docker-stack 2.2.0__tar.gz → 2.2.2__tar.gz

{docker_stack-2.2.0 → docker_stack-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docker-stack
-Version: 2.2.0
+Version: 2.2.2
 Summary: CLI for deploying and managing Docker stacks.
 Home-page: https://github.com/mesudip/docker-stack
 Author: Sudip Bhattarai

{docker_stack-2.2.0 → docker_stack-2.2.2}/docker_stack/cli.py

@@ -137,33 +137,155 @@ def _select_node(value: str) -> str:
     return hostname
 
 
-def _human_age(timestamp: object) -> str:
+COMMAND_DISPLAY_WIDTH = 20
+SIZE_UNITS = ("B", "kB", "MB", "GB", "TB", "PB")
+
+
+def _human_duration(timestamp: object) -> str:
+    """Mirror docker's units.HumanDuration for the CREATED column."""
     try:
-        seconds = max(0, int(time.time()) - int(timestamp))
+        seconds = time.time() - float(timestamp)
     except (TypeError, ValueError):
-        return "-"
+        return ""
+    if seconds < 1:
+        return "Less than a second ago"
+    if int(seconds) == 1:
+        return "1 second ago"
     if seconds < 60:
-        return f"{seconds} seconds ago"
-    if seconds < 3600:
-        return f"{seconds // 60} minutes ago"
-    if seconds < 86400:
-        return f"{seconds // 3600} hours ago"
-    return f"{seconds // 86400} days ago"
+        return f"{int(seconds)} seconds ago"
+    minutes = int(seconds // 60)
+    if minutes == 1:
+        return "About a minute ago"
+    if minutes < 60:
+        return f"{minutes} minutes ago"
+    hours = int(seconds / 3600 + 0.5)
+    if hours == 1:
+        return "About an hour ago"
+    if hours < 48:
+        return f"{hours} hours ago"
+    if hours < 24 * 7 * 2:
+        return f"{hours // 24} days ago"
+    if hours < 24 * 30 * 2:
+        return f"{hours // 24 // 7} weeks ago"
+    if hours < 24 * 365 * 2:
+        return f"{hours // 24 // 30} months ago"
+    return f"{hours // 24 // 365} years ago"
+
+
+def _human_size(value: object) -> str:
+    try:
+        size = float(value)
+    except (TypeError, ValueError):
+        return ""
+    index = 0
+    while size >= 1000.0 and index < len(SIZE_UNITS) - 1:
+        size /= 1000.0
+        index += 1
+    return f"{size:.3g}{SIZE_UNITS[index]}"
+
+
+def _quote_command(value: str) -> str:
+    escaped = value.replace("\\", "\\\\").replace('"', '\\"')
+    return f'"{escaped}"'
+
+
+def _ellipsis(value: str, width: int) -> str:
+    if width <= 0:
+        return ""
+    if len(value) <= width:
+        return value
+    return value[: width - 1] + "…"
+
+
+def _form_port_group(key: str, first: int, last: int) -> str:
+    parts = key.split("/")
+    address = ""
+    protocol = parts[0]
+    if len(parts) > 1:
+        address = parts[0]
+        protocol = parts[1]
+    group = str(first) if first == last else f"{first}-{last}"
+    if address:
+        group = f"{address}:{group}->{group}"
+    return f"{group}/{protocol}"
 
 
 def _format_ports(ports: object) -> str:
+    """Mirror docker's api/types.DisplayablePorts for the PORTS column."""
     if not isinstance(ports, list):
         return ""
-    values = []
+    entries = []
     for port in ports:
         if not isinstance(port, dict):
             continue
-        private = port.get("PrivatePort")
-        protocol = port.get("Type") or "tcp"
-        public = port.get("PublicPort")
-        address = port.get("IP") or "0.0.0.0"
-        values.append(f"{address}:{public}->{private}/{protocol}" if public is not None else f"{private}/{protocol}")
-    return ", ".join(values)
+        try:
+            private = int(port.get("PrivatePort"))
+        except (TypeError, ValueError):
+            continue
+        try:
+            public = int(port.get("PublicPort"))
+        except (TypeError, ValueError):
+            public = None
+        entries.append((private, str(port.get("Type") or "tcp"), str(port.get("IP") or ""), public))
+    entries.sort(key=lambda entry: entry[0])
+    groups: Dict[str, List[int]] = {}
+    group_keys: List[str] = []
+    result: List[str] = []
+    host_mappings: List[str] = []
+    for private, protocol, address, public in entries:
+        key = protocol
+        if address and public:
+            if public != private:
+                host_mappings.append(f"{address}:{public}->{private}/{protocol}")
+                continue
+            key = f"{address}/{protocol}"
+        group = groups.get(key)
+        if group is None:
+            groups[key] = [private, private]
+            group_keys.append(key)
+            continue
+        if private == group[1] + 1:
+            group[1] = private
+            continue
+        result.append(_form_port_group(key, group[0], group[1]))
+        groups[key] = [private, private]
+    for key in group_keys:
+        first, last = groups[key]
+        result.append(_form_port_group(key, first, last))
+    result.extend(host_mappings)
+    return ", ".join(result)
+
+
+def _format_names(names: object, *, no_trunc: bool) -> str:
+    values = [str(name).lstrip("/") for name in names] if isinstance(names, list) else []
+    if not no_trunc:
+        for name in values:
+            if "/" not in name:
+                values = [name]
+                break
+    return ",".join(values)
+
+
+def _format_image(image: object, image_id: object, *, no_trunc: bool) -> str:
+    value = str(image or "")
+    if not value:
+        return "<no image>"
+    if no_trunc:
+        return value
+    identifier = str(image_id or "")
+    if identifier and _short_id(identifier) == _short_id(value):
+        return _short_id(value)
+    return value
+
+
+def _short_id(value: str) -> str:
+    return value[len("sha256:") :][:12] if value.startswith("sha256:") else value[:12]
+
+
+def _print_table(columns: List[str], rows: List[Dict[str, str]]) -> None:
+    widths = {column: max(len(column), max((len(row[column]) for row in rows), default=0)) for column in columns}
+    for values in [{column: column for column in columns}, *rows]:
+        print("   ".join(values[column].ljust(widths[column]) for column in columns).rstrip())
 
 
 def _print_cluster_containers(payload: Dict[str, object], *, no_trunc: bool = False, show_size: bool = False) -> int:
@@ -172,29 +294,31 @@ def _print_cluster_containers(payload: Dict[str, object], *, no_trunc: bool = Fa
         if not isinstance(entry, dict) or not isinstance(entry.get("docker"), dict):
             continue
         item = entry["docker"]
-        container_id = str(item.get("Id") or "-")
-        names = item.get("Names") if isinstance(item.get("Names"), list) else []
+        container_id = str(item.get("Id") or "")
+        command = str(item.get("Command") or "")
         row = {
             "CONTAINER ID": container_id if no_trunc else container_id[:12],
-            "IMAGE": str(item.get("Image") or "-"),
-            "COMMAND": str(item.get("Command") or "-"),
-            "CREATED": _human_age(item.get("Created")),
-            "STATUS": str(item.get("Status") or item.get("State") or "-"),
+            "IMAGE": _format_image(item.get("Image"), item.get("ImageID"), no_trunc=no_trunc),
+            "COMMAND": _quote_command(command if no_trunc else _ellipsis(command, COMMAND_DISPLAY_WIDTH)),
+            "CREATED": _human_duration(item.get("Created")),
+            "STATUS": str(item.get("Status") or item.get("State") or ""),
             "PORTS": _format_ports(item.get("Ports")),
-            "NAMES": ",".join(str(name).lstrip("/") for name in names) or "-",
-            "NODE": str(entry.get("node_name") or entry.get("node_id") or "-"),
+            "NAMES": _format_names(item.get("Names"), no_trunc=no_trunc),
+            "NODE": str(entry.get("node_name") or entry.get("node_id") or ""),
         }
         if show_size:
-            row["SIZE"] = str(item.get("SizeRw") if item.get("SizeRw") is not None else "-")
+            size = _human_size(item.get("SizeRw") or 0)
+            try:
+                virtual = float(item.get("SizeRootFs") or 0)
+            except (TypeError, ValueError):
+                virtual = 0
+            row["SIZE"] = f"{size} (virtual {_human_size(virtual)})" if virtual > 0 else size
         rows.append(row)
     columns = ["CONTAINER ID", "IMAGE", "COMMAND", "CREATED", "STATUS", "PORTS", "NAMES"]
     if show_size:
         columns.append("SIZE")
     columns.append("NODE")
-    widths = {column: max(len(column), max((len(row[column]) for row in rows), default=0)) for column in columns}
-    print("   ".join(column.ljust(widths[column]) for column in columns))
-    for row in rows:
-        print("   ".join(row[column].ljust(widths[column]) for column in columns))
+    _print_table(columns, rows)
     errors = payload.get("node_errors") if isinstance(payload.get("node_errors"), list) else []
     for error in errors:
         if isinstance(error, dict):
@@ -1628,6 +1752,7 @@ def open_context_shell(config_dir: Path, context_name: str) -> int:
         env.pop(key, None)
     env["DOCKER_CONFIG"] = str(config_dir)
     env["DOCKER_CONTEXT"] = context_name
+    env["DOCKER_MANAGER_CONTEXT_NAME"] = context_name
     shell = env.get("SHELL", "").strip() or "/bin/bash"
     return subprocess.run([shell, "-i"], check=False, env=env).returncode
 

{docker_stack-2.2.0 → docker_stack-2.2.2}/docker_stack/login.py

@@ -14,7 +14,7 @@ import webbrowser
 from dataclasses import dataclass
 from http.server import BaseHTTPRequestHandler, HTTPServer
 from pathlib import Path
-from typing import Callable, Dict, Optional
+from typing import Callable, Dict, Optional, Tuple
 
 from docker_stack.command_runner import run_command
 
@@ -111,8 +111,132 @@ def _candidate_urls(target: str, *, verify_ssl: bool) -> list[str]:
     return [https_candidate, f"http://{normalized_target}:2375"]
 
 
-def probe_manager_url(url: str, *, timeout: int = 3, verify_tls: bool = True) -> tuple[bool, bool]:
-    request = urllib.request.Request(f"{url.rstrip('/')}/_ping", method="GET")
+DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV = "DOCKER_MANAGER_SKIP_TLS_VERIFY"
+LOOPBACK_HOSTS = {"localhost", "127.0.0.1", "::1"}
+_TRUTHY_VALUES = {"1", "true", "yes", "on"}
+_FALSY_VALUES = {"0", "false", "no", "off"}
+_CONTEXT_INSPECT_CACHE: Dict[Tuple[str, str], Optional[Dict[str, object]]] = {}
+
+
+def _parse_bool(value: Optional[str]) -> Optional[bool]:
+    if value is None:
+        return None
+    normalized = value.strip().lower()
+    if normalized in _TRUTHY_VALUES:
+        return True
+    if normalized in _FALSY_VALUES:
+        return False
+    return None
+
+
+def _host_and_port(value: str) -> Optional[Tuple[str, Optional[int]]]:
+    target = normalize_manager_target(value)
+    parsed = urllib.parse.urlparse(target if "://" in target else f"//{target}")
+    if not parsed.hostname:
+        return None
+    try:
+        port = parsed.port
+    except ValueError:
+        return None
+    return parsed.hostname.lower(), port
+
+
+def docker_config_path(docker_config_dir: Optional[Path] = None) -> Path:
+    if docker_config_dir is None:
+        configured = os.getenv("DOCKER_CONFIG", "").strip()
+        docker_config_dir = Path(configured) if configured else Path.home() / ".docker"
+    return Path(docker_config_dir) / "config.json"
+
+
+def docker_config_http_headers(docker_config_dir: Optional[Path] = None) -> Dict[str, str]:
+    """Headers the Docker CLI sends to the manager, including the access token."""
+    try:
+        payload = read_docker_config(docker_config_path(docker_config_dir))
+    except RuntimeError:
+        return {}
+    headers = payload.get("HttpHeaders")
+    if not isinstance(headers, dict):
+        return {}
+    return {
+        str(key): str(value)
+        for key, value in headers.items()
+        if isinstance(key, str) and isinstance(value, str) and key.strip() and value.strip()
+    }
+
+
+def _probe_headers(url: str, headers: Optional[Dict[str, str]]) -> Dict[str, str]:
+    if not headers:
+        return {}
+    if url.startswith("https://"):
+        return dict(headers)
+    host = (_host_and_port(url) or ("", None))[0]
+    if host in LOOPBACK_HOSTS:
+        return dict(headers)
+    # Never put the access token on the wire in cleartext towards a remote host.
+    return {key: value for key, value in headers.items() if key.lower() != "authorization"}
+
+
+def _docker_context_skip_tls_verify(context_payload: Optional[Dict[str, object]]) -> Optional[bool]:
+    if not isinstance(context_payload, dict):
+        return None
+    endpoints = context_payload.get("Endpoints") or context_payload.get("endpoints") or {}
+    docker_endpoint = {}
+    if isinstance(endpoints, dict):
+        docker_endpoint = endpoints.get("docker") or endpoints.get("Docker") or {}
+    if not isinstance(docker_endpoint, dict):
+        return None
+    value = docker_endpoint.get("SkipTLSVerify")
+    if value is None:
+        value = docker_endpoint.get("skipTLSVerify")
+    return bool(value) if isinstance(value, bool) else None
+
+
+def _skip_tls_verify_hint(
+    target: str,
+    *,
+    context_name: Optional[str] = None,
+    docker_config_dir: Optional[Path] = None,
+) -> Optional[bool]:
+    """The TLS mode of an endpoint we already configured, so probing it again is unnecessary."""
+    env_hint = _parse_bool(os.getenv(DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV))
+    if env_hint is not None:
+        return env_hint
+    target_origin = _host_and_port(target)
+    if target_origin is None or target_origin[1] is None:
+        return None
+    candidate_names = [
+        context_name,
+        os.getenv("DOCKER_MANAGER_CONTEXT_NAME"),
+        os.getenv("DOCKER_CONTEXT"),
+    ]
+    seen = set()
+    for name in candidate_names:
+        name = (name or "").strip()
+        if not name or name in seen:
+            continue
+        seen.add(name)
+        payload = _inspect_docker_context(name, docker_config_dir)
+        host = _docker_context_host(payload)
+        if not host or _host_and_port(host) != target_origin:
+            continue
+        hint = _docker_context_skip_tls_verify(payload)
+        if hint is not None:
+            return hint
+    return None
+
+
+def probe_manager_url(
+    url: str,
+    *,
+    timeout: int = 3,
+    verify_tls: bool = True,
+    headers: Optional[Dict[str, str]] = None,
+) -> tuple[bool, bool]:
+    request = urllib.request.Request(
+        f"{url.rstrip('/')}/_ping",
+        method="GET",
+        headers=_probe_headers(url, headers),
+    )
     context = None
     if url.startswith("https://") and not verify_tls:
         context = ssl._create_unverified_context()
@@ -132,20 +256,34 @@ def probe_manager_url(url: str, *, timeout: int = 3, verify_tls: bool = True) ->
         return False, True
 
 
-def detect_manager_url(target: str, *, verify_ssl: bool = False) -> tuple[str, bool]:
+def detect_manager_url(
+    target: str,
+    *,
+    verify_ssl: bool = False,
+    skip_tls_verify: Optional[bool] = None,
+    headers: Optional[Dict[str, str]] = None,
+) -> tuple[str, bool]:
     normalized_target = normalize_manager_target(target)
     parsed = urllib.parse.urlparse(normalized_target)
     explicit_scheme = parsed.scheme in {"http", "https"}
 
     candidates = _candidate_urls(normalized_target, verify_ssl=verify_ssl)
     tls_verification_failed = False
+    known_skip_tls_verify = None if verify_ssl else skip_tls_verify
 
     for candidate in candidates:
-        success, cert_failed = probe_manager_url(candidate, verify_tls=True)
+        if known_skip_tls_verify and candidate.startswith("https://"):
+            # The endpoint is known to serve a certificate this trust store cannot
+            # verify. A verified handshake would only abort with an UnknownCA alert.
+            insecure_success, _ = probe_manager_url(candidate, verify_tls=False, headers=headers)
+            if insecure_success:
+                return candidate, True
+            continue
+        success, cert_failed = probe_manager_url(candidate, verify_tls=True, headers=headers)
         if success:
             return candidate, False
         if candidate.startswith("https://") and cert_failed and not verify_ssl:
-            insecure_success, _ = probe_manager_url(candidate, verify_tls=False)
+            insecure_success, _ = probe_manager_url(candidate, verify_tls=False, headers=headers)
             if insecure_success:
                 return candidate, True
             tls_verification_failed = True
@@ -203,6 +341,13 @@ def _docker_env(docker_config_dir: Optional[Path] = None) -> Dict[str, str]:
 
 
 def _inspect_docker_context(context_name: str, docker_config_dir: Optional[Path] = None) -> Optional[Dict[str, object]]:
+    cache_key = (context_name, str(docker_config_dir or os.getenv("DOCKER_CONFIG", "")))
+    if cache_key not in _CONTEXT_INSPECT_CACHE:
+        _CONTEXT_INSPECT_CACHE[cache_key] = _read_docker_context(context_name, docker_config_dir)
+    return _CONTEXT_INSPECT_CACHE[cache_key]
+
+
+def _read_docker_context(context_name: str, docker_config_dir: Optional[Path] = None) -> Optional[Dict[str, object]]:
     inspect = subprocess.run(
         ["docker", "context", "inspect", context_name],
         text=True,
@@ -256,6 +401,42 @@ def docker_context_target(context_name: str, docker_config_dir: Optional[Path] =
     return _docker_context_host(_inspect_docker_context(context_name, docker_config_dir))
 
 
+def _resolve_manager_endpoint(
+    target: str,
+    *,
+    verify_ssl: bool = False,
+    context_name: Optional[str] = None,
+    docker_config_dir: Optional[Path] = None,
+) -> tuple[str, bool]:
+    """Resolve the manager URL, avoiding probes when the endpoint is already configured."""
+    normalized_target = normalize_manager_target(target)
+    headers = docker_config_http_headers(docker_config_dir)
+    hint = None
+    if not verify_ssl:
+        hint = _skip_tls_verify_hint(
+            normalized_target,
+            context_name=context_name,
+            docker_config_dir=docker_config_dir,
+        )
+        if hint is not None:
+            candidates = _candidate_urls(normalized_target, verify_ssl=False)
+            if len(candidates) == 1:
+                candidate = candidates[0]
+                return candidate, hint if candidate.startswith("https://") else False
+            if hint:
+                # Skipping verification only applies to a TLS endpoint, so the
+                # scheme is settled too and no candidate probing is needed.
+                for candidate in candidates:
+                    if candidate.startswith("https://"):
+                        return candidate, True
+    return detect_manager_url(
+        normalized_target,
+        verify_ssl=verify_ssl,
+        skip_tls_verify=hint,
+        headers=headers,
+    )
+
+
 def resolve_login_config(
     *,
     manager_url: Optional[str] = None,
@@ -285,19 +466,45 @@ def resolve_login_config(
             inferred_context_name = manager_target
             if isolated_context_target:
                 resolved_docker_config_dir = isolated_config_dir
+    endpoint_context_name = (
+        context_name
+        or os.getenv("DOCKER_MANAGER_CONTEXT_NAME")
+        or inferred_context_name
+        or current_context_name
+    )
     if manager_target:
-        resolved_manager_url, skip_tls_verify = detect_manager_url(raw_manager_value, verify_ssl=verify_ssl)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            raw_manager_value,
+            verify_ssl=verify_ssl,
+            context_name=endpoint_context_name,
+            docker_config_dir=resolved_docker_config_dir,
+        )
     elif manager_url:
         resolved_manager_url = normalize_loopback_host(raw_manager_value)
         skip_tls_verify = False
         if resolved_manager_url.startswith("https://"):
-            _, skip_tls_verify = detect_manager_url(resolved_manager_url, verify_ssl=verify_ssl)
+            _, skip_tls_verify = _resolve_manager_endpoint(
+                resolved_manager_url,
+                verify_ssl=verify_ssl,
+                context_name=endpoint_context_name,
+                docker_config_dir=resolved_docker_config_dir,
+            )
         elif verify_ssl:
             raise RuntimeError("verify_ssl=true requires an HTTPS manager URL")
     elif env_manager_value and "://" not in env_manager_value:
-        resolved_manager_url, skip_tls_verify = detect_manager_url(raw_manager_value, verify_ssl=verify_ssl)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            raw_manager_value,
+            verify_ssl=verify_ssl,
+            context_name=endpoint_context_name,
+            docker_config_dir=resolved_docker_config_dir,
+        )
     elif current_context_target:
-        resolved_manager_url, skip_tls_verify = detect_manager_url(raw_manager_value, verify_ssl=verify_ssl)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            raw_manager_value,
+            verify_ssl=verify_ssl,
+            context_name=endpoint_context_name,
+            docker_config_dir=resolved_docker_config_dir,
+        )
     else:
         resolved_manager_url = normalize_loopback_host(raw_manager_value)
         skip_tls_verify = False
@@ -323,7 +530,7 @@ def resolve_context_login_config(
     target = docker_context_target(context_name)
     if not target:
         raise RuntimeError(f"Docker context '{context_name}' does not have a TCP/HTTP(S) Docker endpoint")
-    resolved_manager_url, skip_tls_verify = detect_manager_url(target)
+    resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(target, context_name=context_name)
     return DockerManagerLoginConfig(
         manager_url=resolved_manager_url,
         context_name=context_name,
@@ -343,7 +550,10 @@ def resolve_shell_login_config(
         resolved_context_name = context_name or shell_name
         if not resolved_context_name:
             raise RuntimeError("Pass --context <name> when providing a manager target")
-        resolved_manager_url, skip_tls_verify = detect_manager_url(manager_target)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            manager_target,
+            context_name=resolved_context_name,
+        )
         return DockerManagerLoginConfig(
             manager_url=resolved_manager_url,
             context_name=resolved_context_name,
@@ -360,7 +570,11 @@ def resolve_shell_login_config(
         target = persisted_target or docker_context_target(resolved_context_name)
         if not target:
             raise UnknownShellContextError(resolved_context_name)
-        resolved_manager_url, skip_tls_verify = detect_manager_url(target)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            target,
+            context_name=resolved_context_name,
+            docker_config_dir=isolated_docker_config_dir(resolved_context_name) if persisted_target else None,
+        )
         return DockerManagerLoginConfig(
             manager_url=resolved_manager_url,
             context_name=resolved_context_name,
@@ -370,7 +584,10 @@ def resolve_shell_login_config(
 
     current_context_name, current_target = current_docker_context_target()
     if current_context_name and current_target:
-        resolved_manager_url, skip_tls_verify = detect_manager_url(current_target)
+        resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
+            current_target,
+            context_name=current_context_name,
+        )
         return DockerManagerLoginConfig(
             manager_url=resolved_manager_url,
             context_name=current_context_name,

{docker_stack-2.2.0 → docker_stack-2.2.2}/docker_stack/shell_auth.py

@@ -16,6 +16,7 @@ from pathlib import Path
 from typing import Any, Dict, Optional
 
 from docker_stack.login import (
+    DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV,
     DockerManagerLoginConfig,
     DockerManagerLoginResult,
     browser_login,
@@ -733,6 +734,10 @@ def run_managed_shell(config: DockerManagerLoginConfig, result: DockerManagerLog
         env["DOCKER_CONTEXT"] = config.context_name
         env["DOCKER_MANAGER_URL"] = config.manager_url
         env["DOCKER_MANAGER_CONTEXT_NAME"] = config.context_name
+        # The endpoint's TLS mode is already known, so in-shell commands never
+        # need to re-probe it (a verified probe against a private CA only
+        # produces aborted TLS connections on the manager).
+        env[DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV] = "1" if config.skip_tls_verify else "0"
         env[SHELL_ORIGINAL_ZDOTDIR_ENV] = str(
             Path(os.getenv(SHELL_ORIGINAL_ZDOTDIR_ENV) or os.getenv("ZDOTDIR", str(Path.home())))
         )

{docker_stack-2.2.0 → docker_stack-2.2.2}/docker_stack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docker-stack
-Version: 2.2.0
+Version: 2.2.2
 Summary: CLI for deploying and managing Docker stacks.
 Home-page: https://github.com/mesudip/docker-stack
 Author: Sudip Bhattarai

{docker_stack-2.2.0 → docker_stack-2.2.2}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="docker-stack",
-    version="2.2.0",
+    version="2.2.2",
     description="CLI for deploying and managing Docker stacks.",
     long_description=open("README.md").read(),  # You can include a README file to describe your package
     long_description_content_type="text/markdown",

{docker_stack-2.2.0 → docker_stack-2.2.2}/tests/test_docker_stack.py

@@ -2,6 +2,7 @@ import base64
 import json
 import os
 import subprocess
+import time
 from pathlib import Path
 from types import SimpleNamespace
 
@@ -88,6 +89,48 @@ def test_managed_docker_ps_renders_node_column(monkeypatch, capsys):
     assert "abcdef123456" in output
 
 
+def test_managed_docker_ps_matches_docker_columns(monkeypatch, capsys):
+    client = SimpleNamespace(
+        supports=lambda feature: feature == "cluster_container_cli_v1",
+        list_containers=lambda **_kwargs: {
+            "containers": [
+                {
+                    "node_id": "node-1",
+                    "node_name": "worker-02",
+                    "docker": {
+                        "Id": "467fce208a05dddd",
+                        "Image": "registry.example.com/app/backend:v1",
+                        "Command": "sh -c 'java $JAVA_OPTS -jar /app/app.jar'",
+                        "Created": int(time.time()) - 17 * 60,
+                        "Status": "Up 17 minutes",
+                        "Ports": [
+                            {"PrivatePort": 8080, "Type": "tcp"},
+                            {"PrivatePort": 8081, "Type": "tcp"},
+                            {"IP": "0.0.0.0", "PrivatePort": 443, "PublicPort": 8443, "Type": "tcp"},
+                        ],
+                        "Names": ["/app_backend.1.qtfngt97xvabnhj0ehk4us6kk"],
+                    },
+                }
+            ],
+            "node_errors": [],
+        },
+    )
+    monkeypatch.setattr("docker_stack.cli.discover_manager_client", lambda: client)
+
+    assert _managed_docker(["ps"]) == 0
+    header, row = capsys.readouterr().out.splitlines()
+
+    assert header.split() == [
+        "CONTAINER", "ID", "IMAGE", "COMMAND", "CREATED", "STATUS", "PORTS", "NAMES", "NODE",
+    ]
+    assert row.startswith("467fce208a05   ")
+    assert '"sh -c \'java $JAVA_O\u2026"' in row
+    assert "17 minutes ago" in row
+    assert "8080-8081/tcp, 0.0.0.0:8443->443/tcp" in row
+    assert row.endswith("worker-02")
+    assert row == row.rstrip()
+
+
 def test_managed_docker_ps_forwards_global_latest_and_limit(monkeypatch):
     calls = []
     client = SimpleNamespace(

{docker_stack-2.2.0 → docker_stack-2.2.2}/tests/test_login.py

@@ -9,12 +9,15 @@ import urllib.request
 import pytest
 
 from docker_stack.login import (
+    DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV,
     clear_docker_config_authorization_header,
     DockerManagerLoginConfig,
     build_auth_url,
     browser_login,
     configure_docker_context,
     detect_manager_url,
+    docker_config_http_headers,
+    probe_manager_url,
     ensure_isolated_login,
     format_expiry,
     isolated_docker_config_dir,
@@ -254,7 +257,7 @@ def test_configure_docker_context_uses_skip_tls_verify_for_detected_tls(monkeypa
 
 
 def test_detect_manager_url_prefers_https_when_available(monkeypatch):
-    def fake_probe(url, *, timeout=3, verify_tls=True):
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
         if url == "https://172.31.0.6:2376":
             return True, False
         return False, False
@@ -268,7 +271,7 @@ def test_detect_manager_url_prefers_https_when_available(monkeypatch):
 
 
 def test_detect_manager_url_marks_skip_verify_for_self_signed_tls(monkeypatch):
-    def fake_probe(url, *, timeout=3, verify_tls=True):
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
         if url == "https://172.31.0.6:2376" and verify_tls:
             return False, True
         if url == "https://172.31.0.6:2376" and not verify_tls:
@@ -284,7 +287,7 @@ def test_detect_manager_url_marks_skip_verify_for_self_signed_tls(monkeypatch):
 
 
 def test_detect_manager_url_uses_http_default_port_when_https_unavailable(monkeypatch):
-    def fake_probe(url, *, timeout=3, verify_tls=True):
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
         if url == "http://172.31.0.6:2375":
             return True, False
         return False, False
@@ -297,6 +300,144 @@ def test_detect_manager_url_uses_http_default_port_when_https_unavailable(monkey
     assert skip_tls_verify is False
 
 
+def test_detect_manager_url_skips_verified_probe_when_tls_mode_is_known(monkeypatch):
+    attempts = []
+
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
+        attempts.append((url, verify_tls))
+        return (not verify_tls), False
+
+    monkeypatch.setattr("docker_stack.login.probe_manager_url", fake_probe)
+
+    url, skip_tls_verify = detect_manager_url("https://localhost:2376", skip_tls_verify=True)
+
+    assert url == "https://localhost:2376"
+    assert skip_tls_verify is True
+    # A verified handshake against a private CA is what produced UnknownCA alerts.
+    assert attempts == [("https://localhost:2376", False)]
+
+
+def test_detect_manager_url_ignores_skip_hint_when_verification_is_required(monkeypatch):
+    attempts = []
+
+    def fake_probe(url, *, timeout=3, verify_tls=True, headers=None):
+        attempts.append((url, verify_tls))
+        return verify_tls, False
+
+    monkeypatch.setattr("docker_stack.login.probe_manager_url", fake_probe)
+
+    url, skip_tls_verify = detect_manager_url(
+        "https://localhost:2376",
+        verify_ssl=True,
+        skip_tls_verify=True,
+    )
+
+    assert url == "https://localhost:2376"
+    assert skip_tls_verify is False
+    assert attempts == [("https://localhost:2376", True)]
+
+
+def test_probe_manager_url_sends_docker_config_headers(monkeypatch):
+    captured = {}
+
+    class FakeResponse:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args):
+            return False
+
+        def read(self, _size=None):
+            return b""
+
+    def fake_urlopen(request, timeout=None, context=None):
+        captured["url"] = request.full_url
+        captured["headers"] = dict(request.header_items())
+        return FakeResponse()
+
+    monkeypatch.setattr("docker_stack.login.urllib.request.urlopen", fake_urlopen)
+
+    assert probe_manager_url(
+        "https://localhost:2376",
+        headers={"Authorization": "Bearer token-value"},
+    ) == (True, False)
+    assert captured["url"] == "https://localhost:2376/_ping"
+    assert captured["headers"]["Authorization"] == "Bearer token-value"
+
+
+def test_probe_manager_url_withholds_token_over_remote_cleartext(monkeypatch):
+    captured = {}
+
+    class FakeResponse:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args):
+            return False
+
+        def read(self, _size=None):
+            return b""
+
+    def fake_urlopen(request, timeout=None, context=None):
+        captured["headers"] = dict(request.header_items())
+        return FakeResponse()
+
+    monkeypatch.setattr("docker_stack.login.urllib.request.urlopen", fake_urlopen)
+
+    probe_manager_url("http://manager.example.com:2375", headers={"Authorization": "Bearer token-value"})
+
+    assert "Authorization" not in captured["headers"]
+
+    probe_manager_url("http://localhost:2375", headers={"Authorization": "Bearer token-value"})
+
+    assert captured["headers"]["Authorization"] == "Bearer token-value"
+
+
+def test_docker_config_http_headers_reads_active_config(monkeypatch, tmp_path):
+    (tmp_path / "config.json").write_text(
+        json.dumps({"HttpHeaders": {"Authorization": "Bearer token-value", "X-Empty": " "}}),
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("DOCKER_CONFIG", str(tmp_path))
+
+    assert docker_config_http_headers() == {"Authorization": "Bearer token-value"}
+
+
+def test_resolve_login_config_skips_probing_when_shell_exports_tls_mode(monkeypatch):
+    def fail_probe(*_args, **_kwargs):
+        raise AssertionError("the manager must not be probed when its TLS mode is known")
+
+    monkeypatch.setattr("docker_stack.login.probe_manager_url", fail_probe)
+    monkeypatch.setenv("DOCKER_MANAGER_URL", "https://localhost:2376")
+    monkeypatch.setenv(DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV, "1")
+
+    config = resolve_login_config(manager_target="https://localhost:2376")
+
+    assert config.manager_url == "https://localhost:2376"
+    assert config.skip_tls_verify is True
+
+
+def test_resolve_login_config_reuses_context_tls_mode(monkeypatch):
+    def fail_probe(*_args, **_kwargs):
+        raise AssertionError("the manager must not be probed when its TLS mode is known")
+
+    monkeypatch.setattr("docker_stack.login.probe_manager_url", fail_probe)
+    monkeypatch.setattr(
+        "docker_stack.login._inspect_docker_context",
+        lambda name, docker_config_dir=None: {
+            "Name": name,
+            "Endpoints": {"docker": {"Host": "tcp://localhost:2376", "SkipTLSVerify": True}},
+        },
+    )
+    monkeypatch.delenv(DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV, raising=False)
+    monkeypatch.setenv("DOCKER_CONTEXT", "local")
+
+    config = resolve_login_config(manager_target="tcp://localhost:2376")
+
+    assert config.manager_url == "https://localhost:2376"
+    assert config.skip_tls_verify is True
+
+
 def test_detect_manager_url_verify_ssl_requires_https(monkeypatch):
     with pytest.raises(RuntimeError, match="requires an HTTPS manager URL"):
         detect_manager_url("http://172.31.0.6", verify_ssl=True)
@@ -361,7 +502,7 @@ def test_resolve_login_config_ignores_malformed_context_host(monkeypatch):
 
 
 def test_resolve_login_config_detects_tls_for_positional_target(monkeypatch):
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True))
 
     config = resolve_login_config(manager_target="172.31.0.6:2378", context_name="office")
 
@@ -375,7 +516,7 @@ def test_resolve_login_config_prefers_named_context_for_portless_target(monkeypa
         "docker_stack.login.docker_context_target",
         lambda context_name, docker_config_dir=None: "tcp://172.31.0.6:2378" if context_name == "office" else None,
     )
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True))
 
     config = resolve_login_config(manager_target="office")
 
@@ -394,7 +535,7 @@ def test_resolve_login_config_prefers_isolated_named_context(monkeypatch, tmp_pa
     )
     monkeypatch.setattr(
         "docker_stack.login.detect_manager_url",
-        lambda value, verify_ssl=False: ("https://172.31.3.3:2376", False),
+        lambda value, verify_ssl=False, **_kwargs: ("https://172.31.3.3:2376", False),
     )
 
     config = resolve_login_config(manager_target="saas-a")
@@ -409,7 +550,7 @@ def test_resolve_login_config_uses_current_context_target(monkeypatch):
         "docker_stack.login.current_docker_context_target",
         lambda: ("office", "tcp://172.31.0.6:2378"),
     )
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True))
 
     config = resolve_login_config()
 
@@ -434,7 +575,7 @@ def test_resolve_shell_login_config_uses_persisted_context(monkeypatch):
             "tcp://172.31.0.6:2378" if docker_config_dir == isolated_docker_config_dir("office") else None
         ),
     )
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, **_kwargs: ("https://172.31.0.6:2378", True))
 
     config = resolve_shell_login_config(shell_name="office", manager_target=None, context_name=None)