hammerkit 1.27.0-next.3 → 1.27.0-next.30

package/build.schema.json

@@ -289,10 +289,16 @@
                     ],
                     "description": "network the task or service reaches besides its needs: open (default), none or { allow: [hosts or host:port] }"
                   },
+                  "args": {
+                    "type": "boolean"
+                  },
                   "runner": {
                     "type": "string",
                     "minLength": 1
                   },
+                  "publish": {
+                    "type": "boolean"
+                  },
                   "image": {
                     "type": "string"
                   },
@@ -305,6 +311,56 @@
                   "volumeSize": {
                     "type": "string",
                     "description": "size of its claim on Kubernetes, e.g. 10Gi"
+                  },
+                  "capAdd": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "enum": [
+                        "AUDIT_CONTROL",
+                        "AUDIT_READ",
+                        "AUDIT_WRITE",
+                        "BLOCK_SUSPEND",
+                        "BPF",
+                        "CHECKPOINT_RESTORE",
+                        "CHOWN",
+                        "DAC_OVERRIDE",
+                        "DAC_READ_SEARCH",
+                        "FOWNER",
+                        "FSETID",
+                        "IPC_LOCK",
+                        "IPC_OWNER",
+                        "KILL",
+                        "LEASE",
+                        "LINUX_IMMUTABLE",
+                        "MAC_ADMIN",
+                        "MAC_OVERRIDE",
+                        "MKNOD",
+                        "NET_ADMIN",
+                        "NET_BIND_SERVICE",
+                        "NET_BROADCAST",
+                        "NET_RAW",
+                        "PERFMON",
+                        "SETFCAP",
+                        "SETGID",
+                        "SETPCAP",
+                        "SETUID",
+                        "SYS_ADMIN",
+                        "SYS_BOOT",
+                        "SYS_CHROOT",
+                        "SYS_MODULE",
+                        "SYS_NICE",
+                        "SYS_PACCT",
+                        "SYS_PTRACE",
+                        "SYS_RAWIO",
+                        "SYS_RESOURCE",
+                        "SYS_TIME",
+                        "SYS_TTY_CONFIG",
+                        "SYSLOG",
+                        "WAKE_ALARM"
+                      ]
+                    },
+                    "description": "Linux capabilities added to the container, e.g. [SYS_ADMIN]"
                   }
                 },
                 "required": [
@@ -370,9 +426,15 @@
                   "network": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/network"
                   },
+                  "args": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/args"
+                  },
                   "runner": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/runner"
                   },
+                  "publish": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/publish"
+                  },
                   "platform": {
                     "type": "object",
                     "properties": {
@@ -397,6 +459,91 @@
                 },
                 "additionalProperties": false,
                 "description": "local task"
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "deps": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/deps"
+                  },
+                  "needs": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/needs"
+                  },
+                  "description": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/description"
+                  },
+                  "extend": {
+                    "type": "string"
+                  },
+                  "reset": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/reset"
+                  },
+                  "envs": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/envs"
+                  },
+                  "labels": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/labels"
+                  },
+                  "cache": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/cache"
+                  },
+                  "cmds": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/cmds"
+                  },
+                  "src": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/src"
+                  },
+                  "generates": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/generates"
+                  },
+                  "shell": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/shell"
+                  },
+                  "continuous": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/continuous"
+                  },
+                  "timeout": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/timeout"
+                  },
+                  "secrets": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/secrets"
+                  },
+                  "account": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/account"
+                  },
+                  "resources": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/resources"
+                  },
+                  "network": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/network"
+                  },
+                  "args": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/args"
+                  },
+                  "runner": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/runner"
+                  },
+                  "publish": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/publish"
+                  },
+                  "image": {
+                    "type": "string"
+                  },
+                  "mounts": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/mounts"
+                  },
+                  "volumeSize": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/volumeSize"
+                  },
+                  "capAdd": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/capAdd"
+                  }
+                },
+                "required": [
+                  "extend"
+                ],
+                "additionalProperties": false,
+                "description": "container task taking its image from the task it extends"
               }
             ]
           }
@@ -504,6 +651,12 @@
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/resources",
                     "description": "cpu and memory requests and limits"
                   },
+                  "restarts": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 10,
+                    "description": "crashes restarted before it fails on Kubernetes, 0 to 10, 2 by default"
+                  },
                   "volumeSize": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/volumeSize",
                     "description": "size of its claim on Kubernetes, e.g. 10Gi"
@@ -511,6 +664,12 @@
                   "network": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/network",
                     "description": "network the task or service reaches besides its needs: open (default), none or { allow: [hosts or host:port] }"
+                  },
+                  "args": {
+                    "type": "boolean"
+                  },
+                  "publish": {
+                    "type": "boolean"
                   }
                 },
                 "required": [
@@ -567,6 +726,9 @@
                         "number"
                       ]
                     }
+                  },
+                  "publish": {
+                    "type": "boolean"
                   }
                 },
                 "required": [
@@ -586,6 +748,28 @@
               {
                 "type": "string"
               },
+              {
+                "type": "object",
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Build file or directory, relative to the including file"
+                  },
+                  "with": {
+                    "$ref": "#/definitions/hammerkit/properties/envs",
+                    "description": "Environment values for the current build task\nhttps://hammerkit.dev/docs/build-file/environment-variables"
+                  },
+                  "publish": {
+                    "type": "boolean",
+                    "description": "false: a server leaves out what this file declares"
+                  }
+                },
+                "required": [
+                  "path"
+                ],
+                "additionalProperties": false
+              },
               {
                 "type": "object",
                 "properties": {
@@ -606,6 +790,10 @@
                   "with": {
                     "$ref": "#/definitions/hammerkit/properties/envs",
                     "description": "Environment values for the current build task\nhttps://hammerkit.dev/docs/build-file/environment-variables"
+                  },
+                  "publish": {
+                    "type": "boolean",
+                    "description": "false: a server leaves out what this file declares"
                   }
                 },
                 "required": [

package/dist/cache/backends/local-cache-backend.js

@@ -80,6 +80,12 @@ function createLocalCacheBackend(spec) {
                 return false;
             }
         },
+        async touch(taskId, stateKey, environment) {
+            const remoteDir = (0, path_1.join)(root, taskId, stateKey);
+            if (await environment.file.exists((0, path_1.join)(remoteDir, 'stats.json'))) {
+                await (0, promises_1.writeFile)((0, path_1.join)(remoteDir, LAST_ACCESS_FILE), `${Date.now()}`);
+            }
+        },
         async push(taskId, stateKey, from, environment) {
             const remoteDir = (0, path_1.join)(root, taskId, stateKey);
             await environment.file.createDirectory(remoteDir);

package/dist/cache/backends/registry-cache-backend.js

@@ -5,6 +5,7 @@ const crypto_1 = require("crypto");
 const os_1 = require("os");
 const path_1 = require("path");
 const tar_1 = require("tar");
+const tar_2 = require("../../utils/tar");
 const registry_reference_1 = require("./registry/registry-reference");
 const registry_client_1 = require("./registry/registry-client");
 const MAX_TAG_LENGTH = 128;
@@ -74,8 +75,7 @@ function createRegistryCacheBackend(spec) {
                 const layerFile = (0, path_1.join)(dir, 'layer.tar');
                 const files = (await environment.file.listFiles(from)).sort();
                 // portable + mtime-free so identical entries produce identical digests
-                // `noMtime` is supported by tar 6 but missing from its type definitions
-                await (0, tar_1.create)({ file: layerFile, cwd: from, portable: true, noMtime: true }, files);
+                await (0, tar_2.packArchive)({ file: layerFile, cwd: from, portable: true, noMtime: true }, files);
                 const layer = await (0, registry_client_1.digestFile)(layerFile);
                 const config = Buffer.from(JSON.stringify({
                     architecture: 'amd64',

package/dist/cache/explain.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.explainWorkTree = exports.explainTask = exports.describeCause = void 0;
+const work_task_1 = require("../planner/work-task");
 const state_key_1 = require("../executer/scheduler/state-key");
 const work_task_cache_description_1 = require("../optimizer/work-task-cache-description");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
@@ -157,6 +158,22 @@ async function explainTask(item, defaultCacheMethod, environment, memo = new Map
         visiting.delete(item.id());
         return explanation;
     }
+    // Mirrors executeWorkTask: an aggregate is never looked up itself, and is reported
+    // cached when all its dependencies were. What changed is in its dependencies.
+    if ((0, work_task_1.isAggregateTask)(item.data)) {
+        const causes = [];
+        for (const dep of item.deps) {
+            const depExplanation = await explainTask(dep, defaultCacheMethod, environment, memo, visiting);
+            if (depExplanation.status !== 'hit') {
+                causes.push({ kind: 'dependency-changed', identifier: dep.name });
+            }
+        }
+        const status = causes.length === 0 ? 'hit' : 'miss';
+        const explanation = { taskId: item.id(), taskName: item.name, status, causes };
+        memo.set(item.id(), explanation);
+        visiting.delete(item.id());
+        return explanation;
+    }
     const runtimeStateKey = await safeCurrentStateKey(item, environment);
     const hasEntry = await safeHas(item, stateKey, environment);
     const predictedHit = runtimeStateKey === stateKey || hasEntry;

package/dist/cli.js

@@ -79,7 +79,9 @@ class Cli {
                         explain: options?.explain ?? false,
                         cacheReadOnly: options?.cacheReadOnly ?? false,
                         timeout: options?.timeout ?? null,
+                        maxTimeout: options?.maxTimeout ?? null,
                         skipDeps: options?.skipDeps ?? true,
+                        restore: options?.restore ?? true,
                         wait: options?.wait ?? 'ready',
                         resourceCheck: options?.resourceCheck ?? true,
                         network: options?.network ?? null,

package/dist/docker/item-network.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.removeOrphanedNetworks = exports.removeItemNetworks = exports.getNetworkHostConfig = exports.removeItemNetwork = exports.prepareItemNetwork = exports.checkNetworkLimitSupport = exports.getProxyNetworkName = exports.getRunNetworkName = exports.getItemNetworkName = void 0;
+exports.removeOrphanedNetworks = exports.removeItemNetworks = exports.getNetworkHostConfig = exports.getPortBinding = exports.removeItemNetwork = exports.prepareItemNetwork = exports.checkNetworkLimitSupport = exports.getProxyNetworkName = exports.getRunNetworkName = exports.getItemNetworkName = void 0;
 const readline_1 = require("readline");
 const stream_1 = require("stream");
 const work_service_1 = require("../planner/work-service");
@@ -258,7 +258,7 @@ options) {
         await removeItemNetwork(docker, name);
         throw e;
     }
-    const publish = (options.publish ?? []).filter((port) => !!port.hostPort);
+    const publish = (options.publish ?? []).filter((port) => port.hostPort !== null);
     return {
         options: {
             mode: name,
@@ -272,8 +272,9 @@ options) {
                     await docker.getNetwork(getProxyNetworkName(name)).connect({ Container: container.id });
                 }
                 if (publish.length > 0) {
-                    await startPortRelay(docker, item, environment, name, container, publish, options);
+                    return await startPortRelay(docker, item, environment, name, container, publish, options);
                 }
+                return undefined;
             }
             catch (e) {
                 await removeItemNetwork(docker, name);
@@ -374,12 +375,13 @@ async function startPortRelay(docker, item, environment, networkName, service, p
         ExposedPorts: Object.fromEntries(ports.map((port) => [`${port.containerPort}/tcp`, {}])),
         HostConfig: {
             ...HELPER_HOST_CONFIG,
-            PortBindings: Object.fromEntries(ports.map((port) => [`${port.containerPort}/tcp`, [{ HostPort: `${port.hostPort}` }]])),
+            PortBindings: Object.fromEntries(ports.map((port) => [`${port.containerPort}/tcp`, [getPortBinding(port)]])),
         },
     });
     await docker.getNetwork(networkName).connect({ Container: container.id });
     await container.start();
-    item.status.write('debug', `ports ${ports.map((port) => port.hostPort).join(', ')} published by a relay`);
+    item.status.write('debug', `ports ${ports.map((port) => port.hostPort || 'any').join(', ')} published by a relay`);
+    return container;
 }
 // The network, its proxy network, its proxy and relay, and every endpoint on
 // them: what an earlier run left behind, or what the item used.
@@ -429,6 +431,12 @@ async function removeNetwork(docker, name) {
         }
     }
 }
+// A port of the host for a port of a container: a free one for 0, on one address of it
+// when the port names one.
+function getPortBinding(port) {
+    return { HostPort: port.hostPort ? `${port.hostPort}` : '', ...(port.hostIp ? { HostIp: port.hostIp } : {}) };
+}
+exports.getPortBinding = getPortBinding;
 function getNetworkHostConfig(network) {
     return {
         ...(network.mode ? { NetworkMode: network.mode } : {}),

package/dist/executer/deadline.js

@@ -1,14 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.withDeadline = void 0;
+exports.withDeadline = exports.getTaskTimeout = void 0;
 const abort_event_1 = require("../utils/abort-event");
+// How long a task may run: its own `timeout`, else the run's default (`--timeout`), and
+// never longer than the run's cap (`--max-timeout`), which also covers tasks with a
+// longer timeout of their own. A caller can shorten a task this way, never extend it.
+function getTaskTimeout(own, run) {
+    const timeout = own ?? run.timeout;
+    if (run.maxTimeout === null) {
+        return timeout;
+    }
+    return timeout === null ? run.maxTimeout : Math.min(timeout, run.maxTimeout);
+}
+exports.getTaskTimeout = getTaskTimeout;
+// the longest delay of setTimeout: Node fires a longer one after 1 ms
+const MAX_TIMER_MS = 2 ** 31 - 1;
 // An abort signal that follows `parent` and additionally fires after `timeout`
-// ms, so a task deadline reuses the runtimes' existing abort/cleanup path.
+// ms, so a task deadline reuses the runtimes' existing abort/cleanup path. A
+// timeout beyond what a timer can wait (about 24.8 days) sets no deadline.
 function withDeadline(parent, timeout) {
     const controller = new AbortController();
     let expired = false;
     const parentListener = (0, abort_event_1.listenOnAbort)(parent, () => controller.abort());
-    const timer = timeout === null
+    const timer = timeout === null || timeout > MAX_TIMER_MS
         ? null
         : setTimeout(() => {
             expired = true;

package/dist/executer/deferred-restore.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.restoreDeferred = exports.clearDeferredRestore = exports.deferRestore = void 0;
+const abort_1 = require("./abort");
+// Keyed by the item's state, which every run replaces (resetWorkTree): a hit
+// deferred in one run of a Cli is never restored in a later one, over outputs
+// that run built.
+const deferred = new WeakMap();
+function deferRestore(item, run) {
+    deferred.set(item.state, { run, promise: null });
+}
+exports.deferRestore = deferRestore;
+// Every cache check starts from scratch: a key that changed since a hit was
+// deferred must not restore the old entry.
+function clearDeferredRestore(item) {
+    deferred.delete(item.state);
+}
+exports.clearDeferredRestore = clearDeferredRestore;
+// Restore every given item that was a hit without its outputs, in parallel,
+// each at most once however many items wait on it.
+async function restoreDeferred(work, items, abort) {
+    await Promise.all(items.map((item) => {
+        const entry = deferred.get(item.state);
+        if (!entry) {
+            return Promise.resolve();
+        }
+        if (!entry.promise) {
+            work.status.write('debug', `restore ${item.name} from cache, ${work.name} needs its outputs`);
+            entry.promise = entry.run();
+        }
+        return entry.promise;
+    }));
+    (0, abort_1.checkForAbort)(abort);
+}
+exports.restoreDeferred = restoreDeferred;
+//# sourceMappingURL=deferred-restore.js.map

package/dist/executer/docker-service.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.dockerService = exports.buildServiceCreateOptions = void 0;
+exports.dockerService = exports.buildServiceCreateOptions = exports.readPublishedPorts = void 0;
 const work_service_1 = require("../planner/work-service");
 const run_labels_1 = require("../docker/run-labels");
 const service_hostname_1 = require("../planner/utils/service-hostname");
@@ -22,6 +22,28 @@ const work_healthcheck_1 = require("../planner/work-healthcheck");
 const docker_resources_1 = require("./docker-resources");
 const egress_proxy_1 = require("../network/egress-proxy");
 const HEALTHCHECK_INTERVAL_MS = 1000;
+// Where docker published the ports of a container (or of its relay), for those that asked
+// for a free one.
+async function readPublishedPorts(container, ports) {
+    const wanted = ports.filter((port) => port.hostPort === 0);
+    if (wanted.length === 0) {
+        return [];
+    }
+    const bound = (await container.inspect()).NetworkSettings.Ports ?? {};
+    return wanted.flatMap((port) => {
+        const binding = bound[`${port.containerPort}/tcp`]?.find((candidate) => candidate.HostPort);
+        return binding
+            ? [
+                {
+                    containerPort: port.containerPort,
+                    host: port.hostIp ?? (binding.HostIp && binding.HostIp !== '0.0.0.0' ? binding.HostIp : '127.0.0.1'),
+                    port: Number(binding.HostPort),
+                },
+            ]
+            : [];
+    });
+}
+exports.readPublishedPorts = readPublishedPorts;
 function buildServiceCreateOptions(item, options, network, secrets, resources = {}) {
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs);
     const command = (0, work_service_1.getServiceCommand)(item.data);
@@ -58,12 +80,9 @@ function buildServiceCreateOptions(item, options, network, secrets, resources =
             // collide with another run on the same host. A limited service's are
             // published by its relay.
             PortBindings: options.publishPorts && !network.relayPorts
-                ? item.data.ports
-                    .filter((p) => !!p.hostPort)
-                    .reduce((map, port) => {
-                    map[`${port.containerPort}/tcp`] = [{ HostPort: `${port.hostPort}` }];
-                    return map;
-                }, {})
+                ? Object.fromEntries(item.data.ports
+                    .filter((p) => p.hostPort !== null)
+                    .map((port) => [`${port.containerPort}/tcp`, [(0, item_network_1.getPortBinding)(port)]]))
                 : {},
             ...resources,
         },
@@ -90,16 +109,18 @@ async function dockerService(docker, item, options, environment) {
         const resources = await (0, docker_resources_1.resolveDockerResources)(docker, item.data.resources, item.status);
         await (0, execution_steps_1.refuseHostLinks)(item, environment);
         container = await docker.createContainer(buildServiceCreateOptions(item, options, network.options, secrets, resources));
-        await network.connect(container);
+        const relay = await network.connect(container);
         const stream = await container.attach({ stream: true, stdout: true, stderr: true });
         (0, stream_1.logStream)(item.status, stream);
         await container.start();
+        const published = options.publishPorts ? await readPublishedPorts(relay ?? container, item.data.ports) : [];
         if (!item.data.healthcheck || !options.waitForReady) {
             options.state.set({
                 type: 'running',
                 dns: { containerId: container.id },
                 stateKey: options.stateKey,
                 remote: null,
+                ...(published.length > 0 ? { published } : {}),
             });
         }
         else {
@@ -125,6 +146,7 @@ async function dockerService(docker, item, options, environment) {
                     dns: { containerId: container.id },
                     stateKey: options.stateKey,
                     remote: null,
+                    ...(published.length > 0 ? { published } : {}),
                 });
             }
         }

package/dist/executer/docker-task.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.dockerTask = exports.buildCreateOptions = void 0;
+exports.dockerTask = exports.getCapabilityHostConfig = exports.buildCreateOptions = void 0;
 const run_labels_1 = require("../docker/run-labels");
 const execute_docker_1 = require("./execute-docker");
 const abort_1 = require("./abort");
@@ -47,10 +47,30 @@ function buildCreateOptions(item, stateKey, network, environment, secrets, resou
             ...(0, item_network_1.getNetworkHostConfig)(network),
             AutoRemove: true,
             ...resources,
+            ...getCapabilityHostConfig(item, environment),
         },
     };
 }
 exports.buildCreateOptions = buildCreateOptions;
+/**
+ * The capabilities a task adds (`capAdd`). On a server they are only granted in the
+ * sandboxed runtime of `backend.capabilities`, never by the kernel of the docker host.
+ */
+function getCapabilityHostConfig(item, environment) {
+    const capAdd = item.data.capAdd;
+    if (capAdd.length === 0) {
+        return {};
+    }
+    if (!environment.hosted) {
+        return { CapAdd: capAdd };
+    }
+    const runtime = environment.hosted.capabilityRuntime;
+    if (!runtime) {
+        throw new Error(`${item.name}: adds the capabilities ${capAdd.join(', ')}, which this server grants in no sandboxed runtime`);
+    }
+    return { CapAdd: capAdd, Runtime: runtime };
+}
+exports.getCapabilityHostConfig = getCapabilityHostConfig;
 async function dockerTask(docker, item, environment, options) {
     item.status.write('info', `execute ${item.name} in container`);
     let network = null;

package/dist/executer/event-cache.js

@@ -8,6 +8,8 @@ const execute_docker_1 = require("./execute-docker");
 const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
 const path_1 = require("path");
+const crypto_1 = require("crypto");
+const claim_layout_1 = require("../kubernetes/claim-layout");
 const move_files_1 = require("../file/move-files");
 const work_instance_id_1 = require("../planner/work-instance-id");
 async function restoreCache(environment, path, workTree) {
@@ -43,8 +45,24 @@ function* getArchivePaths(task, path) {
         }
     }
     else {
-        for (const generate of task.generates.filter((g) => !g.inherited)) {
-            const generateId = (0, path_1.relative)(task.cwd, generate.path).split(path_1.sep).join('-');
+        // `a-b` and `a/b` flatten alike: of those, the least deep (then the first in sorted
+        // order) keeps the name, the others' names carry a hash of their relative path, so a
+        // store and a restore in another directory or order find the same archive
+        const generates = task.generates
+            .filter((g) => !g.inherited)
+            .map((generate) => ({ generate, rel: (0, path_1.relative)(task.cwd, generate.path).split(path_1.sep).join(path_1.posix.sep) }));
+        const holders = new Map();
+        for (const { rel } of [...generates].sort((a, b) => (0, claim_layout_1.byDepth)(a.rel, b.rel))) {
+            const id = rel.split(path_1.posix.sep).join('-');
+            if (!holders.has(id)) {
+                holders.set(id, rel);
+            }
+        }
+        for (const { generate, rel } of generates) {
+            let generateId = rel.split(path_1.posix.sep).join('-');
+            if (holders.get(generateId) !== rel) {
+                generateId += '-' + (0, crypto_1.createHash)('sha256').update(rel).digest('hex').slice(0, 12);
+            }
             yield {
                 filename: (0, path_1.join)(path, generateId + '-generates.tgz'),
                 path: generate.path,

package/dist/executer/execute-work-service.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.executeWorkService = exports.stopService = void 0;
 const work_item_1 = require("../planner/work-item");
 const await_completed_dependencies_1 = require("./await-completed-dependencies");
+const deferred_restore_1 = require("./deferred-restore");
 const abort_1 = require("./abort");
 const log_1 = require("../log");
 const watch_loop_1 = require("./watch-loop");
@@ -35,6 +36,7 @@ async function executeWorkService(work, environment, options) {
         });
         await (0, watch_loop_1.watchLoop)(work, environment, options, async (cacheState, abort, stop) => {
             await (0, await_completed_dependencies_1.awaitCompletedDependencies)(work, work.deps, abort);
+            await (0, deferred_restore_1.restoreDeferred)(work, (0, await_completed_dependencies_1.transitiveDeps)(work.deps), abort);
             work.state.set({
                 type: 'ready',
                 stateKey: cacheState.stateKey,