hammerkit 1.27.0-next.21 → 1.27.0-next.23

package/dist/server/kubernetes-backend.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.awaitRunObjectsGone = exports.removeRunObjects = exports.CallerNamespaces = exports.getVolumeScope = exports.KubernetesExecutor = exports.getRunRoleBinding = exports.removeServiceRunNamespace = exports.getServerIngressPolicy = exports.getNamespacePolicies = exports.getClusterAccess = exports.isCallerNamespace = exports.SERVICE_RUN_LABEL = exports.getServiceRunNamespace = exports.getCallerNamespace = void 0;
+exports.awaitRunObjectsGone = exports.removeRunObjects = exports.CallerNamespaces = exports.getVolumeScope = exports.getPrivilegedNamespaceProblem = exports.getCapabilitiesProblem = exports.getPodSecurityLabels = exports.KubernetesExecutor = exports.getRunRoleBinding = exports.removeServiceRunNamespace = exports.getServerIngressPolicy = exports.getNamespacePolicies = exports.getClusterAccess = exports.isCallerNamespace = exports.SERVICE_RUN_LABEL = exports.getServiceRunNamespace = exports.getCallerNamespace = void 0;
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -368,11 +368,12 @@ class KubernetesExecutor {
                     return { kubernetes: this.environmentOf(run, namespace), env: this.access.env };
                 }
                 const label = (0, job_placement_1.getRunLabelValue)(run.id);
+                let capabilitiesProblem;
                 await this.enqueue(namespace, async () => {
                     if (context.signal.aborted) {
                         throw new Error('the run was cancelled');
                     }
-                    await this.namespaces.prepare(namespace);
+                    capabilitiesProblem = await this.namespaces.prepare(namespace);
                     // what an earlier run left when the server stopped before its end, or when its
                     // release failed: the objects of a run that does not execute. One that starts
                     // after this waits for it here before it makes any.
@@ -394,7 +395,10 @@ class KubernetesExecutor {
                 });
                 this.sweepLeftClaims();
                 context.emit({ type: 'log', task: 'hammerkit', stream: 'stdout', text: `runs in the namespace ${namespace}` });
-                return { kubernetes: this.environmentOf(run, namespace, work), env: this.access.env };
+                return {
+                    kubernetes: this.environmentOf(run, namespace, work, capabilitiesProblem),
+                    env: this.access.env,
+                };
             },
             release: async (run, context) => {
                 const namespace = this.namespaceOf(run);
@@ -462,7 +466,7 @@ class KubernetesExecutor {
         };
     }
     // The cluster as the process of a run sees it: the namespace its tasks and services go in.
-    environmentOf(run, namespace, work) {
+    environmentOf(run, namespace, work, capabilitiesProblem) {
         const backend = this.config.backend;
         return {
             type: 'kubernetes',
@@ -483,6 +487,14 @@ class KubernetesExecutor {
                 ...(work?.claim ? { workspace: getWorkspace(work.root, work.claim, namespace, backend.sandboxes.runner) } : {}),
                 // the claims of a service run go with its namespace
                 ...(this.keep > 0 && !run.up ? { volumeScope: getVolumeScope(run) } : {}),
+                ...(backend.capabilities
+                    ? {
+                        capabilities: {
+                            runtimeClass: backend.capabilities.runtimeClass,
+                            ...(capabilitiesProblem ? { unavailable: capabilitiesProblem } : {}),
+                        },
+                    }
+                    : {}),
             },
         };
     }
@@ -565,6 +577,50 @@ class KubernetesExecutor {
     }
 }
 exports.KubernetesExecutor = KubernetesExecutor;
+const ENFORCE_LABEL = 'pod-security.kubernetes.io/enforce';
+const AUDIT_LABEL = 'pod-security.kubernetes.io/audit';
+/**
+ * The Pod Security level a caller's namespace is made with: `baseline`, no privileged pods,
+ * host paths or host network, whatever a build asks. `baseline` also refuses the capabilities
+ * of `backend.capabilities`, sandboxed or not: with them the namespace enforces `privileged`
+ * and audits `baseline`, and the operator's admission policy (see the docs on capabilities)
+ * refuses what `baseline` would to a pod outside the sandbox's RuntimeClass.
+ */
+function getPodSecurityLabels(backend) {
+    return backend.capabilities
+        ? { [ENFORCE_LABEL]: 'privileged', [AUDIT_LABEL]: 'baseline' }
+        : { [ENFORCE_LABEL]: 'baseline' };
+}
+exports.getPodSecurityLabels = getPodSecurityLabels;
+/**
+ * The server never changes the level of a namespace it made (that would take `patch` on every
+ * namespace of the cluster): one made before `backend.capabilities` is relabelled by the
+ * operator. Until then its tasks that add capabilities fail with this, the others run.
+ */
+function getCapabilitiesProblem(namespace, labels, backend) {
+    const enforce = labels?.[ENFORCE_LABEL];
+    if (!backend.capabilities || enforce === 'privileged') {
+        return undefined;
+    }
+    return (`the namespace ${namespace} was made before backend.capabilities and enforces ` +
+        `${enforce ? `Pod Security ${enforce}` : 'no Pod Security level of its own'}, not privileged: kubectl label namespace ${namespace} ` +
+        `${ENFORCE_LABEL}=privileged ${AUDIT_LABEL}=baseline --overwrite`);
+}
+exports.getCapabilitiesProblem = getCapabilitiesProblem;
+/**
+ * A namespace made while the server had `backend.capabilities` admits privileged pods but for
+ * the operator's admission policy. Without capabilities the server runs nothing in it until the
+ * operator sets it back.
+ */
+function getPrivilegedNamespaceProblem(namespace, labels, backend) {
+    if (backend.capabilities || labels?.[ENFORCE_LABEL] !== 'privileged') {
+        return undefined;
+    }
+    return (`the namespace ${namespace} enforces Pod Security privileged, made while the server had ` +
+        `backend.capabilities, and the server runs nothing in it without them: kubectl label namespace ` +
+        `${namespace} ${ENFORCE_LABEL}=baseline ${AUDIT_LABEL}- --overwrite`);
+}
+exports.getPrivilegedNamespaceProblem = getPrivilegedNamespaceProblem;
 // What may mount a claim a run kept: the runs of the same repository, as they share the
 // cache, and on a sandbox the runs of that sandbox only, whose claim is on the same node or
 // zone as the kept ones. The owner is the namespace's.
@@ -595,7 +651,8 @@ class CallerNamespaces {
     // are admitted under a quota on compute. All of it is replaced when the server sets up
     // a namespace it did not set up in the last `NAMESPACE_SETUP_REUSE_MS` (it reads the
     // config once, at its start), so the namespace follows the config; a namespace made anew
-    // since (deleted and made again) is set up again at once.
+    // since (deleted and made again) is set up again at once. Returns what keeps the tasks that
+    // add capabilities from running in it (getCapabilitiesProblem), if anything.
     async prepare(namespace, 
     // a service run's own namespace: its label, the namespace of the server that reaches its
     // endpoints, and its quota
@@ -613,6 +670,12 @@ class CallerNamespaces {
         if (existing && existing.metadata?.labels?.[MANAGED_LABEL] !== 'true') {
             throw new Error(`the namespace ${namespace} was not made by hammerkit, the server does not run tasks in it`);
         }
+        const privileged = getPrivilegedNamespaceProblem(namespace, existing?.metadata?.labels, backend);
+        if (privileged) {
+            throw new Error(privileged);
+        }
+        // one made by another run of this server at the same time has the labels of its config
+        const problem = () => getCapabilitiesProblem(namespace, existing?.metadata?.labels ?? getPodSecurityLabels(backend), backend);
         const started = Date.now();
         const applied = this.applied.get(namespace);
         if (existing &&
@@ -620,7 +683,7 @@ class CallerNamespaces {
             applied &&
             applied.uid === existing.metadata?.uid &&
             started - applied.at < NAMESPACE_SETUP_REUSE_MS) {
-            return;
+            return problem();
         }
         this.applied.delete(namespace);
         if (!existing) {
@@ -633,8 +696,7 @@ class CallerNamespaces {
                                 [MANAGED_LABEL]: 'true',
                                 'hammerkit.dev/caller': namespace,
                                 ...(serviceRun ? { [exports.SERVICE_RUN_LABEL]: serviceRun.serviceRun } : {}),
-                                // no privileged pods, host paths or host network, whatever a build asks
-                                'pod-security.kubernetes.io/enforce': 'baseline',
+                                ...getPodSecurityLabels(backend),
                             },
                         },
                     },
@@ -703,6 +765,7 @@ class CallerNamespaces {
         if (uid) {
             this.applied.set(namespace, { uid, at: started });
         }
+        return problem();
     }
     whoAmI() {
         if (!this.subject) {

package/dist/server/plan.js

@@ -40,50 +40,33 @@ const COMMIT_PATTERN = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
 // A hash alone can only name what is inside the bundle, so everything a build
 // file pulls in from elsewhere has to be pinned: a git include needs a commit
 // and a remote that is not a path on the server.
-function findLooseIncludes(bundle, noRemote = false) {
+function checkGitSource(path, where, source, noRemote) {
+    if (noRemote === 'proposal') {
+        throw new DefinitionError(`${path}: ${where}: a proposal may not include from git, the server would fetch it before anybody approved it`);
+    }
+    if (noRemote === 'check') {
+        throw new DefinitionError(`${path}: ${where}: checking a build file that includes from git needs builds: publish, the server would fetch it`);
+    }
     const problems = [];
-    for (const [path, content] of Object.entries(bundle.files)) {
-        if (!/\.ya?ml$/i.test(path)) {
-            continue;
-        }
-        let document;
-        try {
-            document = (0, yaml_1.parse)(content);
-        }
-        catch {
-            continue; // a file that isn't valid yaml is reported when the bundle is parsed
-        }
-        for (const block of ['includes', 'references']) {
-            for (const [name, include] of Object.entries(document?.[block] ?? {})) {
-                const source = include;
-                if (!source || typeof source !== 'object' || source.git === undefined) {
-                    continue;
-                }
-                if (noRemote) {
-                    problems.push(`${path}: ${block}.${name}: a proposal may not include from git, the server would fetch it before anybody approved it`);
-                    continue;
-                }
-                if (typeof source.git !== 'string' || !/^(https:\/\/|ssh:\/\/|git@[\w.-]+:)/.test(source.git)) {
-                    problems.push(`${path}: ${block}.${name}: git has to be an https:// or ssh:// address`);
-                }
-                if (typeof source.ref !== 'string' || !COMMIT_PATTERN.test(source.ref)) {
-                    problems.push(`${path}: ${block}.${name}: pin ref to a commit, a branch or tag can move`);
-                }
-            }
-        }
+    if (!/^(https:\/\/|ssh:\/\/|git@[\w.-]+:)/.test(source.git)) {
+        problems.push(`${path}: ${where}: git has to be an https:// or ssh:// address`);
+    }
+    if (typeof source.ref !== 'string' || !COMMIT_PATTERN.test(source.ref)) {
+        problems.push(`${path}: ${where}: pin ref to a commit, a branch or tag can move`);
+    }
+    if (problems.length > 0) {
+        throw new DefinitionError(problems.join('\n'));
     }
-    return problems;
 }
 // What a build file may not name on a server: the places it would run or store things
 // are the operator's. The docker host, a Kubernetes cluster and a remote cache are
 // credentials of the machine, not of the build file, and a project file that could carry
 // them could send runs, or the cache, anywhere.
-function findHostProblems(bundle) {
+// A file a server leaves out (`publish: false`) is not checked, and neither is a service
+// with `publish: false`: what is left out is never run there.
+function findHostProblems(files) {
     const problems = [];
-    for (const [path, content] of Object.entries(bundle.files)) {
-        if (!/\.ya?ml$/i.test(path)) {
-            continue;
-        }
+    for (const [path, content] of Object.entries(files)) {
         let document;
         try {
             document = (0, yaml_1.parse)(content);
@@ -105,6 +88,7 @@ function findHostProblems(bundle) {
         for (const [name, service] of Object.entries(document.services ?? {})) {
             if (service &&
                 typeof service === 'object' &&
+                service.publish !== false &&
                 ('selector' in service || 'kubeconfig' in service || 'context' in service)) {
                 problems.push(`${path}: services.${name}: Kubernetes services are not supported on a server`);
             }
@@ -112,6 +96,17 @@ function findHostProblems(bundle) {
     }
     return problems;
 }
+// The files of the bundle a server publishes, see getPublishedFiles
+function publishedBundleFiles(bundle, directory, entry) {
+    const files = {};
+    for (const scope of (0, reference_parser_1.getPublishedFiles)(entry)) {
+        const path = (0, path_1.relative)(directory, scope.fileName).split(path_1.sep).join('/');
+        if (!scope.remote && path in bundle.files) {
+            files[path] = bundle.files[path];
+        }
+    }
+    return files;
+}
 // What a build file may read while it is inspected: its own files. The rest of
 // the server is not its business (a missing file is "not there", not an error).
 function confined(files, root) {
@@ -193,6 +188,18 @@ function findItemPolicyProblems(item, policy, root) {
         problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
     }
     const data = item.data;
+    // a capability holds in the sandboxed runtime the operator named for it, so only those
+    // the operator allows are added
+    const refused = policy.capabilities
+        ? ('capAdd' in data ? data.capAdd : []).filter((capability) => !policy.capabilities?.includes(capability))
+        : [];
+    if (refused.length > 0) {
+        const from = policy.capabilitiesFrom ?? 'backend.capabilities.allow';
+        problems.push(`${item.name}: adds the ${refused.length > 1 ? 'capabilities' : 'capability'} ${refused.join(', ')}, ` +
+            (policy.capabilities && policy.capabilities.length > 0
+                ? `which this server does not allow (${from}: ${policy.capabilities.join(', ')})`
+                : `and this server allows none (${from})`));
+    }
     // what a task reads and writes is the bundle's: `src: ../..` would have the server
     // copy its own files (its credentials, other callers' caches) into the task
     for (const source of 'src' in data ? data.src : []) {
@@ -308,6 +315,10 @@ function toPlan(root, item) {
     if (data.scope.remote) {
         flags.push('remote-include');
     }
+    const capAdd = (0, work_task_1.isContainerWorkTask)(data) ? data.capAdd : [];
+    if (capAdd.length > 0) {
+        flags.push('capabilities');
+    }
     const isTask = data.type === 'local-task' || data.type === 'container-task';
     return {
         kind: isTask ? 'task' : 'service',
@@ -326,6 +337,7 @@ function toPlan(root, item) {
         mounts,
         ports,
         generates: 'generates' in data ? data.generates.map((generate) => generate.path) : [],
+        ...(capAdd.length > 0 ? { capAdd: [...capAdd] } : {}),
         flags,
     };
 }
@@ -342,10 +354,6 @@ function describeFailure(e) {
 // when somebody wants to run it. The same function answers what a run will do,
 // with the scope of the run: which tasks, services and accounts it involves.
 async function planBundle(bundle, environment, options = {}) {
-    const problems = [...findLooseIncludes(bundle, options.noRemote), ...(options.policy ? findHostProblems(bundle) : [])];
-    if (problems.length > 0) {
-        throw new DefinitionError(problems.join('\n'));
-    }
     const directory = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), 'hammerkit-definition-'));
     try {
         for (const [path, content] of Object.entries(bundle.files)) {
@@ -358,7 +366,20 @@ async function planBundle(bundle, environment, options = {}) {
             file: confined((0, get_file_context_1.getFileContext)(directory), directory),
         };
         try {
-            const { ctx, scope } = await (0, schema_parser_1.createParseContext)((0, path_1.join)(directory, bundle.entry), inspected);
+            const { ctx, scope } = await (0, schema_parser_1.createParseContext)((0, path_1.join)(directory, bundle.entry), inspected, {
+                // a hash alone can only name what is inside the bundle, see checkGitSource
+                checkGitSource: (source, from, block, name) => checkGitSource(
+                // a file of a git include is named by its repository
+                from.remote
+                    ? `${from.remote.git} ${(0, path_1.relative)(from.remote.root, from.fileName).split(path_1.sep).join('/')}`
+                    : (0, path_1.relative)(directory, from.fileName), `${block}.${name}`, source, options.noRemote),
+            });
+            if (options.policy) {
+                const problems = findHostProblems(publishedBundleFiles(bundle, directory, scope));
+                if (problems.length > 0) {
+                    throw new DefinitionError(problems.join('\n'));
+                }
+            }
             const context = await (0, reference_parser_1.parseReferences)(ctx, scope, inspected);
             const workTree = (0, work_scope_parser_1.getWorkContext)(context, options.scope ?? { environmentName: null }, inspected);
             const items = itemsOf(workTree);

package/dist/server/run-worker.js

@@ -51,6 +51,9 @@ exports.workerInputSchema = zod_1.z
     kubernetes: zod_1.z
         .custom((value) => typeof value === 'object' && value !== null && value.type === 'kubernetes')
         .optional(),
+    // on the server's docker host, the runtime a container that adds capabilities runs in
+    // (`backend.capabilities.runtime`)
+    capabilityRuntime: zod_1.z.string().min(1).optional(),
     // the most any task or service reaches besides its needs, as `--network`: `runs.network`
     network: network_schema_1.networkSchema.optional(),
     // for a run on a sandbox, `sandboxes.network`: the run gets the lower of the two
@@ -153,7 +156,12 @@ up) {
     // is what is streamed: it is redacted with the secrets of this run
     const environment = {
         processEnvs,
-        hosted: { catalog: input.catalog, accounts: input.accounts, kubernetes: input.kubernetes },
+        hosted: {
+            catalog: input.catalog,
+            accounts: input.accounts,
+            kubernetes: input.kubernetes,
+            capabilityRuntime: input.capabilityRuntime,
+        },
         abortCtrl,
         cwd: work,
         file: (0, get_file_context_1.getFileContext)(work),

package/dist/server/server-config.js

@@ -8,6 +8,7 @@ const log_1 = require("../log");
 const units_1 = require("../utils/units");
 const version_1 = require("../version");
 const network_schema_1 = require("../schema/network-schema");
+const capabilities_schema_1 = require("../schema/capabilities-schema");
 const build_file_secret_provider_schema_1 = require("../schema/build-file-secret-provider-schema");
 const repo_1 = require("./repo");
 const work_network_1 = require("../planner/work-network");
@@ -117,12 +118,24 @@ exports.accountSchema = zod_1.z
         });
     }
 });
+// The capabilities (`capAdd`) a task of a run may add, and the sandboxed runtime its
+// container then runs in, so they hold in the sandbox's own kernel and never in the host's
+const capabilitiesAllowSchema = zod_1.z
+    .array(zod_1.z.enum(capabilities_schema_1.LINUX_CAPABILITIES))
+    .min(1)
+    .refine((names) => new Set(names).size === names.length, 'a capability is listed twice');
 // The tasks of runs execute on this machine, with its docker daemon and local tools.
 const hostBackendSchema = zod_1.z
     .object({
     type: zod_1.z.literal('host'),
     // what this machine offers; detected when left out
     platform: exports.serverPlatformSchema.optional(),
+    // `runtime` is a runtime of the docker daemon (`runtimes` in its daemon.json), such as
+    // runsc of gVisor
+    capabilities: zod_1.z
+        .object({ allow: capabilitiesAllowSchema, runtime: zod_1.z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]*$/) })
+        .strict()
+        .optional(),
 })
     .strict();
 const tolerationSchema = zod_1.z
@@ -282,6 +295,9 @@ const kubernetesBackendSchema = zod_1.z
     // build file's environment does: hammerkit can't tell from the API, and without it a
     // task with a limited network fails rather than runs open
     networkPolicy: zod_1.z.literal('enforced').optional(),
+    // `runtimeClass` is a RuntimeClass of a sandbox, such as gvisor; the pods of tasks that
+    // add capabilities run in it
+    capabilities: zod_1.z.object({ allow: capabilitiesAllowSchema, runtimeClass: kubernetesNameSchema }).strict().optional(),
 })
     .strict();
 // the most a task's claim may request on a server whose operator states no maxVolumeSize
@@ -546,6 +562,9 @@ exports.serverConfigSchema = zod_1.z
             .object({ allow: zod_1.z.array(zod_1.z.string().regex(/^[A-Za-z_][A-Za-z0-9_()]*$/)).default([]) })
             .strict()
             .default({}),
+        // the capabilities of `backend.capabilities.allow` a task of a run on a sandbox may
+        // add: none by default, a sandbox holds code nobody reviewed
+        capabilities: zod_1.z.array(zod_1.z.enum(capabilities_schema_1.LINUX_CAPABILITIES)).default([]),
         // what one caller may keep; a sandbox over it can't be created
         limits: zod_1.z
             .object({
@@ -677,6 +696,16 @@ exports.serverConfigSchema = zod_1.z
             }
         }
     });
+    const allowed = config.backend.capabilities?.allow ?? [];
+    config.sandboxes.capabilities.forEach((capability, index) => {
+        if (!allowed.includes(capability)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['sandboxes', 'capabilities', index],
+                message: `the capability ${capability} is not in backend.capabilities.allow, no run may add it`,
+            });
+        }
+    });
     const sandboxNetwork = (0, work_network_1.parseWorkNetwork)(config.sandboxes.network);
     const runsNetwork = (0, work_network_1.parseWorkNetwork)(config.runs.network);
     if ((0, work_network_1.exceedsNetwork)(sandboxNetwork, runsNetwork)) {

package/dist/server/server.js

@@ -617,6 +617,7 @@ async function startServer(config, environment, options = {}) {
             network: (0, work_network_1.parseWorkNetwork)(config.runs.network),
             secretNetwork: (0, work_network_1.parseWorkNetwork)(config.runs.secretNetwork),
             args: config.runs.args,
+            capabilities: config.backend.capabilities?.allow ?? [],
             proxiedProviders: config.backend.type === 'kubernetes'
                 ? Object.entries(config.backend.providers)
                     .filter(([, provider]) => provider.allow)
@@ -657,6 +658,8 @@ async function startServer(config, environment, options = {}) {
             envs: config.sandboxes.env.allow,
             envsFrom: 'sandboxes.env.allow',
             runtimes: sandboxRuntimes,
+            capabilities: config.sandboxes.capabilities,
+            capabilitiesFrom: 'sandboxes.capabilities',
         },
     };
     if (sandboxRuntimes.length === 0 && config.entitlements.some((entitlement) => entitlement.sandboxes?.length)) {
@@ -676,6 +679,9 @@ async function startServer(config, environment, options = {}) {
         cache: (0, path_1.join)(storage, 'cache'),
         worker: options.worker,
         sandboxes: { ...sandboxes, network: config.sandboxes.network },
+        ...(config.backend.type === 'host' && config.backend.capabilities
+            ? { capabilityRuntime: config.backend.capabilities.runtime }
+            : {}),
         log,
     };
     const backend = config.backend;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.21",
+  "version": "1.27.0-next.23",
   "keywords": [
     "build",
     "build-tool",