hammerkit 1.26.0 → 1.27.0-next.1

package/dist/docker/remove-orphaned-containers.js

@@ -1,12 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.removeOrphanedContainers = exports.isDockerUnreachable = exports.isProcessAlive = exports.isOrphanedContainer = void 0;
+exports.removeOrphanedContainers = exports.isDockerUnreachable = exports.isProcessAlive = exports.isOfStoppedRun = exports.isOrphanedContainer = void 0;
 const os_1 = require("os");
 const remove_container_1 = require("./remove-container");
 // A hammerkit container nothing will remove any more: a task container (they
-// never outlive their run) or a service of a run that is gone, started by a
-// hammerkit process of this machine that no longer exists, and the paused
-// state records hammerkit kept before 1.9. Services of `up --daemon` and
+// never outlive their run), a service or an egress proxy of a run that is
+// gone, started by a hammerkit process of this machine that no longer exists,
+// and the paused state records hammerkit kept before 1.9. Services of `up --daemon` and
 // containers of other machines or of running processes stay.
 function isOrphanedContainer(container, isProcessAlive) {
     const labels = container.Labels;
@@ -14,9 +14,16 @@ function isOrphanedContainer(container, isProcessAlive) {
     if (type === 'task' && container.State === 'paused') {
         return true;
     }
-    if (type !== 'task' && type !== 'service') {
+    // a proxy goes with the task or service it serves
+    if (type !== 'task' && type !== 'service' && type !== 'proxy') {
         return false;
     }
+    return isOfStoppedRun(labels, isProcessAlive);
+}
+exports.isOrphanedContainer = isOrphanedContainer;
+// Labeled with the run labels of a hammerkit process of this machine that no
+// longer exists, and not kept for `up --daemon`.
+function isOfStoppedRun(labels, isProcessAlive) {
     if (labels['hammerkit-daemon'] === 'true') {
         return false;
     }
@@ -29,7 +36,7 @@ function isOrphanedContainer(container, isProcessAlive) {
     }
     return !isProcessAlive(pid);
 }
-exports.isOrphanedContainer = isOrphanedContainer;
+exports.isOfStoppedRun = isOfStoppedRun;
 function isProcessAlive(pid) {
     try {
         process.kill(pid, 0);

package/dist/environment/replace-env-variables.js

@@ -6,9 +6,10 @@ const INTERPOLATION = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
 // The shell / process environment first, then the .env files. A variable set to
 // an empty string is set, as in a shell: CI providers leave many empty (a merge
 // request id on a branch pipeline).
-function resolveReference(name, environment, context) {
+function resolveReference(name, environment, context, fromProcess) {
     const processValue = environment.processEnvs[name];
     if (processValue !== undefined && processValue !== null) {
+        fromProcess?.add(name);
         return processValue;
     }
     for (const envFile of Object.values(context.envFiles)) {
@@ -22,10 +23,11 @@ function resolveReference(name, environment, context) {
 function buildEnvironmentVariables(envs, environment, context) {
     const replacements = [];
     const variables = {};
+    const fromProcess = new Set();
     for (const [key, value] of Object.entries(envs)) {
         if (value.startsWith('$') && !value.startsWith('${')) {
             const name = value.substring(1);
-            const nameValue = resolveReference(name, environment, context);
+            const nameValue = resolveReference(name, environment, context, fromProcess);
             if (nameValue !== null) {
                 replacements.push({ key, name, available: true, value: nameValue });
             }
@@ -34,7 +36,7 @@ function buildEnvironmentVariables(envs, environment, context) {
             }
         }
         else if (value.includes('${')) {
-            const interpolated = interpolate(value, envs, environment, context);
+            const interpolated = interpolate(value, envs, environment, context, fromProcess);
             if (interpolated.missing) {
                 replacements.push({ key, name: interpolated.missing, available: false, value: null });
             }
@@ -46,16 +48,16 @@ function buildEnvironmentVariables(envs, environment, context) {
             variables[key] = value;
         }
     }
-    return { variables, replacements };
+    return { variables, replacements, processNames: [...fromProcess].sort() };
 }
 exports.buildEnvironmentVariables = buildEnvironmentVariables;
 // Each `${NAME}` comes from the process environment or a .env file, else from a
 // literal value of the same build file / task `envs`, else from its
 // `:-default`. A reference without any of them is missing.
-function interpolate(value, envs, environment, context) {
+function interpolate(value, envs, environment, context, fromProcess) {
     let missing = null;
     const result = value.replace(INTERPOLATION, (match, name, fallback) => {
-        const resolved = resolveReference(name, environment, context) ?? getLiteral(envs, name) ?? fallback ?? null;
+        const resolved = resolveReference(name, environment, context, fromProcess) ?? getLiteral(envs, name) ?? fallback ?? null;
         if (resolved === null) {
             missing = missing ?? name;
             return match;

package/dist/executer/await-completed-dependencies.js

@@ -77,7 +77,8 @@ exports.awaitCompleted = awaitCompleted;
 async function awaitRunningNeed(work, dep, abort) {
     const state = await (0, state_resolver_1.isState)('await-running-need-' + work.name, dep.state, isRunningOrDone, abort);
     if (state.type !== 'running') {
-        throw new Error(`needed service ${dep.name} ${state.type === 'end' ? 'stopped' : 'failed'} before it was ready`);
+        const why = state.type === 'error' ? `: ${state.errorMessage}` : '';
+        throw new Error(`needed service ${dep.name} ${state.type === 'end' ? 'stopped' : 'failed'} before it was ready${why}`);
     }
     return state;
 }

package/dist/executer/check-readiness.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkReadiness = void 0;
 const execute_docker_1 = require("./execute-docker");
-async function checkReadiness(status, command, environment, container, user, abort) {
-    const result = await (0, execute_docker_1.execCommand)(status, environment, container, undefined, command, user, 2000, abort);
+async function checkReadiness(status, command, environment, container, user, abort, env) {
+    const result = await (0, execute_docker_1.execCommand)(status, environment, container, undefined, command, user, 2000, abort, env);
     if (result.type === 'timeout') {
         return false;
     }

package/dist/executer/docker-service.js

@@ -14,13 +14,13 @@ const remove_container_1 = require("../docker/remove-container");
 const check_readiness_1 = require("./check-readiness");
 const main_process_user_1 = require("./main-process-user");
 const execution_steps_1 = require("./execution-steps");
-const docker_task_1 = require("./docker-task");
+const item_network_1 = require("../docker/item-network");
 const container_secrets_1 = require("./container-secrets");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
-const get_service_containers_1 = require("./get-service-containers");
 const work_instance_id_1 = require("../planner/work-instance-id");
 const work_healthcheck_1 = require("../planner/work-healthcheck");
 const docker_resources_1 = require("./docker-resources");
+const egress_proxy_1 = require("../network/egress-proxy");
 const HEALTHCHECK_INTERVAL_MS = 1000;
 function buildServiceCreateOptions(item, options, network, secrets, resources = {}) {
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs);
@@ -28,7 +28,7 @@ function buildServiceCreateOptions(item, options, network, secrets, resources =
     return {
         Image: item.data.image,
         Hostname: (0, service_hostname_1.getServiceHostname)(item.name),
-        Env: Object.entries({ ...envs, ...secrets.env }).map(([key, value]) => `${key}=${value}`),
+        Env: Object.entries({ ...envs, ...network.env, ...secrets.env }).map(([key, value]) => `${key}=${value}`),
         Labels: {
             app: 'hammerkit',
             'hammerkit-id': (0, work_instance_id_1.getWorkInstanceId)(item),
@@ -46,8 +46,7 @@ function buildServiceCreateOptions(item, options, network, secrets, resources =
         Cmd: command.cmd ?? undefined,
         WorkingDir: (0, execute_docker_1.convertToPosixPath)((0, work_service_1.getServiceWorkingDir)(item.data)),
         HostConfig: {
-            ExtraHosts: network.hosts,
-            Links: network.links,
+            ...(0, item_network_1.getNetworkHostConfig)(network),
             Binds: [
                 ...item.data.src.map((s) => `${s.absolutePath}:${s.absolutePath}`),
                 ...item.data.mounts.map((v) => `${v.localPath}:${(0, execute_docker_1.convertToPosixPath)(v.containerPath)}${v.readOnly ? ':ro' : ''}`),
@@ -56,8 +55,9 @@ function buildServiceCreateOptions(item, options, network, secrets, resources =
             ],
             // host ports are for `hammerkit up` and local tasks; container tasks
             // reach the service over its link, and a run publishing them would
-            // collide with another run on the same host
-            PortBindings: options.publishPorts
+            // collide with another run on the same host. A limited service's are
+            // published by its relay.
+            PortBindings: options.publishPorts && !network.relayPorts
                 ? item.data.ports
                     .filter((p) => !!p.hostPort)
                     .reduce((map, port) => {
@@ -72,19 +72,25 @@ function buildServiceCreateOptions(item, options, network, secrets, resources =
 exports.buildServiceCreateOptions = buildServiceCreateOptions;
 async function dockerService(docker, item, options, environment) {
     let container = null;
+    let network = null;
     try {
         await (0, execution_steps_1.prepareMounts)(item, environment);
         (0, abort_1.checkForAbort)(options.abort);
         await (0, execution_steps_1.pullImage)(item, docker, environment);
         (0, abort_1.checkForAbort)(options.abort);
-        await (0, execution_steps_1.prepareVolume)(item, docker);
+        await (0, execution_steps_1.prepareVolume)(item, docker, environment);
+        (0, abort_1.checkForAbort)(options.abort);
+        network = await (0, item_network_1.prepareItemNetwork)(docker, item, environment, {
+            daemon: options.daemon,
+            publish: options.publishPorts ? item.data.ports : [],
+        });
         (0, abort_1.checkForAbort)(options.abort);
-        const serviceContainers = (0, get_service_containers_1.getServiceContainers)(item.needs);
-        const network = (0, docker_task_1.getNeedsNetwork)(serviceContainers, item.needs);
         item.status.write('debug', `create container with image ${item.data.image}`);
         const secrets = await (0, container_secrets_1.prepareContainerSecrets)(item.data.secrets, (0, work_instance_id_1.getWorkInstanceId)(item), environment);
         const resources = await (0, docker_resources_1.resolveDockerResources)(docker, item.data.resources, item.status);
-        container = await docker.createContainer(buildServiceCreateOptions(item, options, network, secrets, resources));
+        await (0, execution_steps_1.refuseHostLinks)(item, environment);
+        container = await docker.createContainer(buildServiceCreateOptions(item, options, network.options, secrets, resources));
+        await network.connect(container);
         const stream = await container.attach({ stream: true, stdout: true, stderr: true });
         (0, stream_1.logStream)(item.status, stream);
         await container.start();
@@ -108,7 +114,7 @@ async function dockerService(docker, item, options, environment) {
                     break;
                 }
                 const user = await (0, main_process_user_1.getMainProcessUser)(container);
-                ready = await (0, check_readiness_1.checkReadiness)(item.status, (0, work_service_1.getHealthcheckCommand)(item.data) ?? [], environment, container, user, options.abort);
+                ready = await (0, check_readiness_1.checkReadiness)(item.status, (0, work_service_1.getHealthcheckCommand)(item.data) ?? [], environment, container, user, options.abort, (0, egress_proxy_1.getProxylessEnvironment)(network.options.env ?? {}));
                 if (!ready && Date.now() >= deadline) {
                     throw new Error((0, work_healthcheck_1.getHealthcheckTimeoutMessage)(item.name, healthcheck));
                 }
@@ -168,9 +174,14 @@ async function dockerService(docker, item, options, environment) {
                 item.status.write('error', `remove of container failed ${(0, log_1.getErrorMessage)(e)}`);
             }
         }
-        // a daemon keeps its secret files until `hammerkit down` stops it
+        // a daemon keeps its secret files and network until `hammerkit down` stops it
         if (!options.daemon) {
             await (0, container_secrets_1.removeContainerSecrets)((0, work_instance_id_1.getWorkInstanceId)(item));
+            if (network) {
+                await network
+                    .release()
+                    .catch((e) => item.status.write('error', `remove of network failed ${(0, log_1.getErrorMessage)(e)}`));
+            }
         }
     }
 }

package/dist/executer/docker-task.js

@@ -1,8 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.dockerTask = exports.buildCreateOptions = exports.getNeedsNetwork = void 0;
+exports.dockerTask = exports.buildCreateOptions = void 0;
 const run_labels_1 = require("../docker/run-labels");
-const service_dns_1 = require("./service-dns");
 const execute_docker_1 = require("./execute-docker");
 const abort_1 = require("./abort");
 const log_1 = require("../log");
@@ -12,32 +11,13 @@ const print_container_options_1 = require("./print-container-options");
 const tar_1 = require("tar");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const get_container_binds_1 = require("./get-container-binds");
-const get_service_containers_1 = require("./get-service-containers");
+const item_network_1 = require("../docker/item-network");
 const work_instance_id_1 = require("../planner/work-instance-id");
 const get_outputs_to_reset_1 = require("../planner/utils/get-outputs-to-reset");
 const container_secrets_1 = require("./container-secrets");
 const container_task_state_1 = require("./container-task-state");
 const docker_resources_1 = require("./docker-resources");
-function getNeedsNetwork(serviceContainers, needs) {
-    const links = [];
-    const hosts = [];
-    for (const need of needs) {
-        const dns = serviceContainers[need.name];
-        if ((0, service_dns_1.isHostServiceDns)(dns)) {
-            hosts.push(`${need.name}:${dns.host}`);
-        }
-        else {
-            if (!dns.containerId) {
-                throw new Error(`service ${need.name} is not running`);
-            }
-            links.push(`${dns.containerId}:${need.name}`);
-        }
-    }
-    return { links, hosts };
-}
-exports.getNeedsNetwork = getNeedsNetwork;
-function buildCreateOptions(item, stateKey, serviceContainers, environment, secrets, resources = {}) {
-    const network = getNeedsNetwork(serviceContainers, item.needs);
+function buildCreateOptions(item, stateKey, network, environment, secrets, resources = {}) {
     const binds = (0, get_container_binds_1.getContainerBinds)(item);
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs);
     // Running as the host's uid (Linux), the user has no home in the image and
@@ -50,7 +30,7 @@ function buildCreateOptions(item, stateKey, serviceContainers, environment, secr
         Tty: true,
         Entrypoint: [item.data.shell],
         Cmd: ['-c', 'sleep 3600'],
-        Env: Object.entries({ ...envs, ...home, ...secrets.env }).map(([key, value]) => `${key}=${value}`),
+        Env: Object.entries({ ...envs, ...home, ...network.env, ...secrets.env }).map(([key, value]) => `${key}=${value}`),
         WorkingDir: (0, execute_docker_1.convertToPosixPath)(item.data.cwd),
         Labels: {
             app: 'hammerkit',
@@ -64,8 +44,7 @@ function buildCreateOptions(item, stateKey, serviceContainers, environment, secr
                 ...binds.map((b) => `${b.localPath}:${(0, execute_docker_1.convertToPosixPath)(b.containerPath)}${b.readOnly ? ':ro' : ''}`),
                 ...secrets.binds,
             ],
-            ExtraHosts: network.hosts,
-            Links: network.links,
+            ...(0, item_network_1.getNetworkHostConfig)(network),
             AutoRemove: true,
             ...resources,
         },
@@ -74,6 +53,7 @@ function buildCreateOptions(item, stateKey, serviceContainers, environment, secr
 exports.buildCreateOptions = buildCreateOptions;
 async function dockerTask(docker, item, environment, options) {
     item.status.write('info', `execute ${item.name} in container`);
+    let network = null;
     try {
         // A run that fails overwrites outputs, so the previous record goes first,
         // and only a run that succeeded writes a new one.
@@ -87,14 +67,18 @@ async function dockerTask(docker, item, environment, options) {
         (0, abort_1.checkForAbort)(options.abort);
         await (0, execution_steps_1.pullImage)(item, docker, environment);
         (0, abort_1.checkForAbort)(options.abort);
-        await (0, execution_steps_1.prepareVolume)(item, docker);
+        await (0, execution_steps_1.prepareVolume)(item, docker, environment);
+        (0, abort_1.checkForAbort)(options.abort);
+        network = await (0, item_network_1.prepareItemNetwork)(docker, item, environment, { daemon: false });
         (0, abort_1.checkForAbort)(options.abort);
-        const serviceContainers = (0, get_service_containers_1.getServiceContainers)(item.needs);
         const secrets = await (0, container_secrets_1.prepareContainerSecrets)(item.data.secrets, (0, work_instance_id_1.getWorkInstanceId)(item), environment);
         const resources = await (0, docker_resources_1.resolveDockerResources)(docker, item.data.resources, item.status);
-        const containerOptions = buildCreateOptions(item, options.stateKey, serviceContainers, environment, secrets, resources);
+        const containerOptions = buildCreateOptions(item, options.stateKey, network.options, environment, secrets, resources);
         (0, print_container_options_1.printContainerOptions)(item.status, containerOptions);
+        await (0, execution_steps_1.refuseHostLinks)(item, environment);
+        const itemNetwork = network;
         const succeeded = await (0, using_container_1.usingContainer)(docker, item, containerOptions, async (container) => {
+            await itemNetwork.connect(container);
             await (0, execution_steps_1.setUserPermissions)(item, container, environment);
             for (const generate of outputsToReset.filter((g) => !g.isFile)) {
                 await (0, execute_docker_1.clearContainerDirectory)(item.status, environment, container, generate.path);
@@ -110,6 +94,7 @@ async function dockerTask(docker, item, environment, options) {
                     throw new abort_1.AbortError();
                 }
                 if (result.result.ExitCode !== 0) {
+                    await (0, execution_steps_1.refuseHostLinks)(item, environment);
                     await exportGenerates(environment, container, item.data.generates.filter((g) => g.exportAlways));
                     options.state.set({
                         stateKey: options.stateKey,
@@ -119,6 +104,7 @@ async function dockerTask(docker, item, environment, options) {
                     return false;
                 }
             }
+            await (0, execution_steps_1.refuseHostLinks)(item, environment);
             await exportGenerates(environment, container, item.data.generates.filter((g) => g.export));
             return true;
         });
@@ -143,6 +129,9 @@ async function dockerTask(docker, item, environment, options) {
     }
     finally {
         await (0, container_secrets_1.removeContainerSecrets)((0, work_instance_id_1.getWorkInstanceId)(item));
+        if (network) {
+            await network.release().catch((e) => item.status.write('error', `remove of network failed ${(0, log_1.getErrorMessage)(e)}`));
+        }
     }
 }
 exports.dockerTask = dockerTask;

package/dist/executer/event-cache.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.cleanCache = exports.storeCache = exports.getArchivePaths = exports.restoreCache = void 0;
 const resolve_git_source_1 = require("../includes/resolve-git-source");
 const remove_orphaned_containers_1 = require("../docker/remove-orphaned-containers");
+const item_network_1 = require("../docker/item-network");
 const execute_docker_1 = require("./execute-docker");
 const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
@@ -102,6 +103,9 @@ async function cleanCache(workTree, environment, options) {
         for (const id of removed) {
             environment.console.info(`removed container ${id.substring(0, 12)} left behind by a stopped run`);
         }
+        for (const name of await (0, item_network_1.removeOrphanedNetworks)((0, execute_docker_1.getContainerCli)(workTree.environment))) {
+            environment.console.info(`removed network ${name} left behind by a stopped run`);
+        }
     }
 }
 exports.cleanCache = cleanCache;

package/dist/executer/execute-command.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.executeCommand = void 0;
+exports.executeCommand = exports.processEnv = void 0;
 const child_process_1 = require("child_process");
 const os_1 = require("os");
 const log_1 = require("../log");
@@ -12,17 +12,30 @@ const environment_config_1 = require("../utils/environment-config");
 function getStopTimeout() {
     return (0, environment_config_1.getEnvironmentConfig)('HAMMERKIT_STOP_TIMEOUT_MS', 10000);
 }
+// A variable of the process. Windows ignores the case of their names and calls PATH
+// `Path`, which a copy of process.env (`{ ...process.env }`) keeps.
+function processEnv(envs, name, windows) {
+    if (envs[name] !== undefined || !windows) {
+        return envs[name];
+    }
+    const key = Object.keys(envs).find((key) => key.toUpperCase() === name.toUpperCase());
+    return key !== undefined ? envs[key] : undefined;
+}
+exports.processEnv = processEnv;
 // powershell takes about half a minute to start when it has to work out its module
-// path itself, so the one of the process is passed on
+// path or the PATH itself, so the ones of the process are passed on
 function shellEnvs(windows, environment) {
-    const value = environment.processEnvs['PSModulePath'];
-    return windows && value !== undefined ? { PSModulePath: value } : {};
+    const value = processEnv(environment.processEnvs, 'PSModulePath', windows);
+    return {
+        ...(windows && value !== undefined ? { PSModulePath: value } : {}),
+        PATH: processEnv(environment.processEnvs, 'PATH', windows),
+    };
 }
 async function executeCommand(status, abortSignal, cwd, command, envs, environment) {
     const windows = (0, os_1.platform)() === 'win32';
     return new Promise((resolve, reject) => {
         const ps = (0, child_process_1.spawn)(command, {
-            env: { ...envs, ...shellEnvs(windows, environment), PATH: environment.processEnvs['PATH'] },
+            env: { ...envs, ...shellEnvs(windows, environment) },
             cwd,
             shell: windows ? 'powershell.exe' : true,
             // its own process group, so an abort reaches every process the command

package/dist/executer/execute-docker.js

@@ -66,10 +66,13 @@ function convertToPosixPath(path) {
     return path;
 }
 exports.convertToPosixPath = convertToPosixPath;
-async function execCommand(status, environment, container, cwd, cmd, user, timeout, abort) {
+async function execCommand(status, environment, container, cwd, cmd, user, timeout, abort, 
+// set for this command only, on top of the container's
+env) {
     const abortController = new AbortController();
     const exec = await container.exec({
         Cmd: cmd,
+        Env: env ? Object.entries(env).map(([key, value]) => `${key}=${value}`) : undefined,
         WorkingDir: cwd,
         Tty: false,
         AttachStdout: true,

package/dist/executer/execution-steps.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setUserPermissions = exports.prepareMounts = exports.prepareVolume = exports.pullImage = void 0;
+exports.setUserPermissions = exports.prepareMounts = exports.prepareVolume = exports.pullImage = exports.refuseHostLinks = exports.hostedRoot = void 0;
 const pull_1 = require("../docker/pull");
 const get_docker_executor_1 = require("./get-docker-executor");
 const path_1 = require("path");
@@ -8,20 +8,42 @@ const set_user_permission_1 = require("./set-user-permission");
 const work_task_1 = require("../planner/work-task");
 const work_service_1 = require("../planner/work-service");
 const get_container_binds_1 = require("./get-container-binds");
+const assert_item_paths_1 = require("../planner/utils/assert-item-paths");
+// The files a server run works on: its checkout, or a sandbox. Somebody else wrote them.
+function hostedRoot(environment) {
+    return environment.hosted ? environment.cwd : undefined;
+}
+exports.hostedRoot = hostedRoot;
+/**
+ * On a server, every path of the host an item binds into its container, or the engine
+ * reads or writes for it, has to stay inside the run's files with no link on the way:
+ * tasks of this or an earlier run on a sandbox, or the commit of a ref, could have left
+ * one pointing anywhere on the server. The runtime checks before an item runs; this is
+ * checked again right before a container is made and before outputs are copied, after
+ * other tasks of the run had their turn.
+ */
+async function refuseHostLinks(item, environment) {
+    const root = hostedRoot(environment);
+    if (root) {
+        await (0, assert_item_paths_1.assertItemPathsWithinRoot)(item, root);
+    }
+}
+exports.refuseHostLinks = refuseHostLinks;
 async function pullImage(item, docker, environment) {
     await (0, pull_1.pull)(item.status, docker, item.data.image, environment);
 }
 exports.pullImage = pullImage;
-async function prepareVolume(item, docker) {
+async function prepareVolume(item, docker, environment) {
+    const labels = (0, get_docker_executor_1.volumeLabels)(environment ? hostedRoot(environment) : undefined);
     if ((0, work_service_1.isContainerWorkService)(item.data)) {
         for (const volume of item.data.volumes) {
             if (volume.resetOnChange && !volume.inherited) {
                 item.status.write('debug', 'recreate volume');
-                await (0, get_docker_executor_1.recreateVolume)(docker, item.status, volume.name);
+                await (0, get_docker_executor_1.recreateVolume)(docker, item.status, volume.name, labels);
             }
             else {
                 item.status.write('debug', 'ensure volume exists');
-                await (0, get_docker_executor_1.ensureVolumeExists)(docker, item.status, volume.name);
+                await (0, get_docker_executor_1.ensureVolumeExists)(docker, item.status, volume.name, labels);
             }
         }
     }
@@ -32,7 +54,7 @@ async function prepareVolume(item, docker) {
                 continue;
             }
             item.status.write('debug', 'ensure volume exists');
-            await (0, get_docker_executor_1.ensureVolumeExists)(docker, item.status, generate.volumeName);
+            await (0, get_docker_executor_1.ensureVolumeExists)(docker, item.status, generate.volumeName, labels);
         }
     }
 }
@@ -66,8 +88,12 @@ async function prepareMounts(item, environment) {
 exports.prepareMounts = prepareMounts;
 async function setUserPermissions(item, container, environment) {
     if (item.data.user) {
-        const binds = (0, get_container_binds_1.getContainerBinds)(item);
-        await (0, set_user_permission_1.setUserPermission)(item.data.cwd, item.status, environment, container, item.data.user);
+        // On a server only the volumes: a chown as the container's root on a path of the host
+        // would follow a link a task put there after the binds were checked
+        const binds = (0, get_container_binds_1.getContainerBinds)(item).filter((bind) => !environment.hosted || !(0, path_1.isAbsolute)(bind.localPath));
+        if (!environment.hosted) {
+            await (0, set_user_permission_1.setUserPermission)(item.data.cwd, item.status, environment, container, item.data.user);
+        }
         for (const bind of binds) {
             await (0, set_user_permission_1.setUserPermission)(bind.containerPath, item.status, environment, container, item.data.user);
         }

package/dist/executer/get-docker-executor.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.recreateVolume = exports.removeVolume = exports.createVolume = exports.ensureVolumeExists = exports.existsVolume = void 0;
+exports.recreateVolume = exports.removeVolume = exports.createVolume = exports.ensureVolumeExists = exports.volumeLabels = exports.VOLUME_ROOT_LABEL = exports.existsVolume = void 0;
 const log_1 = require("../log");
 async function existsVolume(docker, volumeName) {
     try {
@@ -12,22 +12,29 @@ async function existsVolume(docker, volumeName) {
     }
 }
 exports.existsVolume = existsVolume;
-async function ensureVolumeExists(docker, scopedConsole, volumeName) {
+// The label a volume gets when a server run made it for outputs in its files (a sandbox's),
+// so the server finds it again to measure it and to remove it with the sandbox.
+exports.VOLUME_ROOT_LABEL = 'hammerkit-root';
+function volumeLabels(root) {
+    return root ? { [exports.VOLUME_ROOT_LABEL]: root } : {};
+}
+exports.volumeLabels = volumeLabels;
+async function ensureVolumeExists(docker, scopedConsole, volumeName, labels = {}) {
     const volumeExists = await existsVolume(docker, volumeName);
     if (!volumeExists) {
-        await createVolume(docker, scopedConsole, volumeName);
+        await createVolume(docker, scopedConsole, volumeName, labels);
     }
     else {
         scopedConsole.write('debug', 'volume exists ' + volumeName);
     }
 }
 exports.ensureVolumeExists = ensureVolumeExists;
-async function createVolume(docker, scopedConsole, volumeName) {
+async function createVolume(docker, scopedConsole, volumeName, labels = {}) {
     scopedConsole.write('debug', 'create volume ' + volumeName);
     await docker.createVolume({
         Name: volumeName,
         Driver: 'local',
-        Labels: { app: 'hammerkit' },
+        Labels: { ...labels, app: 'hammerkit' },
     });
 }
 exports.createVolume = createVolume;
@@ -44,9 +51,9 @@ async function removeVolume(docker, scopedConsole, volumeName) {
     }
 }
 exports.removeVolume = removeVolume;
-async function recreateVolume(docker, scopedConsole, volumeName) {
+async function recreateVolume(docker, scopedConsole, volumeName, labels = {}) {
     await removeVolume(docker, scopedConsole, volumeName);
-    await createVolume(docker, scopedConsole, volumeName);
+    await createVolume(docker, scopedConsole, volumeName, labels);
 }
 exports.recreateVolume = recreateVolume;
 //# sourceMappingURL=get-docker-executor.js.map

package/dist/executer/scheduler/enqueue-next.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkCacheState = void 0;
+exports.checkCacheState = exports.UNCACHED_STATE_KEY = void 0;
 const work_item_1 = require("../../planner/work-item");
 const get_cache_directory_1 = require("../../optimizer/get-cache-directory");
 const cache_metadata_1 = require("../cache-metadata");
@@ -8,7 +8,21 @@ const work_task_cache_description_1 = require("../../optimizer/work-task-cache-d
 const log_1 = require("../../log");
 const state_key_1 = require("./state-key");
 const work_instance_id_1 = require("../../planner/work-instance-id");
-async function checkCacheState(item, defaultCacheMethod, environment) {
+// The key a task whose cache is off runs and records its outputs under. It is
+// no hash, so a later run with its cache on never takes those outputs as its own.
+exports.UNCACHED_STATE_KEY = 'uncached';
+async function checkCacheState(item, defaultCacheMethod, environment, 
+// watch mode compares keys to rerun on a change, so it needs one even when
+// the cache is off
+options = {}) {
+    // A task whose cache is off is never looked up, so hashing its sources buys
+    // nothing, and a `**` over a node_modules takes most of a minute (every run
+    // with arguments). Its dependents still hash its sources for their own key.
+    const declared = (0, state_key_1.resolveEffective)(item, defaultCacheMethod);
+    if (declared.method === 'none' && (0, work_item_1.isWorkTaskItem)(item) && !options.watch) {
+        item.status.write('debug', `${item.name} is skipping cache check, because caching is disabled`);
+        return { cached: false, stateKey: exports.UNCACHED_STATE_KEY, resolved: declared, provable: false };
+    }
     const { stateKey, stats: currentStats, resolved, provable, unmatched, } = await (0, state_key_1.computeStateKey)(item, defaultCacheMethod, environment);
     for (const src of unmatched) {
         item.status.write('warn', `src "${src.source}" matches no files`);
@@ -31,7 +45,7 @@ async function checkCacheState(item, defaultCacheMethod, environment) {
             const pulled = await resolved.backend.pull(item.id(), stateKey, cacheDir, environment);
             if (pulled) {
                 item.status.write('info', `${item.name} pulled from cache "${resolved.name}" (${resolved.backend.type})`);
-                await item.runtime.restore(environment, cacheDir);
+                await item.runtime.restore(environment, cacheDir, stateKey);
                 await (0, cache_metadata_1.writeCacheMetadata)(environment, item, currentStats, (0, work_task_cache_description_1.getWorkTaskCacheDescription)(item));
                 return { cached: true, stateKey, resolved, provable };
             }

package/dist/executer/watch-loop.js

@@ -8,12 +8,12 @@ const state_resolver_1 = require("./state-resolver");
 const abort_1 = require("./abort");
 const enqueue_next_1 = require("./scheduler/enqueue-next");
 async function watchLoop(work, environment, options, factory) {
-    const currentStats = await (0, enqueue_next_1.checkCacheState)(work, options.cacheDefault, environment);
-    (0, abort_1.checkForAbort)(environment.abortCtrl.signal);
     // continuous lives on container-services and on tasks (both task types); a
     // kubernetes-service has no such field. Read it wherever it exists.
     const continuous = 'continuous' in work.data ? work.data.continuous : false;
     const watchMode = options.watch && !options.daemon && !continuous;
+    const currentStats = await (0, enqueue_next_1.checkCacheState)(work, options.cacheDefault, environment, { watch: watchMode });
+    (0, abort_1.checkForAbort)(environment.abortCtrl.signal);
     const watchState = watchMode
         ? (0, watch_state_key_1.watchStateKey)(work, currentStats, environment, options)
         : new state_1.State(currentStats);

package/dist/executer/watch-state-key.js

@@ -19,7 +19,7 @@ function watchStateKey(item, cacheStats, environment, options) {
         if (environment.abortCtrl.signal.aborted) {
             return;
         }
-        const cacheState = await (0, enqueue_next_1.checkCacheState)(item, options.cacheDefault, environment);
+        const cacheState = await (0, enqueue_next_1.checkCacheState)(item, options.cacheDefault, environment, { watch: true });
         if (state.current.stateKey !== cacheState.stateKey) {
             state.set(cacheState);
         }