libre-webui 0.16.0 → 0.17.0

package/backend/dist/services/workRuntimeService.js

@@ -31,10 +31,15 @@ export const WORK_RUNTIME_DEFAULTS = {
     cpuLimit: '2',
     pidsLimit: 256,
     previewPort: 4173,
+    previewBind: '127.0.0.1',
+    networkName: 'libre-webui-work',
 };
+// Two runtimes per administrator so a second task does not have to wait for
+// the first, three per instance to bound the worst case at three containers'
+// resource caps. Both remain tunable through WORK_MAX_ACTIVE_RUNTIMES_*.
 export const WORK_RUNTIME_ADMISSION_DEFAULTS = {
-    maxActiveRuntimesGlobal: 2,
-    maxActiveRuntimesPerUser: 1,
+    maxActiveRuntimesGlobal: 3,
+    maxActiveRuntimesPerUser: 2,
 };
 const config = {
     image: process.env.WORK_RUNTIME_IMAGE || WORK_RUNTIME_DEFAULTS.image,
@@ -46,18 +51,37 @@ const config = {
     cpuLimit: process.env.WORK_CPU_LIMIT || WORK_RUNTIME_DEFAULTS.cpuLimit,
     pidsLimit: positiveInteger(process.env.WORK_PIDS_LIMIT, WORK_RUNTIME_DEFAULTS.pidsLimit),
     previewPort: positiveInteger(process.env.WORK_PREVIEW_PORT, WORK_RUNTIME_DEFAULTS.previewPort),
+    // Interface the daemon publishes a task preview on. Loopback keeps a preview
+    // private to the Docker host, which is correct when the browser runs there.
+    previewBind: process.env.WORK_PREVIEW_BIND || WORK_RUNTIME_DEFAULTS.previewBind,
+    // Host advertised in the preview URL. It differs from the bind address when
+    // the browser reaches the Docker host by another name.
+    previewHost: process.env.WORK_PREVIEW_HOST ||
+        process.env.WORK_PREVIEW_BIND ||
+        WORK_RUNTIME_DEFAULTS.previewBind,
     maxActiveRuntimesGlobal: positiveInteger(process.env.WORK_MAX_ACTIVE_RUNTIMES_GLOBAL, WORK_RUNTIME_ADMISSION_DEFAULTS.maxActiveRuntimesGlobal),
     maxActiveRuntimesPerUser: positiveInteger(process.env.WORK_MAX_ACTIVE_RUNTIMES_PER_USER, WORK_RUNTIME_ADMISSION_DEFAULTS.maxActiveRuntimesPerUser),
+    // Dedicated bridge network for networked Work tasks. It is created with
+    // inter-container communication disabled, so a sandbox cannot reach other
+    // Work sandboxes or the deployment's own containers on the default bridge.
+    networkName: process.env.WORK_NETWORK_NAME || WORK_RUNTIME_DEFAULTS.networkName,
+    // Optional resolvers forced onto every networked sandbox. Pointing this at
+    // a filtering resolver is the supported egress-policy hook.
+    dnsServers: parseDnsServers(process.env.WORK_RUNTIME_DNS),
 };
 const PREVIEW_READY_TIMEOUT_MS = 15000;
 const PREVIEW_POLL_INTERVAL_MS = 250;
 const runtimePolicyFingerprint = createHash('sha256')
     .update(JSON.stringify({
-    version: 1,
+    version: 2,
     memoryLimit: config.memoryLimit,
     cpuLimit: config.cpuLimit,
     pidsLimit: config.pidsLimit,
     previewPort: config.previewPort,
+    previewBind: config.previewBind,
+    networkName: config.networkName,
+    dnsServers: config.dnsServers,
+    memorySwapPinned: true,
 }))
     .digest('hex');
 export class WorkRuntimeError extends Error {
@@ -76,14 +100,18 @@ export class WorkRuntimeService {
             maxRounds: config.maxAgentRounds,
             commandTimeoutMs: config.commandTimeoutMs,
             maxOutputChars: config.maxOutputChars,
+            maxActiveRuntimesGlobal: config.maxActiveRuntimesGlobal,
+            maxActiveRuntimesPerUser: config.maxActiveRuntimesPerUser,
         };
         this.lifecycleTails = new Map();
         this.preparations = new Map();
         this.retiringTasks = new Set();
         this.networkPolicies = new Map();
         this.activeCommands = new Set();
+        this.lastDockerUnavailableReason = null;
         this.runtimeLeases = new Map();
         this.previewLeaseReleases = new Map();
+        this.terminalHolds = new Map();
         this.recoveryTasks = new Map();
         this.shuttingDown = false;
     }
@@ -106,12 +134,36 @@ export class WorkRuntimeService {
             await this.docker(['info', '--format', '{{.ServerVersion}}'], {
                 timeoutMs: 5000,
             });
+            this.lastDockerUnavailableReason = null;
             return true;
         }
-        catch {
+        catch (error) {
+            this.lastDockerUnavailableReason = describeDockerUnavailable(error, config.dockerCommand);
             return false;
         }
     }
+    /**
+     * Why the last availability probe failed. "Docker is not available" cannot be
+     * acted on: a containerized deployment fails for a missing CLI, an unreadable
+     * socket, or a stopped daemon, and each needs a different change.
+     */
+    get dockerUnavailableReason() {
+        return this.lastDockerUnavailableReason;
+    }
+    /**
+     * Live runtime occupancy, so the interface can say "1 of 2 runtimes in use"
+     * instead of surprising the administrator with a 429 at submit time.
+     */
+    activeRuntimeCounts(userId) {
+        let user = 0;
+        if (userId) {
+            for (const lease of this.runtimeLeases.values()) {
+                if (lease.userId === userId)
+                    user += 1;
+            }
+        }
+        return { global: this.runtimeLeases.size, user };
+    }
     async beginRecovery(tasks) {
         for (const task of tasks) {
             this.recoveryTasks.set(task.id, task);
@@ -206,6 +258,46 @@ export class WorkRuntimeService {
             throw error;
         }
     }
+    /**
+     * Hold the task container up for an interactive terminal session. The hold
+     * goes through the same admission (runtime lease), policy verification, and
+     * container preparation as every other runtime operation, and keeps the
+     * idle-stop path from tearing the container down while a shell is attached.
+     */
+    async acquireTerminalHold(task) {
+        if (this.activeCommands.has(task.id)) {
+            throw new WorkRuntimeError('A Work command is running in this container. Wait for it to finish, then reconnect the terminal.', 409, 'WORK_TERMINAL_COMMAND_ACTIVE');
+        }
+        const releaseLease = await this.prepare(task);
+        this.terminalHolds.set(task.id, (this.terminalHolds.get(task.id) ?? 0) + 1);
+        let released = false;
+        return async () => {
+            if (released)
+                return;
+            released = true;
+            const remaining = (this.terminalHolds.get(task.id) ?? 1) - 1;
+            if (remaining <= 0) {
+                this.terminalHolds.delete(task.id);
+            }
+            else {
+                this.terminalHolds.set(task.id, remaining);
+            }
+            try {
+                if (remaining <= 0 && !this.shuttingDown) {
+                    await this.withLifecycleLock(task.id, () => this.stopContainerIfIdleWithLock(task));
+                }
+            }
+            catch (error) {
+                logger.warn(`Could not idle Work container ${task.containerName} after terminal session:`, error);
+            }
+            finally {
+                releaseLease();
+            }
+        };
+    }
+    terminalSessionCount(taskId) {
+        return this.terminalHolds.get(taskId) ?? 0;
+    }
     beginShutdown() {
         this.shuttingDown = true;
         if (this.recoveryTimer) {
@@ -302,8 +394,39 @@ export class WorkRuntimeService {
             this.assertTaskIsActive(task);
         }
     }
+    async ensureWorkNetwork(task) {
+        if (!task.networkEnabled)
+            return;
+        const inspect = await this.docker([
+            'network',
+            'inspect',
+            '--format',
+            '{{index .Labels "ai.libre-webui.managed"}} {{index .Options "com.docker.network.bridge.enable_icc"}}',
+            config.networkName,
+        ], { acceptFailure: true });
+        if (inspect.exitCode === 0) {
+            const [managed, icc] = inspect.stdout.trim().split(' ');
+            if (managed !== 'true' || icc !== 'false') {
+                throw new WorkRuntimeError(`Docker network "${config.networkName}" exists but is not the managed Work sandbox network (label ai.libre-webui.managed=true with inter-container communication disabled). Remove it or point WORK_NETWORK_NAME at an unused name.`, 503, 'WORK_NETWORK_CONFLICT');
+            }
+            return;
+        }
+        const created = await this.docker([
+            'network',
+            'create',
+            '--label',
+            'ai.libre-webui.managed=true',
+            '--opt',
+            'com.docker.network.bridge.enable_icc=false',
+            config.networkName,
+        ], { acceptFailure: true });
+        if (created.exitCode !== 0 && !/already exists/i.test(created.stderr)) {
+            throw new WorkRuntimeError(`Could not create the Work sandbox network "${config.networkName}": ${created.stderr.trim()}`, 503, 'WORK_NETWORK_UNAVAILABLE');
+        }
+    }
     async ensureContainer(task) {
         this.assertRuntimeLease(task);
+        await this.ensureWorkNetwork(task);
         if (await this.containerExists(task.containerName)) {
             await this.assertManagedContainer(task);
             if (!(await this.containerMatchesTaskPolicy(task))) {
@@ -518,6 +641,10 @@ export class WorkRuntimeService {
     async stopContainerIfIdleWithLock(task) {
         if (this.activeCommands.has(task.id))
             return;
+        // An attached terminal session owns the running container exactly like a
+        // ready preview does.
+        if ((this.terminalHolds.get(task.id) ?? 0) > 0)
+            return;
         try {
             if ((await this.previewProcessCheckWithLock(task)) === 'ready' &&
                 this.previewLeaseReleases.has(task.id)) {
@@ -579,6 +706,59 @@ export class WorkRuntimeService {
             };
         });
     }
+    /**
+     * Delete a workspace file, symlink, or directory. Directories require an
+     * explicit recursive flag, and the workspace root is never deletable. Runs
+     * through the helper container, so it also works while a preview holds the
+     * task container.
+     */
+    async deletePath(task, requestedPath, recursive = false) {
+        const workspacePath = validateWorkspacePath(requestedPath, false);
+        return this.withWorkspaceHelperContainer(task, async () => {
+            const result = await this.exec(task, [
+                'node',
+                '-e',
+                DELETE_PATH_SCRIPT,
+                '--',
+                workspacePath,
+                recursive ? 'recursive' : '',
+            ], { maxOutputChars: 10000, acceptFailure: true });
+            if (result.exitCode === 21) {
+                throw new WorkRuntimeError(`No file or directory exists at ${workspacePath}.`, 404, 'WORK_FILE_NOT_FOUND');
+            }
+            if (result.exitCode === 22) {
+                throw new WorkRuntimeError(`${workspacePath} is a directory. Pass recursive: true to delete it with its contents.`, 409, 'WORK_DELETE_REQUIRES_RECURSIVE');
+            }
+            if (result.exitCode !== 0) {
+                throw new WorkRuntimeError(result.stderr.trim() || 'Could not delete the workspace path.', 503, 'WORK_FILE_DELETE_FAILED');
+            }
+            const payload = parseJsonOutput(result.stdout);
+            return { path: workspacePath, type: payload.type };
+        });
+    }
+    /**
+     * Move or rename a workspace file or directory. Destination parents are
+     * created inside the workspace, an existing destination is never
+     * overwritten, and like deletePath this works while a preview is running.
+     */
+    async movePath(task, requestedFrom, requestedTo) {
+        const fromPath = validateWorkspacePath(requestedFrom, false);
+        const toPath = validateWorkspacePath(requestedTo, false);
+        return this.withWorkspaceHelperContainer(task, async () => {
+            const result = await this.exec(task, ['node', '-e', MOVE_PATH_SCRIPT, '--', fromPath, toPath], { maxOutputChars: 10000, acceptFailure: true });
+            if (result.exitCode === 21) {
+                throw new WorkRuntimeError(`No file or directory exists at ${fromPath}.`, 404, 'WORK_FILE_NOT_FOUND');
+            }
+            if (result.exitCode === 24) {
+                throw new WorkRuntimeError(`${toPath} already exists. Delete it first or choose another destination.`, 409, 'WORK_DESTINATION_EXISTS');
+            }
+            if (result.exitCode !== 0) {
+                throw new WorkRuntimeError(result.stderr.trim() || 'Could not move the workspace path.', 503, 'WORK_FILE_MOVE_FAILED');
+            }
+            parseJsonOutput(result.stdout);
+            return { from: fromPath, to: toPath };
+        });
+    }
     async searchFiles(task, query, requestedPath = '.') {
         const workspacePath = validateWorkspacePath(requestedPath);
         if (!query.trim() || query.length > 500) {
@@ -832,7 +1012,7 @@ export class WorkRuntimeService {
             if (!publishedPort) {
                 throw new WorkRuntimeError('Docker did not publish the preview port.', 503, 'WORK_PREVIEW_PORT_UNAVAILABLE');
             }
-            return `http://127.0.0.1:${publishedPort}`;
+            return `http://${formatPreviewHost(config.previewHost)}:${publishedPort}`;
         }
         catch (error) {
             try {
@@ -1072,7 +1252,7 @@ export class WorkRuntimeService {
             ? inspected.Mounts.map(objectRecord)
             : [];
         const workspaceMount = mounts.find(mount => mount.Destination === '/workspace');
-        const expectedNetwork = task.networkEnabled ? 'bridge' : 'none';
+        const expectedNetwork = task.networkEnabled ? config.networkName : 'none';
         const portBindings = objectRecord(hostConfig.PortBindings);
         const previewBindings = Array.isArray(portBindings[`${config.previewPort}/tcp`])
             ? portBindings[`${config.previewPort}/tcp`].map(objectRecord)
@@ -1080,7 +1260,7 @@ export class WorkRuntimeService {
         const portPolicyMatches = task.networkEnabled
             ? Object.keys(portBindings).length === 1 &&
                 previewBindings.length === 1 &&
-                previewBindings[0]?.HostIp === '127.0.0.1'
+                previewBindings[0]?.HostIp === config.previewBind
             : Object.keys(portBindings).length === 0;
         return (labels['ai.libre-webui.managed'] === 'true' &&
             labels['ai.libre-webui.task'] === task.id &&
@@ -1097,6 +1277,7 @@ export class WorkRuntimeService {
             securityOpt.includes('no-new-privileges') &&
             Number(hostConfig.PidsLimit) === config.pidsLimit &&
             Number(hostConfig.Memory) > 0 &&
+            Number(hostConfig.MemorySwap) === Number(hostConfig.Memory) &&
             Number(hostConfig.NanoCpus) > 0 &&
             hostConfig.NetworkMode === expectedNetwork &&
             portPolicyMatches &&
@@ -1196,6 +1377,31 @@ export class WorkRuntimeService {
         }
     }
 }
+/** Bracket a bare IPv6 literal so it can carry a port in a URL. */
+export function formatPreviewHost(host) {
+    return host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+}
+/**
+ * Turn a failed `docker info` into the change an operator has to make. These
+ * are the three ways a containerized Libre WebUI fails to reach the daemon:
+ * the image has no CLI, the bind-mounted socket is owned by a group the
+ * backend user is not in, or no daemon is listening.
+ */
+export function describeDockerUnavailable(error, dockerCommand = config.dockerCommand) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/ENOENT/.test(message)) {
+        return `The "${dockerCommand}" CLI is not installed in the Libre WebUI runtime. Run an image that ships the Docker CLI and mount the host Docker socket, or point WORK_DOCKER_COMMAND at the CLI path.`;
+    }
+    if (/EACCES/.test(message) || /permission denied/i.test(message)) {
+        return 'The Docker socket is mounted but the Libre WebUI user cannot open it. Add the backend user to the group that owns /var/run/docker.sock (Compose: group_add with the socket GID).';
+    }
+    if (/cannot connect to the docker daemon/i.test(message) ||
+        /is the docker daemon running/i.test(message) ||
+        /no such file or directory/i.test(message)) {
+        return 'No Docker daemon is reachable. Start Docker, or mount the host socket into the Libre WebUI container with -v /var/run/docker.sock:/var/run/docker.sock.';
+    }
+    return message;
+}
 export function buildWorkContainerRunArgs(task, image = config.image) {
     const args = [
         'run',
@@ -1228,15 +1434,25 @@ export function buildWorkContainerRunArgs(task, image = config.image) {
         String(config.pidsLimit),
         '--memory',
         config.memoryLimit,
+        // Same value as --memory: the memory cap cannot be sidestepped via swap.
+        '--memory-swap',
+        config.memoryLimit,
         '--cpus',
         config.cpuLimit,
         '--network',
-        task.networkEnabled ? 'bridge' : 'none',
+        task.networkEnabled ? config.networkName : 'none',
     ];
     if (task.networkEnabled) {
-        args.push('--publish', `127.0.0.1::${config.previewPort}`);
+        args.push('--publish', `${config.previewBind}::${config.previewPort}`);
+        for (const server of config.dnsServers) {
+            args.push('--dns', server);
+        }
     }
-    args.push('--mount', `type=volume,src=${task.volumeName},dst=/workspace,volume-nocopy`, image, 'tail', '-f', '/dev/null');
+    args.push('--mount', task.hostPath
+        ? // Host-folder workspaces are opt-in per deployment and validated
+            // against an allowlist before ever reaching this point.
+            `type=bind,src=${task.hostPath},dst=/workspace`
+        : `type=volume,src=${task.volumeName},dst=/workspace,volume-nocopy`, image, 'tail', '-f', '/dev/null');
     return args;
 }
 export function validateWorkspacePath(input, allowRoot = true) {
@@ -1256,14 +1472,19 @@ export function validateWorkspacePath(input, allowRoot = true) {
     }
     return canonical;
 }
-export function parsePublishedPort(output, _containerPort = config.previewPort) {
+export function parsePublishedPort(output, _containerPort = config.previewPort, bindAddress = config.previewBind) {
+    // Only a binding on the interface this deployment asked for counts. The
+    // default stays loopback, so a stray wildcard binding is still rejected.
+    const allowed = new Set(bindAddress === WORK_RUNTIME_DEFAULTS.previewBind
+        ? ['127.0.0.1', '[::1]']
+        : [bindAddress, formatPreviewHost(bindAddress)]);
     for (const line of output.trim().split(/\r?\n/)) {
-        const match = line.match(/^(?:127\.0\.0\.1|\[::1\]):(\d+)$/);
-        if (match) {
-            const port = Number(match[1]);
-            if (Number.isInteger(port) && port > 0 && port <= 65535)
-                return port;
-        }
+        const match = line.match(/^(.*):(\d+)$/);
+        if (!match || !allowed.has(match[1]))
+            continue;
+        const port = Number(match[2]);
+        if (Number.isInteger(port) && port > 0 && port <= 65535)
+            return port;
     }
     return undefined;
 }
@@ -1392,6 +1613,21 @@ function positiveInteger(value, fallback) {
     const parsed = Number(value);
     return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
 }
+export function parseDnsServers(value) {
+    if (!value)
+        return [];
+    return value
+        .split(',')
+        .map(server => server.trim())
+        .filter(server => {
+        if (!server)
+            return false;
+        if (/^[0-9a-fA-F:.]+$/.test(server))
+            return true;
+        logger.warn(`Ignoring WORK_RUNTIME_DNS entry "${server}": not an IPv4/IPv6 address.`);
+        return false;
+    });
+}
 function objectRecord(value) {
     return value && typeof value === 'object'
         ? value
@@ -1827,6 +2063,64 @@ process.stdin.on('end', () => {
   console.log(JSON.stringify({size:stat.size, updatedAt:stat.mtimeMs}));
 });
 `;
+const DELETE_PATH_SCRIPT = `${COMMON_PATH_GUARD}
+if (target === rootReal) throw new Error('Refusing to delete the workspace root');
+const parentReal = fs.realpathSync(path.dirname(target));
+if (!inside(parentReal)) throw new Error('Path escapes workspace');
+const safeTarget = path.join(parentReal, path.basename(target));
+let stat;
+try { stat = fs.lstatSync(safeTarget); } catch { process.exit(21); }
+const recursive = process.argv[2] === 'recursive';
+let type;
+if (stat.isSymbolicLink()) {
+  type = 'symlink';
+  fs.unlinkSync(safeTarget);
+} else if (stat.isDirectory()) {
+  if (!recursive) process.exit(22);
+  type = 'directory';
+  fs.rmSync(safeTarget, {recursive: true});
+} else {
+  type = 'file';
+  fs.unlinkSync(safeTarget);
+}
+process.stdout.write(JSON.stringify({type}));
+`;
+const MOVE_PATH_SCRIPT = `${COMMON_PATH_GUARD}
+const destRel = process.argv[2] || '';
+if (!destRel) throw new Error('Destination path is required');
+const destTarget = path.resolve(root, destRel);
+if (!inside(destTarget)) throw new Error('Path escapes workspace');
+if (target === rootReal || destTarget === rootReal) {
+  throw new Error('Refusing to move the workspace root');
+}
+const sourceParentReal = fs.realpathSync(path.dirname(target));
+if (!inside(sourceParentReal)) throw new Error('Path escapes workspace');
+const safeSource = path.join(sourceParentReal, path.basename(target));
+let sourceStat;
+try { sourceStat = fs.lstatSync(safeSource); } catch { process.exit(21); }
+const destParent = path.dirname(destTarget);
+const destParts = path.relative(root, destParent).split(path.sep).filter(Boolean);
+let destParentReal = rootReal;
+for (const part of destParts) {
+  const next = path.join(destParentReal, part);
+  if (!fs.existsSync(next)) fs.mkdirSync(next, {mode:0o755});
+  if (fs.lstatSync(next).isSymbolicLink()) throw new Error('Refusing to traverse symlink');
+  destParentReal = fs.realpathSync(next);
+  if (!inside(destParentReal) || !fs.statSync(destParentReal).isDirectory()) {
+    throw new Error('Path escapes workspace');
+  }
+}
+const safeDest = path.join(destParentReal, path.basename(destTarget));
+let destTaken = false;
+try { fs.lstatSync(safeDest); destTaken = true; } catch {}
+if (destTaken) process.exit(24);
+if (safeSource === safeDest) throw new Error('Source and destination are the same path');
+if (sourceStat.isDirectory() && safeDest.startsWith(safeSource + path.sep)) {
+  throw new Error('Cannot move a directory inside itself');
+}
+fs.renameSync(safeSource, safeDest);
+process.stdout.write(JSON.stringify({moved: true}));
+`;
 const SEARCH_FILES_SCRIPT = `${COMMON_PATH_GUARD}
 const query = String(process.argv[2] || '').toLowerCase();
 const targetReal = fs.realpathSync(target);