pakstr 0.24.0 → 0.25.1

package/README.md

@@ -76,6 +76,21 @@ npm run build
 npx pakstr run
 ```
 
+**If your CI runs the job inside a sandbox with its own kernel** - a Kata microVM, or any
+runner where the job container is given no host Docker socket - the job has to start its
+own Docker daemon, and that daemon's default bridge cannot be brought up inside the
+sandbox. Set `PAKSTR_DOCKER_NETWORK=host` so every container pakstr creates joins the
+sandbox's own network namespace instead:
+
+```bash
+PAKSTR_DOCKER_NETWORK=host npx pakstr run
+```
+
+It applies to the build container, the signing container and the short-lived copy
+containers alike, because all of them are created the same way. Leave it unset on a
+workstation, where Docker's default network is what you want - host networking is not
+available on Docker Desktop for macOS.
+
 ---
 
 ## Documentation & License

package/dist/runners/DockerGradleRunner.js

@@ -8,6 +8,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const crypto_1 = require("crypto");
 const process_1 = require("./process");
+const dockerNetwork_1 = require("./dockerNetwork");
 const CONTAINER_RELEASE_APK_SIGNED = "/workspace/app/build/outputs/apk/release/app-release.apk";
 const CONTAINER_RELEASE_APK_UNSIGNED = "/workspace/app/build/outputs/apk/release/app-release-unsigned.apk";
 const CONTAINER_DEBUG_APK = "/workspace/app/build/outputs/apk/debug/app-debug.apk";
@@ -57,6 +58,7 @@ class DockerGradleRunner {
         this.execute("docker", [
             "run",
             "--rm",
+            ...(0, dockerNetwork_1.dockerNetworkArgs)(),
             "-v",
             `${storage.workspaceVolume}:/workspace`,
             this.image,
@@ -74,6 +76,7 @@ class DockerGradleRunner {
         this.execute("docker", [
             "run",
             "--rm",
+            ...(0, dockerNetwork_1.dockerNetworkArgs)(),
             "-v",
             `${storage.workspaceVolume}:/workspace`,
             this.image,
@@ -112,6 +115,7 @@ class DockerGradleRunner {
         try {
             this.execute("docker", [
                 "create",
+                ...(0, dockerNetwork_1.dockerNetworkArgs)(),
                 "--name",
                 container,
                 "-v",
@@ -132,6 +136,7 @@ class DockerGradleRunner {
         try {
             this.execute("docker", [
                 "create",
+                ...(0, dockerNetwork_1.dockerNetworkArgs)(),
                 "--name",
                 container,
                 "-v",

package/dist/runners/DockerSignRunner.js

@@ -10,6 +10,7 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const process_1 = require("./process");
+const dockerNetwork_1 = require("./dockerNetwork");
 class DockerSignRunner {
     image;
     execute;
@@ -53,6 +54,7 @@ class DockerSignRunner {
             const stdout = this.execute("docker", [
                 "run",
                 "--rm",
+                ...(0, dockerNetwork_1.dockerNetworkArgs)(),
                 "--tmpfs",
                 "/signing:mode=0700,uid=0",
                 "-v",
@@ -122,6 +124,7 @@ class DockerSignRunner {
         try {
             this.execute("docker", [
                 "create",
+                ...(0, dockerNetwork_1.dockerNetworkArgs)(),
                 "--name",
                 container,
                 "-v",
@@ -145,6 +148,7 @@ class DockerSignRunner {
         try {
             this.execute("docker", [
                 "create",
+                ...(0, dockerNetwork_1.dockerNetworkArgs)(),
                 "--name",
                 container,
                 "-v",

package/dist/runners/dockerNetwork.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dockerNetworkArgs = dockerNetworkArgs;
+/**
+ * The `--network` value passed to every container pakstr creates, read from
+ * PAKSTR_DOCKER_NETWORK.
+ *
+ * Unset means Docker's own default, which is what a workstation wants. A CI
+ * runner that sandboxes the job inside its own kernel needs the override: there
+ * the daemon's default bridge cannot be brought up - attaching a container to it
+ * writes to /proc/sys, which the sandbox exposes read-only - so `--network=host`
+ * puts the container in the sandbox's own network namespace instead, and the
+ * container inherits the resolvers the daemon itself uses.
+ *
+ * It is applied to `docker create` as well as `docker run`, because the workspace
+ * and artifact copy containers are created the same way and meet the same wall.
+ */
+function dockerNetworkArgs() {
+    const network = process.env.PAKSTR_DOCKER_NETWORK?.trim();
+    return network ? ["--network", network] : [];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.24.0",
+  "version": "0.25.1",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",