        return value;
+    return undefined;
+}
+/** `container` for service.json, and the values that could not be carried over. */
+function containerOf(raw) {
+    const container = {};
+    const dropped = [];
+    for (const [key, field] of [
+        ["cap_add", "capAdd"],
+        ["cap_drop", "capDrop"],
+    ]) {
+        if (raw[key] === undefined)
+            continue;
+        const caps = Array.isArray(raw[key]) ? raw[key] : [];
+        const kept = caps.filter((c) => typeof c === "string" && CAPABILITY.test(c));
+        if (kept.length !== caps.length || caps.length === 0)
+            dropped.push(key);
+        if (kept.length)
+            container[field] = kept;
+    }
+    if (raw.init !== undefined) {
+        if (typeof raw.init === "boolean")
+            container.init = raw.init;
+        else
+            dropped.push("init");
+    }
+    if (raw.read_only !== undefined) {
+        if (typeof raw.read_only === "boolean")
+            container.readOnly = raw.read_only;
+        else
+            dropped.push("read_only");
+    }
+    if (raw.user !== undefined) {
+        const user = typeof raw.user === "number" ? String(raw.user) : raw.user;
+        if (typeof user === "string" && USER.test(user))
+            container.user = user;
+        else
+            dropped.push("user");
+    }
+    if (raw.security_opt !== undefined) {
+        const opts = Array.isArray(raw.security_opt) ? raw.security_opt : [];
+        const kept = opts.filter((o) => typeof o === "string" && SECURITY_OPT.test(o));
+        if (kept.length !== opts.length || opts.length === 0)
+            dropped.push("security_opt");
+        if (kept.length)
+            container.securityOpt = kept;
+    }
+    if (raw.shm_size !== undefined) {
+        const size = shmSizeOf(raw.shm_size);
+        if (size)
+            container.shmSize = size;
+        else
+            dropped.push("shm_size");
+    }
+    return { ...(Object.keys(container).length ? { container } : {}), dropped };
+}
+/** One published port: container port, host port when Compose names a literal one, and protocol. */
+function publishedPort(entry) {
+    const port = containerPort(entry);
+    if (port === undefined)
+        return undefined;
+    let host;
+    let protocol = "tcp";
+    if (isObj(entry)) {
+        const published = typeof entry.published === "string" ? Number(entry.published) : entry.published;
+        if (typeof published === "number" && Number.isInteger(published))
+            host = published;
+        if (entry.protocol === "udp")
+            protocol = "udp";
+    }
+    else if (typeof entry === "string") {
+        const [mapping, proto] = entry.split("/");
+        if (proto === "udp")
+            protocol = "udp";
+        const parts = (mapping ?? "").split(":");
+        const hostPart = parts.length >= 2 ? parts[parts.length - 2] : undefined;
+        if (hostPart && /^\d+$/.test(hostPart))
+            host = Number.parseInt(hostPart, 10);
+    }
+    return {
+        port,
+        ...(host !== undefined && host >= 1 && host <= 65535 && host !== port
+            ? { hostPort: host }
+            : {}),
+        ...(protocol === "udp" ? { protocol } : {}),
+    };
+}
+/** One `volumes:` entry. Bind sources are resolved against the Compose file's directory. */
+function volumeOf(entry, composeDir) {
+    let source;
+    let target;
+    let readOnly = false;
+    let type;
+    if (typeof entry === "string") {
+        const parts = entry.split(":");
+        if (parts.length < 2 || parts.length > 3)
+            return undefined;
+        [source, target] = parts;
+        readOnly = parts[2] === "ro";
+        if (parts[2] !== undefined && parts[2] !== "ro" && parts[2] !== "rw")
+            return undefined;
+    }
+    else if (isObj(entry)) {
+        ({ source, target, type } = entry);
+        readOnly = entry.read_only === true;
+        if (type !== undefined && type !== "volume" && type !== "bind")
+            return undefined;
+    }
+    else {
+        return undefined;
+    }
+    if (typeof source !== "string" || typeof target !== "string" || !CONTAINER_PATH.test(target))
+        return undefined;
+    const bind = type === "bind" || source.startsWith(".") || source.startsWith("/");
+    if (!bind) {
+        return VOLUME_NAME.test(source)
+            ? { source, target, ...(readOnly ? { readOnly } : {}), bind }
+            : undefined;
+    }
+    if (isAbsolute(source) || !HOST_PATH.test(source))
+        return undefined;
+    const resolved = normalize(join(composeDir, source));
+    if (resolved === ".." || resolved.startsWith("../"))
+        return undefined;
+    return { source: resolved, target, ...(readOnly ? { readOnly } : {}), bind };
+}
 function envNames(environment) {
     if (Array.isArray(environment)) {
         return environment
@@ -180,13 +330,13 @@ registerDetector({
             if (ports.length > 1 && selectedPort === undefined) {
                 skips.push({
                     ...base,
-                    reason: `service "${name}" lists several ports (${ports.join(", ")}); no single HTTP container port could be identified`,
+                    reason: `service "${name}" lists several ports (${ports.join(", ")}); no single HTTP container port could be identified, so none is routed (all are published on 127.0.0.1 as extraPorts)`,
                 });
             }
             else if (ports.length > 1) {
                 skips.push({
                     ...base,
-                    reason: `service "${name}" publishes extra container ports (${ports.filter((port) => port !== selectedPort).join(", ")}); Flisk routes only ${selectedPort}`,
+                    reason: `service "${name}" publishes extra container ports (${ports.filter((port) => port !== selectedPort).join(", ")}); Flisk routes only ${selectedPort} and publishes the others on 127.0.0.1 as extraPorts`,
                 });
             }
             const dependsOn = Array.isArray(raw.depends_on)
@@ -207,6 +357,50 @@ registerDetector({
                     reason: `service "${name}" health path "${foundHealthPath}" has characters Flisk does not accept (only a-z, 0-9, / and -); not used`,
                 });
             }
+            const { container, dropped } = containerOf(raw);
+            for (const key of dropped) {
+                skips.push({
+                    ...base,
+                    reason: `service "${name}" ${key} ${JSON.stringify(raw[key])} has values Flisk does not accept; not used`,
+                });
+            }
+            // Every published port Flisk does not route stays published, on 127.0.0.1 (service.json extraPorts).
+            const extraPorts = (Array.isArray(raw.ports) ? raw.ports : [])
+                .map(publishedPort)
+                .filter((p) => p !== undefined && p.port !== selectedPort);
+            let sidecarOf;
+            if (raw.network_mode !== undefined) {
+                const mode = typeof raw.network_mode === "string" ? raw.network_mode : "";
+                if (mode.startsWith("service:") && mode.length > "service:".length) {
+                    sidecarOf = mode.slice("service:".length);
+                }
+                else {
+                    skips.push({
+                        ...base,
+                        reason: `service "${name}" network_mode "${mode}" is not translated; Flisk only shares another service's network (service:<name>)`,
+                    });
+                }
+            }
+            const volumes = [];
+            for (const entry of Array.isArray(raw.volumes) ? raw.volumes : []) {
+                const volume = volumeOf(entry, composeDir);
+                if (volume)
+                    volumes.push(volume);
+                else
+                    skips.push({
+                        ...base,
+                        reason: `service "${name}" volume ${JSON.stringify(entry)} is not translated (an anonymous volume, a path outside the imported directory, or Compose variables); not mounted`,
+                    });
+            }
+            const restart = typeof raw.restart === "string" && RESTART.has(raw.restart)
+                ? raw.restart
+                : undefined;
+            if (raw.restart !== undefined && !restart) {
+                skips.push({
+                    ...base,
+                    reason: `service "${name}" restart ${JSON.stringify(raw.restart)} is not a policy Flisk accepts; not used`,
+                });
+            }
             const untranslated = Object.keys(raw).filter((key) => !TRANSLATED_KEYS.has(key));
             if (untranslated.length) {
                 skips.push({
@@ -231,6 +425,11 @@ registerDetector({
                 ...(envKeys.length ? { envKeys } : {}),
                 ...(Object.keys(env).length ? { env } : {}),
                 ...(dependsOn.length ? { dependsOn } : {}),
+                ...(container ? { container } : {}),
+                ...(extraPorts.length ? { extraPorts } : {}),
+                ...(sidecarOf ? { sidecarOf } : {}),
+                ...(volumes.length ? { volumes } : {}),
+                ...(restart ? { restart } : {}),
                 confidence: "high",
                 sources: [base],
             });

package/dist/flisk.js

@@ -9,7 +9,7 @@ export const SERVICE_MANIFEST_SCHEMA_URL = "https://flisk.sh/schema.service.json
  * release after 1.4.10 (flisk#2646) accepts a bring-your-own port outside 4000-5999 and two-letter
  * names, which this importer now writes. Stated, not checked: it does not read the installed version.
  */
-export const MIN_CORE_VERSION = "1.4.11";
+export const MIN_CORE_VERSION = "1.4.24";
 /**
  * The core change that runs a registered Tiltfile (`orchestration.source: "tiltfile"`) from `flisk up`. Stated, not
  * checked, like MIN_CORE_VERSION.
@@ -70,3 +70,52 @@ export function defaultProjectConfig(projectRoot, preAlpha) {
         overrides: {},
     };
 }
+const isObject = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+const PHASES = ["pre_alpha", "alpha", "beta", "out_of_scope"];
+const OPTIONAL_INFRA = ["monitoring", "elk", "debezium", "golden_image", "verdaccio"];
+/**
+ * The fields of an existing `.flisk/project.json` that Flisk core would refuse, missing or of the wrong type, as dotted
+ * names such as `project.name`. A whole object that is absent is named once (`optional_infra`), not field by field.
+ * Empty when `flisk up` can read the file. A copy of core's `normalizeProjectConfig` (flisk
+ * `cli/src/generator/template-engine.ts`), so it can drift from flisk.
+ */
+export function missingProjectFields(config) {
+    const missing = [];
+    if (typeof config.version !== "string")
+        missing.push("version");
+    if (!isObject(config.project))
+        missing.push("project");
+    else
+        for (const key of ["name", "version"])
+            if (typeof config.project[key] !== "string")
+                missing.push(`project.${key}`);
+    // Core also reads the older `stacks` shape, with `services` in place of `enabledStacks`.
+    const phaseGaps = (value, label, field) => {
+        if (!isObject(value))
+            return [label];
+        return PHASES.filter((phase) => {
+            const entry = value[phase];
+            return !isObject(entry) || !Array.isArray(entry[field]);
+        }).map((phase) => `${label}.${phase}.${field}`);
+    };
+    const phases = phaseGaps(config.phases, "phases", "enabledStacks");
+    if (phases.length && phaseGaps(config.stacks, "stacks", "services").length)
+        missing.push(...phases);
+    if (!isObject(config.optional_infra))
+        missing.push("optional_infra");
+    else {
+        const infra = config.optional_infra;
+        for (const key of OPTIONAL_INFRA)
+            if (typeof infra[key] !== "boolean")
+                missing.push(`optional_infra.${key}`);
+    }
+    if (!isObject(config.discovery))
+        missing.push("discovery");
+    else if (!Array.isArray(config.discovery.paths))
+        missing.push("discovery.paths");
+    if (config.capabilities !== undefined &&
+        !(isObject(config.capabilities) &&
+            Object.values(config.capabilities).every((flag) => typeof flag === "boolean")))
+        missing.push("capabilities");
+    return missing;
+}

package/dist/merge.js

@@ -49,6 +49,10 @@ const SCALAR_FIELDS = [
 function rank(candidate) {
     return Math.min(...candidate.sources.map((s) => precedence(s.detector)));
 }
+function firstOf(ordered, key) {
+    const holder = ordered.find((c) => c[key] !== undefined);
+    return holder ? { [key]: holder[key] } : {};
+}
 function mergeGroup(name, dir, members, resolve) {
     const ordered = [...members].sort((a, b) => rank(a) - rank(b));
     const originalName = ordered.find((c) => c.name !== undefined && c.name !== name)?.name;
@@ -61,6 +65,14 @@ function mergeGroup(name, dir, members, resolve) {
         env: Object.assign({}, ...[...ordered].reverse().map((c) => c.env ?? {})),
         dependsOn: [...new Set(ordered.flatMap((c) => (c.dependsOn ?? []).map(resolve)))].sort(),
         exposeViaProxy: ordered.find((c) => c.exposeViaProxy !== undefined)?.exposeViaProxy,
+        // Only Compose states these, so the first source that has one wins.
+        ...firstOf(ordered, "container"),
+        ...firstOf(ordered, "extraPorts"),
+        ...firstOf(ordered, "volumes"),
+        ...firstOf(ordered, "restart"),
+        ...(ordered.find((c) => c.sidecarOf)?.sidecarOf
+            ? { sidecarOf: resolve(ordered.find((c) => c.sidecarOf)?.sidecarOf) }
+            : {}),
         procfileCommands: ordered.flatMap((c) => c.sources.some((source) => source.detector === "procfile") && c.command ? [c.command] : []),
         conflicts: [],
         sources: [],
@@ -104,6 +116,7 @@ export function mergeCandidates(candidates, rootName) {
     const table = assignResourceNames([
         ...candidates.flatMap((c) => (c.name === undefined ? [] : [c.name])),
         ...candidates.flatMap((c) => c.dependsOn ?? []),
+        ...candidates.flatMap((c) => (c.sidecarOf ? [c.sidecarOf] : [])),
         ...candidates.flatMap((c) => (c.name === undefined ? [basename(c.dir) || rootName] : [])),
     ]);
     const resolve = (raw) => table.get(raw) ?? toResourceName(raw);

package/dist/tiltfile.js

@@ -1,8 +1,29 @@
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, relative, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync, } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { ImportError } from "./errors.js";
-import { defaultProjectConfig, findProjectRoot } from "./flisk.js";
+import { defaultProjectConfig, findProjectRoot, missingProjectFields } from "./flisk.js";
 const RERUN = "flisk import tiltfile <path>";
+const RECREATE = "Or recreate it with `flisk project --yes --force` (this resets .flisk/project.json), then run the import again";
+/** The refusal for a Tiltfile inside `.flisk/`; `resolved` names where a symlink leads. */
+function insideFliskError(path, resolved) {
+    const via = resolved ? ` (it resolves to ${resolved})` : "";
+    return new ImportError(`${path} is inside .flisk/${via}, where Flisk writes its generated files; import your own Tiltfile instead`, [`Point it at the Tiltfile you maintain: ${RERUN}`]);
+}
+/**
+ * Where `tiltfile` really is, relative to the real `<projectRoot>/.flisk`, when a symlink on the way leads into it.
+ * The lexical check misses `infra/Tiltfile -> ../.flisk/.flisk-out/Tiltfile`, and flisk up would then include its own
+ * generated Tiltfile. Undefined when it does not, or when there is no `.flisk/` yet.
+ */
+function linkedIntoFlisk(tiltfile, projectRoot) {
+    const fliskDir = join(projectRoot, ".flisk");
+    if (!existsSync(fliskDir))
+        return undefined;
+    const realFlisk = realpathSync(fliskDir);
+    const inside = relative(realFlisk, realpathSync(tiltfile));
+    if (inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside))
+        return undefined;
+    return [".flisk", ...inside.split(sep)].join("/");
+}
 /** Describes an `orchestration` value for a message, for example `tiltfile: Tiltfile`. */
 export function describeOrchestration(value) {
     if (value && typeof value === "object" && "source" in value) {
@@ -30,14 +51,16 @@ export function planTiltfileImport(pathArg = "Tiltfile", options = {}) {
     if (hasUnsafeChar(path)) {
         throw new ImportError(`Tiltfile path ${JSON.stringify(path)} has a quote or control character`, ["Rename the file or folder, then run: flisk import tiltfile <path>"]);
     }
-    if (path === ".flisk" || path.startsWith(".flisk/")) {
-        throw new ImportError(`${path} is inside .flisk/, where Flisk writes its generated files; import your own Tiltfile instead`, [`Point it at the Tiltfile you maintain: ${RERUN}`]);
-    }
+    if (path === ".flisk" || path.startsWith(".flisk/"))
+        throw insideFliskError(path);
     if (!statSync(tiltfile, { throwIfNoEntry: false })?.isFile()) {
         throw new ImportError(`No Tiltfile found at ${pathArg}`, [
             `Pass the path of an existing Tiltfile, or a folder that holds one: ${RERUN}`,
         ]);
     }
+    const resolved = linkedIntoFlisk(tiltfile, projectRoot);
+    if (resolved)
+        throw insideFliskError(path, resolved);
     const projectJson = join(projectRoot, ".flisk", "project.json");
     const orchestration = { source: "tiltfile", path };
     if (!existsSync(projectJson)) {
@@ -62,14 +85,23 @@ export function planTiltfileImport(pathArg = "Tiltfile", options = {}) {
         existing = JSON.parse(readFileSync(projectJson, "utf8"));
     }
     catch (err) {
-        throw new ImportError(`Cannot read ${projectJson}: ${err instanceof Error ? err.message : String(err)}`, ["Fix the JSON in .flisk/project.json, then run the import again"]);
+        throw new ImportError(`Cannot read ${projectJson}: ${err instanceof Error ? err.message : String(err)}`, ["Fix the JSON in .flisk/project.json, then run the import again", RECREATE]);
     }
     if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
         throw new ImportError(`${projectJson} is not a JSON object`, [
             "Fix .flisk/project.json, then run the import again",
+            RECREATE,
         ]);
     }
     const config = existing;
+    // Writing orchestration into a file flisk up cannot read would report success and then fail at flisk up.
+    const missing = missingProjectFields(config);
+    if (missing.length) {
+        throw new ImportError(`.flisk/project.json is missing fields flisk up needs, or has them with the wrong type: ${missing.join(", ")}`, [
+            `Add ${missing.length === 1 ? "it" : "them"} to .flisk/project.json, then run the import again`,
+            RECREATE,
+        ]);
+    }
     const replaced = config.orchestration;
     if (replaced !== undefined && !options.force) {
         throw new ImportError(`.flisk/project.json already sets orchestration (${describeOrchestration(replaced)})`, ["Pass --force to replace it; every other key is kept"]);

package/dist/write.js

@@ -160,6 +160,31 @@ export function planWrites(plan, force) {
                 dockerfile: service.dockerfile,
             }
             : { image: service.image };
+        // A sidecar shares another written service's network; one whose host is not written stays a normal service.
+        const sidecarOf = service.sidecarOf && service.sidecarOf !== service.name && names.has(service.sidecarOf)
+            ? service.sidecarOf
+            : undefined;
+        if (service.sidecarOf && !sidecarOf)
+            notes.push(`network_mode not written: "${service.sidecarOf}" is not in this import`);
+        const extraPorts = sidecarOf ? [] : (service.extraPorts ?? []);
+        if (sidecarOf && service.extraPorts?.length)
+            notes.push(`ports not written: a sidecar has none of its own; publish them on "${sidecarOf}"`);
+        if (extraPorts.length)
+            notes.push(`published on 127.0.0.1 only: ${extraPorts.map((p) => `${p.hostPort ?? p.port}->${p.port}/${p.protocol ?? "tcp"}`).join(", ")}`);
+        // Bind mounts are relative to the service directory in service.json, and must stay inside the project.
+        const serviceDir = dirname(path);
+        const volumes = (service.volumes ?? []).flatMap((volume) => {
+            if (!volume.bind)
+                return [volume];
+            const absolute = resolve(plan.root, volume.source);
+            const fromProject = relative(projectRoot, absolute).split("\\").join("/");
+            if (fromProject === ".." || fromProject.startsWith("../")) {
+                notes.push(`volume ${volume.source}:${volume.target} not written: it is outside the project`);
+                return [];
+            }
+            const rel = relative(serviceDir, absolute).split("\\").join("/") || ".";
+            return [{ ...volume, source: rel.startsWith(".") ? rel : `./${rel}` }];
+        });
         const manifest = {
             $schema: SERVICE_MANIFEST_SCHEMA_URL,
             schemaVersion: SERVICE_MANIFEST_SCHEMA_VERSION,
@@ -172,6 +197,19 @@ export function planWrites(plan, force) {
             ...(isPrivate ? { exposeViaProxy: false } : {}),
             ...(dependsOn.length ? { dependsOn } : {}),
             ...(secretNames.length ? { secrets: { required: secretNames } } : {}),
+            ...(service.restart ? { restart: service.restart } : {}),
+            ...(service.container ? { container: service.container } : {}),
+            ...(extraPorts.length ? { extraPorts } : {}),
+            ...(sidecarOf ? { sidecarOf } : {}),
+            ...(volumes.length
+                ? {
+                    volumes: volumes.map(({ source, target, readOnly }) => ({
+                        source,
+                        target,
+                        ...(readOnly ? { readOnly } : {}),
+                    })),
+                }
+                : {}),
         };
         items.push({ service, path, manifest, status, notes });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flisk-import",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Import a repository's root docker-compose.yml into Flisk service.json files, or register its Tiltfile.",
   "type": "module",
   "license": "MIT",