the-moby-effect
Version:
Moby/Docker API client built using effect-ts
181 lines • 9.05 kB
JavaScript
import * as Array from "effect/Array";
import * as Effect from "effect/Effect";
import * as FileSystem from "effect/FileSystem";
import * as Function from "effect/Function";
import * as HashMap from "effect/HashMap";
import * as HashSet from "effect/HashSet";
import * as Layer from "effect/Layer";
import * as Match from "effect/Match";
import * as Option from "effect/Option";
import * as Path from "effect/Path";
import * as Schedule from "effect/Schedule";
import * as Stream from "effect/Stream";
import * as String from "effect/String";
import * as Tuple from "effect/Tuple";
import * as InternetSchemas from "effect-schemas/Internet";
import * as Tar from "eftar/Tar";
import * as Untar from "eftar/Untar";
import * as DockerEngine from "../../DockerEngine.js";
import * as MobyConnection from "../../MobyConnection.js";
import * as MobyConvey from "../../MobyConvey.js";
import * as MobyEndpoints from "../../MobyEndpoints.js";
import * as internalHttpBlob from "../blobs/http.js";
import * as internalHttpsBlob from "../blobs/https.js";
import * as internalSocketBlob from "../blobs/socket.js";
import * as internalSshBlob from "../blobs/ssh.js";
import * as PortSchemas from "../schemas/port.js";
/** @internal */
const downloadDindCertificates = dindContainerId => Effect.gen(function* () {
const containers = yield* MobyEndpoints.Containers;
const certs = yield* Effect.catchTag(Untar.extractEntries(containers.archive(dindContainerId, {
path: "/certs"
}), HashSet.make("certs/server/ca.pem", "certs/server/key.pem", "certs/server/cert.pem")), "MissingEntries", () => Effect.die("Missing dind certificates in container"));
const readAndAssemble = path => Function.flow(HashMap.findFirst((_stream, header) => header.filename === path), Option.getOrThrow, Tuple.get(1), Stream.decodeText(), Stream.mkString);
return yield* Effect.all({
ca: readAndAssemble("certs/server/ca.pem")(certs),
key: readAndAssemble("certs/server/key.pem")(certs),
cert: readAndAssemble("certs/server/cert.pem")(certs)
}, {
concurrency: 3
});
});
/** @internal */
const blobForExposeBy = /*#__PURE__*/Function.pipe(/*#__PURE__*/Match.type(), /*#__PURE__*/Match.when("ssh", () => internalSshBlob.content), /*#__PURE__*/Match.when("http", () => internalHttpBlob.content), /*#__PURE__*/Match.when("https", () => internalHttpsBlob.content), /*#__PURE__*/Match.when("socket", () => internalSocketBlob.content), Match.exhaustive);
/** @internal */
const makeDindBinds = exposeDindBy => Effect.gen(function* () {
const acquireScopedVolume = Effect.acquireRelease(MobyEndpoints.Volumes.use(volumes => volumes.create({})), ({
Name
}) => Effect.orDie(MobyEndpoints.Volumes.use(volumes => volumes.delete(Name, {
force: true
}))));
const volume1 = yield* acquireScopedVolume;
const volume2 = yield* acquireScopedVolume;
const tempSocketDirectory = yield* exposeDindBy === "socket" ? Effect.gen(function* () {
const fs = yield* FileSystem.FileSystem;
const folder = yield* fs.makeTempDirectoryScoped();
yield* fs.chmod(folder, 0o777); // Ew, for github actions where uid != 1000 🤮
return folder;
}) : Effect.succeed("");
const boundDockerSocket = yield* exposeDindBy === "socket" ? Effect.map(Path.Path, path => path.join(tempSocketDirectory, "docker.sock")) : Effect.succeed("");
const mountBinds = exposeDindBy === "socket" ? [`${tempSocketDirectory}:/run/user/1000`] : [];
const volumeBinds = Tuple.make(`${volume1.Name}:/var/lib/docker`, `${volume2.Name}:/home/rootless/.local/share/docker`);
const binds = Array.appendAll(mountBinds, volumeBinds);
return [boundDockerSocket, binds];
});
/**
* Since the dind containers do not have health checks, we must wait until a
* specific log line is printed to know that the engine is ready.
*
* @internal
*/
const waitForDindContainerToBeReady = dindContainerId => Function.pipe(Effect.map(MobyEndpoints.Containers, containers => containers.logs(dindContainerId, {
follow: true,
stdout: true,
stderr: true
})), Stream.unwrap, Stream.takeUntil(String.includes("Daemon has completed initialization")), Stream.runDrain);
/**
* Spawns a docker in docker container on the remote host provided by another
* layer and exposes the dind container as a layer. This dind engine was built
* to power the unit tests and used for docker compose.
*
* @internal
*/
export const makeDindLayerFromPlatformConstructor = platformLayerConstructor => options => Effect.gen(function* () {
// The generic type of the layer constructor is too wide
// since we want to be able to pass it as the only required generic
const platformLayerConstructorCasted = platformLayerConstructor;
// Building a layer here instead of providing it to the final effect
// prevents conflicting services with the same tag in the final layer
const hostDocker = yield* Layer.build(platformLayerConstructorCasted(options.connectionOptionsToHost));
const effectWithHostDocker = Effect.provide(hostDocker);
const streamWithHostDocker = Stream.provideContext(hostDocker);
// Test that the host docker is reachable
yield* Function.pipe(DockerEngine.pingHead(), Effect.retry(Schedule.recurs(5).pipe(Schedule.addDelay(() => Effect.succeed("3 seconds")))), effectWithHostDocker);
// Build the docker image for the dind container
const dindTag = Array.lastNonEmpty(String.split(options.dindBaseImage, ":"));
const dindBlob = blobForExposeBy(options.exposeDindContainerBy);
const buildStream = streamWithHostDocker(DockerEngine.build({
dockerfile: "Dockerfile",
buildargs: {
DIND_BASE_IMAGE: options.dindBaseImage
},
tag: `the-moby-effect-${options.exposeDindContainerBy}-${dindTag}:latest`,
context: Tar.tarballFromMemory(HashMap.make(["Dockerfile", dindBlob]))
}));
// Wait for the image to be built
yield* MobyConvey.waitForProgressToComplete(buildStream);
// Create volumes and binds for the container so they can be cleaned up after
const [boundDockerSocket, binds] = yield* effectWithHostDocker(makeDindBinds(options.exposeDindContainerBy));
// Create the dind container
const zeroHostPort = yield* InternetSchemas.Port.makeEffect(0);
const zeroHostPortBinding = yield* PortSchemas.PortBinding.makeEffect({
HostPort: zeroHostPort
});
const containerInspectResponse = yield* effectWithHostDocker(DockerEngine.runScoped({
Image: `the-moby-effect-${options.exposeDindContainerBy}-${dindTag}:latest`,
Volumes: {
"/var/lib/docker": {},
"/home/rootless/.local/share/docker": {}
},
ExposedPorts: {
"22/tcp": {},
"2375/tcp": {},
"2376/tcp": {}
},
HostConfig: {
Privileged: true,
Binds: binds,
PortBindings: {
"22/tcp": [zeroHostPortBinding],
"2375/tcp": [zeroHostPortBinding],
"2376/tcp": [zeroHostPortBinding]
}
}
}));
// Extract the ports from the container inspect response
const tryGetPort = Function.flow(Option.fromNullishOr, Option.getOrThrow);
const sshPort = tryGetPort(containerInspectResponse.NetworkSettings?.Ports?.["22/tcp"]?.[0]?.HostPort);
const httpPort = tryGetPort(containerInspectResponse.NetworkSettings?.Ports?.["2375/tcp"]?.[0]?.HostPort);
const httpsPort = tryGetPort(containerInspectResponse.NetworkSettings?.Ports?.["2376/tcp"]?.[0]?.HostPort);
// Get the host from the connection options
const host = Function.pipe(Match.value(options.connectionOptionsToHost), Match.tag("socket", () => "localhost"), Match.orElse(({
host
}) => host));
// Wait for the dind container to be ready
yield* effectWithHostDocker(waitForDindContainerToBeReady(containerInspectResponse.Id));
// Get the engine certificates if we are exposing the dind container by https
const {
ca,
cert,
key
} = yield* options.exposeDindContainerBy === "https" ? effectWithHostDocker(downloadDindCertificates(containerInspectResponse.Id)) : Effect.succeed({
ca: "",
cert: "",
key: ""
});
// Craft the connection options
const connectionOptions = Function.pipe(Match.value(options.exposeDindContainerBy), Match.when("socket", () => MobyConnection.SocketConnectionOptions({
socketPath: boundDockerSocket
})), Match.when("http", () => MobyConnection.HttpConnectionOptions({
host,
port: httpPort
})), Match.when("https", () => MobyConnection.HttpsConnectionOptions({
host,
port: httpsPort,
ca,
key,
cert
})), Match.when("ssh", () => MobyConnection.SshConnectionOptions({
host,
port: sshPort,
username: "root",
password: "password",
remoteSocketPath: "/var/run/docker.sock"
})), Match.exhaustive);
// Build the layer for the same platform that we are on
const layer = platformLayerConstructorCasted(connectionOptions);
// Test that the dind container is reachable
yield* Function.pipe(DockerEngine.pingHead(), Effect.retry(Schedule.recurs(5).pipe(Schedule.addDelay(() => Effect.succeed("3 seconds")))), Effect.provide(layer));
return layer;
}).pipe(Layer.unwrap);
//# sourceMappingURL=dind.js.map