manta-node 0.5b0.dev87__py3-none-any.whl → 0.5b0.dev91__py3-none-any.whl

manta_node/task_manager.py

@@ -1,9 +1,10 @@
 import asyncio
+import os
 from collections import deque
 from datetime import datetime
 from pathlib import Path
 from tempfile import TemporaryDirectory
-from typing import List, Optional, Set, Tuple
+from typing import Dict, List, Optional, Set, Tuple
 
 from manta_common.build.common.system import EnvId, PairId
 from manta_common.build.common.tasks import MqttTask, TaskStatus, TaskUpdate
@@ -21,7 +22,34 @@ from .infrastructure.container.manager import ContainerManager
 from .infrastructure.grpc.client import NodeClient
 from .tasks import TaskProgression, TaskProgressions
 
-__all__ = ["TaskManager"]
+__all__ = ["TaskManager", "build_image_env", "IMAGE_ENV_ALLOWLIST_VAR"]
+
+# Name of the node-environment variable holding the comma-separated allowlist of
+# env vars to forward into image-mode containers. Set via the manta-node systemd
+# EnvironmentFile. Empty/unset => only the reserved keys are injected.
+IMAGE_ENV_ALLOWLIST_VAR = "MANTA_IMAGE_ENV"
+
+
+def build_image_env(reserved: Dict[str, str]) -> Dict[str, str]:
+    """Build the environment for an image-mode container.
+
+    Forwards an allowlisted set of the node's own environment variables into the
+    container, merged under the caller's ``reserved`` keys — reserved keys win on
+    collision so a node env var can never spoof e.g. ``TASK_ID``.
+
+    The allowlist is a comma-separated list of variable names read from
+    ``MANTA_IMAGE_ENV`` in the node's own environment (typically populated by the
+    manta-node systemd ``EnvironmentFile``). Names absent from the node
+    environment are skipped. When ``MANTA_IMAGE_ENV`` is unset or empty, only the
+    reserved keys are injected (prior behaviour).
+    """
+    names = [
+        name.strip()
+        for name in os.environ.get(IMAGE_ENV_ALLOWLIST_VAR, "").split(",")
+        if name.strip()
+    ]
+    forwarded = {name: os.environ[name] for name in names if name in os.environ}
+    return {**forwarded, **reserved}
 
 
 class TaskManager(ContainerManager, ImageExecutor):
@@ -233,10 +261,12 @@ class TaskManager(ContainerManager, ImageExecutor):
                 swarm_id=swarm_id,
                 task_id=task_id,
                 image=task.image,
-                environment={
-                    "TASK_ID": task_id.xid,
-                    "SWARM_ID": swarm_id.xid,
-                },
+                environment=build_image_env(
+                    {
+                        "TASK_ID": task_id.xid,
+                        "SWARM_ID": swarm_id.xid,
+                    }
+                ),
             )
             self.image_task_ids.add((swarm_id.tid, task_id.tid))
         else:

{manta_node-0.5b0.dev87.dist-info → manta_node-0.5b0.dev91.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: manta_node
-Version: 0.5b0.dev87
+Version: 0.5b0.dev91
 Summary: Node side software of the Manta platform. It is responsible for the communication with the Manta Core and the execution of the tasks.
 Author-email: Hugo Miralles <hugomiralles@manta-tech.io>, Matthew Thompson <matthew.thompson@manta-tech.io>
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE

{manta_node-0.5b0.dev87.dist-info → manta_node-0.5b0.dev91.dist-info}/RECORD

@@ -1,7 +1,7 @@
 manta_node/__init__.py,sha256=bgGWXH3yQVhNf0v1ZGUBAy5Y51fqb0Y-EaLnocbcino,153
 manta_node/__main__.py,sha256=0VzbY1KfezaARZDuCBc7Th1GO_-BnKTK8eDEXhgP5J4,1731
 manta_node/node_orchestrator.py,sha256=0VMBsZSMQiIe9L-Bd7Jn4avNpNyDCMa1kyPSTgRiOes,17336
-manta_node/task_manager.py,sha256=8Yy8ShoKbMemvm3UMPt9xJnoZsxiCptqdWnhAKJnhl4,18498
+manta_node/task_manager.py,sha256=B_h6Mc7to8CTzLLgqrINgEALTYWX1Aek3Tio34ICXag,19887
 manta_node/tasks.py,sha256=W__XjU17AX8VqOtgy8HRBmxWtVufTkFvri8s8Y3R394,6721
 manta_node/utils.py,sha256=gkYRB7fylk1jy1sm7nKU7o8eadGxn0AX4IjCHT6Wzuw,1179
 manta_node/cli/__init__.py,sha256=arzO3mXDJ-E2yeeytbZfN7mCswwxdQ43_QjyeL2E5yE,134
@@ -35,9 +35,9 @@ manta_node/infrastructure/metrics/collector.py,sha256=nhFPAbjA04ye3UaGN95_zdpf9h
 manta_node/infrastructure/metrics/metrics_collector.py,sha256=jhEocAPWS6xgbNvcBBiEB9cAN_9hEGssZJXoysQzWOk,10518
 manta_node/infrastructure/mqtt/__init__.py,sha256=riXo1sXgO4YV6DHCmWRqK61BAmuGLdHiVdQFunAJadA,140
 manta_node/infrastructure/mqtt/command_handler.py,sha256=bDH8k3Vkbbb7q3P68VamhMbtLJ4vSSivqZP3IfMBqIQ,11833
-manta_node-0.5b0.dev87.dist-info/licenses/LICENSE,sha256=P5HojupjKoAusNtHqWOvO-YFolwLFWQ7Uq0XVKK9nFQ,35291
-manta_node-0.5b0.dev87.dist-info/METADATA,sha256=7O6p9Grh2VMjJrlH7tTXB-mKyU_3yLxjcPuThNctOtY,44653
-manta_node-0.5b0.dev87.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
-manta_node-0.5b0.dev87.dist-info/entry_points.txt,sha256=C_zcw6mdmztNxVUZGLZ83UH5TwcSuqb2C-rB4e2CQoc,56
-manta_node-0.5b0.dev87.dist-info/top_level.txt,sha256=nbT5J5WETuXM9UPoQckl29uUOq8wMYdRb9QDx5kAFeo,11
-manta_node-0.5b0.dev87.dist-info/RECORD,,
+manta_node-0.5b0.dev91.dist-info/licenses/LICENSE,sha256=P5HojupjKoAusNtHqWOvO-YFolwLFWQ7Uq0XVKK9nFQ,35291
+manta_node-0.5b0.dev91.dist-info/METADATA,sha256=A0_n5jnU92mC1l6gTncaA5r-PGfkTC6W-rjDogDBXdA,44653
+manta_node-0.5b0.dev91.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+manta_node-0.5b0.dev91.dist-info/entry_points.txt,sha256=C_zcw6mdmztNxVUZGLZ83UH5TwcSuqb2C-rB4e2CQoc,56
+manta_node-0.5b0.dev91.dist-info/top_level.txt,sha256=nbT5J5WETuXM9UPoQckl29uUOq8wMYdRb9QDx5kAFeo,11
+manta_node-0.5b0.dev91.dist-info/RECORD,,