hammerkit 1.25.0 → 1.27.0-next.1

package/dist/planner/work-runtime-docker.js

@@ -17,6 +17,10 @@ const work_instance_id_1 = require("./work-instance-id");
 const stream_1 = require("stream");
 const service_definition_1 = require("./service-definition");
 const container_task_state_1 = require("../executer/container-task-state");
+const item_network_1 = require("../docker/item-network");
+const execution_steps_1 = require("../executer/execution-steps");
+const assert_item_paths_1 = require("./utils/assert-item-paths");
+const log_1 = require("../log");
 function dockerTaskRuntime(task, workEnvironment) {
     const docker = (0, execute_docker_1.getContainerCli)(workEnvironment);
     return {
@@ -39,6 +43,8 @@ function dockerTaskRuntime(task, workEnvironment) {
             });
         },
         async restore(environment, path) {
+            // the restored outputs aren't the ones the record names any more
+            await (0, container_task_state_1.removeContainerTaskState)(environment, task);
             await restoreContainer(docker, environment, task, path);
         },
         async archive(environment, path) {
@@ -54,8 +60,18 @@ function dockerTaskRuntime(task, workEnvironment) {
             for (const container of containers) {
                 await (0, remove_container_1.removeContainer)(docker.getContainer(container.Id));
             }
+            await (0, item_network_1.removeItemNetworks)(docker, task);
         },
         async execute(environment, options) {
+            if (environment.hosted) {
+                try {
+                    await (0, assert_item_paths_1.assertItemPathsWithinRoot)(task, environment.cwd);
+                }
+                catch (e) {
+                    options.state.set({ stateKey: options.stateKey, type: 'error', errorMessage: (0, log_1.getErrorMessage)(e) });
+                    return;
+                }
+            }
             await (0, docker_task_1.dockerTask)(docker, task, environment, options);
         },
         async remove(environment) {
@@ -101,6 +117,18 @@ function isOnHost(generate) {
     return generate.isFile || generate.export;
 }
 async function restoreContainer(docker, environment, item, path) {
+    await (0, execution_steps_1.refuseHostLinks)(item, environment);
+    // on a server the volumes the outputs are restored into carry the run's files, so they
+    // are removed with a sandbox
+    const root = (0, execution_steps_1.hostedRoot)(environment);
+    if (root) {
+        const names = item.data.type === 'container-service'
+            ? item.data.volumes.filter((v) => !v.inherited).map((v) => v.name)
+            : item.data.generates.filter((v) => !v.inherited && !v.isFile).map((v) => v.volumeName);
+        for (const name of names) {
+            await (0, get_docker_executor_1.ensureVolumeExists)(docker, item.status, name, (0, get_docker_executor_1.volumeLabels)(root));
+        }
+    }
     await (0, using_container_1.usingContainer)(docker, item, {
         abortSignal: environment.abortCtrl.signal,
         Image: item.data.image,
@@ -140,6 +168,7 @@ async function restoreContainer(docker, environment, item, path) {
         }
     });
     if (item.data.type === 'container-task') {
+        await (0, execution_steps_1.refuseHostLinks)(item, environment);
         const onHost = new Set(item.data.generates.filter((g) => !g.inherited && isOnHost(g)).map((g) => g.path));
         for (const generate of (0, event_cache_1.getArchivePaths)(item.data, path)) {
             if (onHost.has(generate.path) && (await environment.file.exists(generate.filename))) {
@@ -165,6 +194,8 @@ function dockerServiceRuntime(service, workEnvironment) {
             if (currentService.Labels['hammerkit-definition'] !== (0, service_definition_1.getServiceDefinitionHash)(service)) {
                 service.status.write('info', `${service.name} changed since it was started, recreating it`);
                 await (0, remove_container_1.removeContainer)(docker.getContainer(currentService.Id));
+                // its network, proxy and relay go with it, whatever its new setting
+                await (0, item_network_1.removeItemNetworks)(docker, service);
                 return;
             }
             const servicePid = 'hammerkit-pid' in currentService.Labels ? parseInt(currentService.Labels['hammerkit-pid']) : undefined;
@@ -188,6 +219,7 @@ function dockerServiceRuntime(service, workEnvironment) {
             for (const container of containers) {
                 await (0, remove_container_1.removeContainer)(docker.getContainer(container.Id));
             }
+            await (0, item_network_1.removeItemNetworks)(docker, service);
             await (0, container_secrets_1.removeContainerSecrets)((0, work_instance_id_1.getWorkInstanceId)(service));
         },
         async remove() {
@@ -201,6 +233,16 @@ function dockerServiceRuntime(service, workEnvironment) {
             }
         },
         async execute(environment, options) {
+            if (environment.hosted) {
+                try {
+                    await (0, assert_item_paths_1.assertItemPathsWithinRoot)(service, environment.cwd);
+                }
+                catch (e) {
+                    service.status.write('error', (0, log_1.getErrorMessage)(e));
+                    options.state.set({ type: 'end', reason: 'crash', stateKey: options.stateKey });
+                    return;
+                }
+            }
             await (0, docker_service_1.dockerService)(docker, service, options, environment);
         },
         async restore(environment, path) {
@@ -229,6 +271,7 @@ function dockerServiceRuntime(service, workEnvironment) {
 }
 exports.dockerServiceRuntime = dockerServiceRuntime;
 async function archiveContainer(docker, environment, item, path) {
+    await (0, execution_steps_1.refuseHostLinks)(item, environment);
     await (0, using_container_1.usingContainer)(docker, item, {
         abortSignal: environment.abortCtrl.signal,
         Image: item.data.image,