hammerkit 1.26.0 → 1.27.0-next.10

package/dist/network/egress-proxy.js

@@ -0,0 +1,407 @@
+"use strict";
+// The egress proxy of a task or service with `network: { allow: [hosts] }`.
+// It runs in its own container (a pod on Kubernetes) next to the item, on a
+// network only the item and the proxy join, and is the item's only way out: HTTP requests and
+// `CONNECT` tunnels to an allowed host pass, everything else gets a 403 and a
+// `refused` event on stdout. For each `host:port` entry it also listens on that
+// port and forwards raw TCP to that host, which the item reaches under the
+// host's name. On a server's cluster it also lets the init containers that read
+// the task's secrets reach the endpoints of their providers: a tunnel to port 443
+// that carries the proxy's token, which those containers get and the task not. The script is passed to `node -e`, so the proxy
+// needs no image of its own, only a stock Node image.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatEgressProxyEvent = exports.formatRefusedHost = exports.parseEgressProxyEvent = exports.getProxylessEnvironment = exports.getProxyClientEnvironment = exports.getEgressProxyPorts = exports.getItemProxyEnvironment = exports.getSecretProxyEnvironment = exports.getEgressProxyEnvironment = exports.getEgressProxyCommand = exports.EGRESS_PROXY_SCRIPT = exports.EGRESS_PROXY_HOST = exports.EGRESS_PROXY_PORT = exports.EGRESS_PROXY_IMAGE = void 0;
+const work_network_1 = require("../planner/work-network");
+const network_schema_1 = require("../schema/network-schema");
+// Pinned, so the code behind the boundary is the same on every host. To bump
+// it, take the index digest of the tag (`docker buildx imagetools inspect
+// node:24-alpine`). The port relay runs in it too.
+exports.EGRESS_PROXY_IMAGE = 'node:24-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1';
+exports.EGRESS_PROXY_PORT = network_schema_1.PROXY_PORT;
+// the name the item reaches the proxy under
+exports.EGRESS_PROXY_HOST = 'hammerkit-proxy';
+// Kept free of anything but Node's own modules. The host rule is the one of
+// matchesHost in planner/work-network.ts. A name a wildcard allows must not
+// resolve to the host or a private network, and none to link-local.
+exports.EGRESS_PROXY_SCRIPT = `
+const http = require('http')
+const net = require('net')
+const dns = require('dns')
+const crypto = require('crypto')
+const entries = JSON.parse(process.env.HAMMERKIT_ALLOW || '[]').map((h) => h.toLowerCase())
+// names and patterns for HTTP(S)
+const allow = entries.filter((e) => !e.includes(':'))
+// names and ports for raw TCP, each forwarded on its port
+const forwards = entries
+  .filter((e) => e.includes(':'))
+  .map((e) => ({ host: e.substring(0, e.lastIndexOf(':')), port: parseInt(e.substring(e.lastIndexOf(':') + 1), 10) }))
+// entries of both kinds that a ceiling allows only through a pattern: they
+// reach no private address, like a pattern
+const publicOnly = JSON.parse(process.env.HAMMERKIT_PUBLIC_ONLY || '[]').map((h) => h.toLowerCase())
+// the names of the needed services, for tools that ignore NO_PROXY: exact
+// names only, never patterns
+const needs = JSON.parse(process.env.HAMMERKIT_NEEDS || '[]').map((h) => h.toLowerCase())
+// the endpoints of secret providers, for a request with the token only
+const secretAllow = JSON.parse(process.env.HAMMERKIT_SECRET_ALLOW || '[]').map((h) => h.toLowerCase())
+const secretToken = process.env.HAMMERKIT_SECRET_TOKEN || ''
+const port = parseInt(process.env.HAMMERKIT_PROXY_PORT || '${exports.EGRESS_PROXY_PORT}', 10)
+// the name whose address the proxy listens on, every address when unset
+const bind = process.env.HAMMERKIT_PROXY_BIND
+const refused = new Set()
+const httpsUrls = new Set()
+function emit(event) {
+  process.stdout.write(JSON.stringify(event) + '\\n')
+}
+// the rule that allows a host and port: its exact name, a wildcard, or none
+function allowedBy(host, port) {
+  const name = host.toLowerCase().replace(/\\.$/, '')
+  if (needs.includes(name)) {
+    return 'exact'
+  }
+  const named = []
+  if (allow.includes(name)) {
+    named.push(name)
+  }
+  if (forwards.some((f) => f.host === name && f.port === port)) {
+    named.push(name + ':' + port)
+  }
+  if (named.length > 0) {
+    return named.some((entry) => !publicOnly.includes(entry)) ? 'exact' : 'wildcard'
+  }
+  return allow.some((rule) => rule.startsWith('*.') && name.endsWith(rule.substring(1))) ? 'wildcard' : null
+}
+// Whether the request carries the token as the password of Proxy-Authorization (Basic).
+function hasSecretToken(req) {
+  if (secretToken.length === 0) {
+    return false
+  }
+  const match = /^basic\\s+(\\S+)$/i.exec(String(req.headers['proxy-authorization'] || ''))
+  if (!match) {
+    return false
+  }
+  const credentials = Buffer.from(match[1], 'base64').toString('utf8')
+  const colon = credentials.indexOf(':')
+  if (colon < 0) {
+    return false
+  }
+  const given = Buffer.from(credentials.substring(colon + 1), 'utf8')
+  const expected = Buffer.from(secretToken, 'utf8')
+  return given.length === expected.length && crypto.timingSafeEqual(given, expected)
+}
+// the rule of a tunnel to an endpoint of a secret provider: like a wildcard, it reaches
+// no private address
+function allowedForSecrets(req, host, port) {
+  const name = host.toLowerCase().replace(/\\.$/, '')
+  const listed = secretAllow.some((rule) => (rule.startsWith('*.') ? name.endsWith(rule.substring(1)) : name === rule))
+  return listed && port === 443 && hasSecretToken(req) ? 'wildcard' : null
+}
+function ipv4(address) {
+  const mapped = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/i.exec(address)
+  const value = mapped ? mapped[1] : address
+  return net.isIPv4(value) ? value.split('.').map(Number) : null
+}
+// never allowed: the cloud metadata service lives there
+function isLinkLocal(address) {
+  const v4 = ipv4(address)
+  return v4 ? v4[0] === 169 && v4[1] === 254 : /^fe[89ab]/i.test(address)
+}
+// the host, its private networks (Docker's bridges among them) and the
+// cluster: only for a name listed exactly, such as a needed service
+function isInternal(address) {
+  const v4 = ipv4(address)
+  if (v4) {
+    const [a, b] = v4
+    return (
+      a === 0 ||
+      a === 10 ||
+      a === 127 ||
+      (a === 100 && b >= 64 && b < 128) ||
+      (a === 172 && b >= 16 && b < 32) ||
+      (a === 192 && b === 168)
+    )
+  }
+  return address === '::' || address === '::1' || /^f[cd]/i.test(address)
+}
+// The proxy resolves the name itself and connects only to the addresses it
+// checked, each in turn (a name can have an IPv6 address the network has no
+// route to).
+function resolve(host, rule, callback) {
+  dns.lookup(host, { all: true }, (err, addresses) => {
+    if (err || addresses.length === 0) {
+      callback(err || new Error('no address'), null)
+      return
+    }
+    const blocked = addresses.some((a) => isLinkLocal(a.address) || (rule !== 'exact' && isInternal(a.address)))
+    callback(null, blocked ? null : addresses)
+  })
+}
+// connection options that reach the checked addresses and nothing else
+function connectTo(host, addresses) {
+  const lookup = (hostname, options, callback) => {
+    const cb = typeof options === 'function' ? options : callback
+    if (typeof options === 'object' && options && options.all) {
+      cb(null, addresses)
+    } else {
+      cb(null, addresses[0].address, addresses[0].family)
+    }
+  }
+  return { host, lookup, autoSelectFamily: true }
+}
+function refuse(host) {
+  if (!refused.has(host)) {
+    refused.add(host)
+    emit({ type: 'refused', host })
+  }
+}
+function httpsUrl(host) {
+  if (!httpsUrls.has(host)) {
+    httpsUrls.add(host)
+    emit({ type: 'https-url', host })
+  }
+}
+function parseAuthority(value) {
+  const match = /^\\[([^\\]]+)\\](?::(\\d+))?$/.exec(value) || /^([^:]+)(?::(\\d+))?$/.exec(value)
+  return match ? { host: match[1], port: match[2] ? parseInt(match[2], 10) : 443 } : null
+}
+const server = http.createServer((req, res) => {
+  let url
+  try {
+    url = new URL(req.url)
+  } catch (e) {
+    res.writeHead(400, { 'content-type': 'text/plain' })
+    res.end('hammerkit: only proxy requests are served\\n')
+    return
+  }
+  // BusyBox wget sends an https URL to the proxy as it is: TLS belongs between
+  // the client and the host, so only a CONNECT tunnel reaches an https host
+  if (url.protocol === 'https:' && allowedBy(url.hostname, parseInt(url.port || '443', 10))) {
+    httpsUrl(url.hostname)
+    res.writeHead(501, { 'content-type': 'text/plain' })
+    res.end('hammerkit: ' + url.hostname + ' is allowed through a CONNECT tunnel only, not by its https URL\\n')
+    return
+  }
+  const rule = url.protocol === 'http:' ? allowedBy(url.hostname, parseInt(url.port || '80', 10)) : null
+  if (!rule) {
+    refuse(url.hostname)
+    res.writeHead(403, { 'content-type': 'text/plain' })
+    res.end('hammerkit: network access to ' + url.hostname + ' is not allowed\\n')
+    return
+  }
+  resolve(url.hostname, rule, (err, addresses) => {
+    if (err) {
+      res.writeHead(502, { 'content-type': 'text/plain' })
+      res.end()
+      return
+    }
+    if (!addresses) {
+      refuse(url.hostname)
+      res.writeHead(403, { 'content-type': 'text/plain' })
+      res.end('hammerkit: ' + url.hostname + ' resolves to an address that is not allowed\\n')
+      return
+    }
+    const headers = Object.assign({}, req.headers)
+    delete headers['proxy-connection']
+    delete headers['proxy-authorization']
+    // the absolute URL wins over a Host header that disagrees
+    headers.host = url.host
+    const upstream = http.request(
+      Object.assign(connectTo(url.hostname, addresses), {
+        port: url.port || 80,
+        method: req.method,
+        path: url.pathname + url.search,
+        headers,
+      }),
+      (response) => {
+        res.writeHead(response.statusCode || 502, response.headers)
+        response.pipe(res)
+      }
+    )
+    upstream.on('error', () => {
+      if (!res.headersSent) {
+        res.writeHead(502, { 'content-type': 'text/plain' })
+      }
+      res.end()
+    })
+    req.pipe(upstream)
+  })
+})
+server.on('connect', (req, socket, head) => {
+  const target = parseAuthority(req.url || '')
+  socket.on('error', () => socket.destroy())
+  const rule = target ? allowedBy(target.host, target.port) || allowedForSecrets(req, target.host, target.port) : null
+  if (!rule) {
+    refuse(target ? target.host : String(req.url))
+    socket.end('HTTP/1.1 403 Forbidden\\r\\ncontent-type: text/plain\\r\\n\\r\\nhammerkit: network access is not allowed\\n')
+    return
+  }
+  resolve(target.host, rule, (err, addresses) => {
+    if (err) {
+      socket.end('HTTP/1.1 502 Bad Gateway\\r\\n\\r\\n')
+      return
+    }
+    if (!addresses) {
+      refuse(target.host)
+      socket.end('HTTP/1.1 403 Forbidden\\r\\ncontent-type: text/plain\\r\\n\\r\\nhammerkit: network access is not allowed\\n')
+      return
+    }
+    let established = false
+    const upstream = net.connect(Object.assign(connectTo(target.host, addresses), { port: target.port }), () => {
+      established = true
+      socket.write('HTTP/1.1 200 Connection Established\\r\\n\\r\\n')
+      if (head && head.length > 0) {
+        upstream.write(head)
+      }
+      upstream.pipe(socket)
+      socket.pipe(upstream)
+    })
+    upstream.on('error', () => {
+      if (established) {
+        socket.destroy()
+      } else {
+        socket.end('HTTP/1.1 502 Bad Gateway\\r\\n\\r\\n')
+      }
+    })
+    socket.on('close', () => upstream.destroy())
+  })
+})
+// A TCP forward: each connection goes to the checked addresses of its host,
+// on the same port.
+function forward(target) {
+  return net.createServer({ allowHalfOpen: true }, (client) => {
+    client.on('error', () => client.destroy())
+    resolve(target.host, allowedBy(target.host, target.port), (err, addresses) => {
+      if (err || !addresses) {
+        if (!err) {
+          refuse(target.host)
+        }
+        client.destroy()
+        return
+      }
+      const upstream = net.connect(Object.assign(connectTo(target.host, addresses), { port: target.port }))
+      upstream.on('error', () => client.destroy())
+      client.on('close', () => upstream.destroy())
+      client.pipe(upstream)
+      upstream.pipe(client)
+    })
+  })
+}
+function listen(address) {
+  const servers = [{ server, port }].concat(forwards.map((f) => ({ server: forward(f), port: f.port })))
+  let pending = servers.length
+  for (const entry of servers) {
+    entry.server.on('error', (err) => {
+      process.stderr.write('hammerkit: unable to listen on port ' + entry.port + ': ' + err.message + '\\n')
+      process.exit(1)
+    })
+    entry.server.listen(entry.port, address, () => {
+      pending--
+      if (pending === 0) {
+        emit({ type: 'ready' })
+      }
+    })
+  }
+}
+if (bind) {
+  dns.lookup(bind, { family: 4 }, (err, address) => {
+    if (err) {
+      process.stderr.write('hammerkit: unable to resolve ' + bind + ': ' + err.message + '\\n')
+      process.exit(1)
+    }
+    listen(address)
+  })
+} else {
+  listen(undefined)
+}
+process.on('SIGTERM', () => process.exit(0))
+`;
+function getEgressProxyCommand() {
+    return ['node', '-e', exports.EGRESS_PROXY_SCRIPT];
+}
+exports.getEgressProxyCommand = getEgressProxyCommand;
+// `needs` are the names of the needed services, allowed as exactly those
+// names. `bind` is the name the proxy listens on alone, so that nothing on its
+// other networks reaches it. `publicOnly` are the entries of `hosts` that reach
+// no private address (see WorkNetwork). The endpoints of secret providers and
+// the token they need are set by the caller (getSecretProxyEnvironment).
+function getEgressProxyEnvironment(hosts, needs, bind, publicOnly = []) {
+    return {
+        HAMMERKIT_ALLOW: JSON.stringify(hosts),
+        ...(publicOnly.length > 0 ? { HAMMERKIT_PUBLIC_ONLY: JSON.stringify(publicOnly) } : {}),
+        HAMMERKIT_NEEDS: JSON.stringify(needs),
+        HAMMERKIT_PROXY_PORT: `${exports.EGRESS_PROXY_PORT}`,
+        ...(bind ? { HAMMERKIT_PROXY_BIND: bind } : {}),
+    };
+}
+exports.getEgressProxyEnvironment = getEgressProxyEnvironment;
+// The endpoints of secret providers the proxy lets a tunnel with its token reach; the
+// token itself is set where the proxy runs, see HAMMERKIT_SECRET_TOKEN.
+function getSecretProxyEnvironment(hosts) {
+    return hosts.length > 0 ? { HAMMERKIT_SECRET_ALLOW: JSON.stringify(hosts) } : {};
+}
+exports.getSecretProxyEnvironment = getSecretProxyEnvironment;
+// The proxy of a task or service: the hosts of its network in this run (under
+// the run's ceiling), and the names of the services it needs, on every runtime.
+function getItemProxyEnvironment(item, bind) {
+    const network = (0, work_network_1.getEffectiveNetwork)(item.data);
+    return getEgressProxyEnvironment(network.type === 'allow' ? network.hosts : [], item.needs.map((need) => need.name), bind, network.type === 'allow' ? network.publicOnly ?? [] : []);
+}
+exports.getItemProxyEnvironment = getItemProxyEnvironment;
+// The variables that send the item's HTTP(S) through the proxy, both spellings
+// since tools read either. The services it needs are reached directly.
+// The ports the proxy of a network listens on: its own, and one per TCP forward.
+function getEgressProxyPorts(network) {
+    return [exports.EGRESS_PROXY_PORT, ...(0, work_network_1.getTcpForwards)(network).map((forward) => forward.port)];
+}
+exports.getEgressProxyPorts = getEgressProxyPorts;
+// `token` is sent as the password, for the endpoints of secret providers.
+function getProxyClientEnvironment(directHosts, token) {
+    const proxy = `http://${token !== undefined ? `hammerkit:${token}@` : ''}${exports.EGRESS_PROXY_HOST}:${exports.EGRESS_PROXY_PORT}`;
+    const noProxy = ['localhost', '127.0.0.1', ...directHosts].join(',');
+    return {
+        HTTP_PROXY: proxy,
+        HTTPS_PROXY: proxy,
+        NO_PROXY: noProxy,
+        http_proxy: proxy,
+        https_proxy: proxy,
+        no_proxy: noProxy,
+    };
+}
+exports.getProxyClientEnvironment = getProxyClientEnvironment;
+// The proxy variables emptied: a healthcheck checks the service itself, and
+// tools that ignore NO_PROXY (busybox wget) would ask the proxy for localhost.
+function getProxylessEnvironment(env) {
+    const proxyKeys = Object.keys(env).filter((key) => /^(https?|no)_proxy$/i.test(key));
+    return proxyKeys.length > 0 ? Object.fromEntries(proxyKeys.map((key) => [key, ''])) : undefined;
+}
+exports.getProxylessEnvironment = getProxylessEnvironment;
+// One line of the proxy's stdout, null for anything else.
+function parseEgressProxyEvent(line) {
+    try {
+        const value = JSON.parse(line);
+        if (value?.type === 'ready') {
+            return { type: 'ready' };
+        }
+        if ((value?.type === 'refused' || value?.type === 'https-url') && typeof value.host === 'string') {
+            return { type: value.type, host: value.host };
+        }
+    }
+    catch {
+        // not an event
+    }
+    return null;
+}
+exports.parseEgressProxyEvent = parseEgressProxyEvent;
+function formatRefusedHost(host) {
+    return `network: refused ${host}`;
+}
+exports.formatRefusedHost = formatRefusedHost;
+// The line of an event other than `ready` in the item's log.
+function formatEgressProxyEvent(event) {
+    if (event.type === 'https-url') {
+        return (`network: ${event.host} is allowed, but the client asked the proxy for its https URL instead of ` +
+            'tunneling with CONNECT (BusyBox wget does), use curl or GNU wget');
+    }
+    return formatRefusedHost(event.host);
+}
+exports.formatEgressProxyEvent = formatEgressProxyEvent;
+//# sourceMappingURL=egress-proxy.js.map

package/dist/network/port-relay.js

@@ -0,0 +1,35 @@
+"use strict";
+// The published ports of a service with a limited network. Docker publishes
+// ports only on a network with a way out, which a limited service must not
+// have, so a relay container on the default bridge publishes them and passes
+// each connection on to the service over the service's internal network.
+// Like the egress proxy, it is a script for `node -e` in a stock Node image.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPortRelayEnvironment = exports.getPortRelayCommand = exports.PORT_RELAY_SCRIPT = void 0;
+// Kept free of anything but Node's own modules.
+exports.PORT_RELAY_SCRIPT = `
+const net = require('net')
+const targets = JSON.parse(process.env.HAMMERKIT_RELAY || '[]')
+for (const target of targets) {
+  // a client that ends its side still gets the answer
+  net
+    .createServer({ allowHalfOpen: true }, (client) => {
+      const upstream = net.connect(target.targetPort, target.host)
+      client.on('error', () => upstream.destroy())
+      upstream.on('error', () => client.destroy())
+      client.pipe(upstream)
+      upstream.pipe(client)
+    })
+    .listen(target.port)
+}
+process.on('SIGTERM', () => process.exit(0))
+`;
+function getPortRelayCommand() {
+    return ['node', '-e', exports.PORT_RELAY_SCRIPT];
+}
+exports.getPortRelayCommand = getPortRelayCommand;
+function getPortRelayEnvironment(targets) {
+    return { HAMMERKIT_RELAY: JSON.stringify(targets) };
+}
+exports.getPortRelayEnvironment = getPortRelayEnvironment;
+//# sourceMappingURL=port-relay.js.map

package/dist/optimizer/get-work-cache-stats.js

@@ -4,6 +4,7 @@ exports.getStateKey = exports.getWorkItemCacheStats = exports.getWorkCacheStats
 const calculate_checksum_1 = require("./calculate-checksum");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
+const promises_1 = require("fs/promises");
 function isExcluded(path, excluded) {
     return excluded.some((excludedPath) => path === excludedPath || path.startsWith(excludedPath + path_1.sep));
 }
@@ -11,6 +12,21 @@ async function addWorkCacheStats(result, cwd, path, matcher, context, root, excl
     if (isExcluded(path, excluded)) {
         return 0;
     }
+    // On a server the files were written by a commit or a task: a link is a source as it is,
+    // its target, and never followed. A `**` would walk `x -> /` through the server's disk.
+    if (context.hosted) {
+        const link = await (0, promises_1.lstat)(path).catch(() => undefined);
+        if (link?.isSymbolicLink()) {
+            if (!matcher(path)) {
+                return 0;
+            }
+            const checksum = (0, crypto_1.createHash)('sha1')
+                .update(`link:${await (0, promises_1.readlink)(path)}`)
+                .digest('hex');
+            result.files[(0, path_1.relative)(cwd, path).split(path_1.sep).join(path_1.posix.sep)] = { lastModified: link.mtimeMs, checksum };
+            return 1;
+        }
+    }
     const exists = await context.file.exists(path);
     if (!exists) {
         return 0;

package/dist/optimizer/work-task-cache-description.js

@@ -6,6 +6,7 @@ const crypto_1 = require("crypto");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const portable_path_1 = require("../planner/utils/portable-path");
 const work_secret_1 = require("../planner/work-secret");
+const claim_layout_1 = require("../kubernetes/claim-layout");
 // Every path is made project-relative (portablePath) so the description, and the
 // task id hashed from it, is identical wherever the project is checked out.
 //
@@ -24,8 +25,9 @@ function getWorkTaskCacheDescription(item) {
         shell: task.shell ?? undefined,
         platform: task.type === 'container-task' ? task.image : (0, os_1.platform)(),
         // outputs hold native binaries, and docker pulls images for the host
-        // architecture, so container tasks are keyed by it too
-        arch: process.arch,
+        // architecture, so container tasks are keyed by it too; on a cluster it is the
+        // one of the nodes the task runs on
+        arch: (task.type === 'container-task' && task.arch) || process.arch,
         generates: task.generates.map((g) => portable(g.path)).sort() ?? undefined,
         src: task.src.map((s) => s.source).sort() ?? undefined,
         envs: Object.keys(envs)
@@ -39,6 +41,7 @@ function getWorkTaskCacheDescription(item) {
         cwd: portable(task.cwd),
         deps: item.deps.length > 0 ? item.deps.map((dep) => dep.id()).sort() : undefined,
         secrets: cachedSecrets.length > 0 ? cachedSecrets : undefined,
+        claimLayout: (0, claim_layout_1.hasPathsEndingAlike)(item) || (0, claim_layout_1.hasOutputsFlatteningAlike)(item) ? 2 : undefined,
     };
 }
 exports.getWorkTaskCacheDescription = getWorkTaskCacheDescription;

package/dist/planner/service-definition.js

@@ -4,6 +4,7 @@ exports.getServiceDefinitionHash = void 0;
 const crypto_1 = require("crypto");
 const work_secret_1 = require("./work-secret");
 const work_service_1 = require("./work-service");
+const work_network_1 = require("./work-network");
 const work_cache_id_1 = require("./work-cache-id");
 // Everything a running container of the service was created from, plus the
 // definitions of the services it needs: a dependent links to the container it
@@ -12,6 +13,7 @@ const work_cache_id_1 = require("./work-cache-id");
 // service whose definition changed instead of silently reusing it.
 function getServiceDefinitionHash(item) {
     const service = item.data;
+    const network = (0, work_network_1.getEffectiveNetwork)(service);
     const definition = {
         image: service.image,
         cmd: service.cmd?.cmd ?? null,
@@ -38,6 +40,9 @@ function getServiceDefinitionHash(item) {
             .map((need) => `${need.name}=${getServiceDefinitionHash(need.service)}`),
         // only when declared, so a service without keeps its hash
         ...(service.resources ? { resources: service.resources } : {}),
+        // in this run, under its `--network` ceiling: a service started open is
+        // recreated for a run that limits it
+        ...((0, work_network_1.isLimitedNetwork)(network) ? { network } : {}),
     };
     return (0, crypto_1.createHash)('sha1').update(JSON.stringify(definition)).digest('hex');
 }

package/dist/planner/utils/append-work-dependencies.js

@@ -19,7 +19,10 @@ function appendWorkDependencies(workTree, referenced, item, environment, context
         }
         if (((0, work_task_1.isContainerWorkTask)(depNode.data) || (0, work_service_1.isContainerWorkService)(depNode.data)) &&
             ((0, work_task_1.isContainerWorkTask)(item.data) || (0, work_service_1.isContainerWorkService)(item.data))) {
+            // the outputs of the dep's own deps too, which stay those of the task that made them
+            // (on Kubernetes, they are in its claim)
             for (const generate of depNode.data.generates) {
+                const inherited = generate.inherited ?? depNode;
                 if (generate.isFile) {
                     // TODO check if thats correct
                     continue;
@@ -31,7 +34,7 @@ function appendWorkDependencies(workTree, referenced, item, environment, context
                             export: false,
                             resetOnChange: false,
                             containerPath: generate.path,
-                            inherited: depNode,
+                            inherited,
                             readOnly: false,
                         });
                     }
@@ -44,7 +47,7 @@ function appendWorkDependencies(workTree, referenced, item, environment, context
                             exportAlways: false,
                             resetOnChange: false,
                             path: generate.path,
-                            inherited: depNode,
+                            inherited,
                             isFile: false,
                         });
                     }

package/dist/planner/utils/append-work-environment.js

@@ -15,6 +15,8 @@ function appendWorkEnvironment(referenced) {
             kubeConfig: referenced.schema.kubernetes.kubeconfig,
             httpRoutes: referenced.schema.kubernetes.httpRoutes || [],
             namespace: referenced.schema.kubernetes.namespace ?? 'default',
+            networkPolicyEnforced: referenced.schema.kubernetes.networkPolicy === 'enforced',
+            ...(referenced.schema.kubernetes.volumeSize ? { volumeSize: referenced.schema.kubernetes.volumeSize } : {}),
         };
     }
 }

package/dist/planner/utils/append-work-service.js

@@ -23,6 +23,7 @@ const resolve_cache_1 = require("../../cache/resolve-cache");
 const units_1 = require("../../utils/units");
 const log_1 = require("../../log");
 const work_resources_1 = require("../work-resources");
+const work_network_1 = require("../work-network");
 function appendWorkService(workTree, service, environment, context) {
     const workService = parseService(workTree, service, environment, context);
     if (!workTree.services[workService.name]) {
@@ -116,6 +117,10 @@ function parseService(workTree, service, environment, context) {
             init: null,
             secrets: (0, work_secret_1.parseWorkSecrets)(service.cwd, context.projectRoot, service.schema.secrets, envs, environment, context.secrets, service.schema.account),
             resources: (0, work_resources_1.parseWorkResources)(service.schema.resources),
+            volumeSize: service.schema.volumeSize ?? null,
+            network: (0, work_network_1.parseWorkNetwork)(service.schema.network),
+            networkCeiling: null,
+            args: service.schema.args ?? null,
         };
     }
 }

package/dist/planner/utils/append-work-task.js

@@ -19,8 +19,17 @@ const get_work_runtime_1 = require("./get-work-runtime");
 const resolve_cache_1 = require("../../cache/resolve-cache");
 const units_1 = require("../../utils/units");
 const work_resources_1 = require("../work-resources");
+const job_placement_1 = require("../../kubernetes/job-placement");
+const work_network_1 = require("../work-network");
 function appendWorkTask(workTree, cwd, referenceTask, environment, context) {
-    const task = parseTask(cwd, referenceTask, environment, context);
+    const parsed = parseTask(cwd, referenceTask, environment, context);
+    // on a server's cluster a local task runs in a tool image like a container task
+    const server = workTree.environment.type === 'kubernetes' ? workTree.environment.server : undefined;
+    const task = !server
+        ? parsed
+        : parsed.type === 'local-task'
+            ? (0, job_placement_1.runInToolImage)(parsed, server, referenceTask.schema.platform)
+            : (0, job_placement_1.placeOnPool)(parsed, server);
     if (!workTree.tasks[task.name]) {
         const workItem = {
             // A dependency cycle is rejected before anything runs (checkForLoop), but
@@ -72,6 +81,9 @@ function parseTask(cwd, task, environment, context) {
         timeout: task.schema.timeout ? (0, units_1.parseDuration)(task.schema.timeout) : null,
         secrets: (0, work_secret_1.parseWorkSecrets)(cwd, context.projectRoot, task.schema.secrets, envs, environment, context.secrets, task.schema.account),
         resources: (0, work_resources_1.parseWorkResources)(task.schema.resources),
+        network: (0, work_network_1.parseWorkNetwork)(task.schema.network),
+        networkCeiling: null,
+        args: task.schema.args ?? null,
         runner: task.schema.runner ?? task.scope.schema.runner ?? null,
     };
     if ((0, build_file_task_schema_1.isBuildFileContainerTaskSchema)(task.schema)) {
@@ -81,6 +93,7 @@ function parseTask(cwd, task, environment, context) {
             user: (0, get_container_user_1.getContainerUser)(),
             image: (0, template_value_1.templateValue)(task.schema.image, envs),
             mounts: (0, parse_work_mounts_1.parseWorkMounts)(cwd, task.schema, envs),
+            volumeSize: task.schema.volumeSize ?? null,
         };
     }
     else {
@@ -88,6 +101,12 @@ function parseTask(cwd, task, environment, context) {
         if (fileSecret) {
             throw new Error(`task ${task.relativeName}: a local task takes secrets as env only (${(0, work_secret_1.getSecretName)(fileSecret)})`);
         }
+        // on a server's cluster it runs in a pod of a pool's tool image (runInToolImage)
+        const contained = !!environment.hosted?.kubernetes || !!environment.hosted?.localTasksInContainers;
+        if (baseWorkNode.network.type !== 'open' && !contained) {
+            throw new Error(`task ${task.relativeName}: network ${(0, work_network_1.formatNetwork)(baseWorkNode.network)} needs a container, ` +
+                `hammerkit can't limit the network of a local task`);
+        }
         return {
             ...baseWorkNode,
             type: 'local-task',